A data processing method, device, computer, storage medium and program product

Abstract

The embodiment of the present application discloses a data processing method, device, computer, storage medium and program product, which relates to the field of computers. The method is applied to a trusted third-party object, including: obtaining a first business processing request sent by a first business object, determining a first access database based on the first business processing request; obtaining first permission information associated with the first access database, creating a second access database based on the first permission information and the first access database, and updating the first business processing request to a second business processing request based on the second access database; executing the second business processing request for the second access database, obtaining business request data, and sending a request result for the first business processing request to the first business object based on the business request data. By adopting the present application, resource overhead can be reduced and computing efficiency can be improved under the premise of ensuring data security computing of all parties.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, device, computer, storage medium and program product. Background Art

[0002] In advertising, finance and other scenarios, multiple parties (usually two parties) need to combine their data for analysis. However, due to laws, regulations, commercial competition and other factors, data has formed data islands in different entities, organizations and companies. When one party needs the data of the other party for calculation and analysis, the other party cannot directly display the data. In order to promote the circulation and cooperation of data elements of all parties, various data security computing technologies have been developed, for example, through federated learning, joint analysis, and the creation of data closed domains or data clean rooms. However, most of the privacy computing solutions through federated learning and joint analysis rely on homomorphic encryption with high computational overhead or multi-party secure computing with high communication overhead. When the data scale is large, the overall efficiency is not high; by creating a closed data domain, each calculation requires moving the data of all parties to a closed and isolated space, which has high movement overhead. Summary of the invention

[0003] The embodiments of the present application provide a data processing method, device, computer, storage medium and program product, which can reduce resource overhead and improve computing efficiency while ensuring the secure computing of data of all parties.

[0004] On the one hand, an embodiment of the present application provides a data processing method, which is applied to a trusted third-party object; the method includes:

[0005] Acquire a first business processing request sent by a first business object, and determine a first access database based on the first business processing request;

[0006] Acquire first permission information associated with the first access database, create a second access database based on the first permission information and the first access database, and update the first service processing request to a second service processing request based on the second access database;

[0007] A second service processing request is executed on the second access database to obtain service request data, and a request result for the first service processing request is sent to the first service object based on the service request data.

[0008] An embodiment of the present application provides a data processing device, the device comprising:

[0009] A request acquisition module, used to acquire a first business processing request sent by a first business object, and determine a first access database based on the first business processing request;

[0010] A data updating module, configured to obtain first permission information associated with the first access database, create a second access database based on the first permission information and the first access database, and update the first service processing request to a second service processing request based on the second access database;

[0011] The data execution module is used to execute the second business processing request on the second access database, obtain business request data, and send a request result for the first business processing request to the first business object based on the business request data.

[0012] In a possible implementation, when the data update module is used to create the second access database based on the first permission information and the first access database, the data update module is specifically used to perform the following operations:

[0013] Determine the access scope in the first permission information, and obtain the accessible business data from the first access database based on the access scope;

[0014] Based on the first database name of the first access database, the second database name is determined, the accessible business data is used as the database content, and the second database name and the database content are combined into a second access database.

[0015] In a possible implementation, the number of first access databases is N, where N is a positive integer; when the data update module is used to create the second access database based on the first permission information and the first access database, the data update module is specifically used to perform the following operations:

[0016] Obtain request business objects corresponding to N first access databases respectively;

[0017] If the N requested business objects include the first business object, the first access database of the first business object is determined as the second access database of the first business object, and the second access database of the second business object is created based on the first permission information of the second business object and the first access database of the second business object; the second business object is the business object other than the first business object among the N requested business objects.

[0018] In a possible implementation, the first permission information includes access rights; the data processing device further includes a permission verification module, and the permission verification module is specifically configured to perform the following operations:

[0019] Parsing the second service processing request to obtain request information corresponding to the second service processing request;

[0020] Performing permission verification on the request information based on the access permission associated with the second access database;

[0021] If the authority verification of the request information fails, a request failure message is sent to the first business object;

[0022] If the authority verification of the request information is passed, a process of executing the second service processing request on the second access database to obtain service request data is performed.

[0023] In a possible implementation, the request information includes a business keyword and a data column to be accessed corresponding to the business keyword, and a request query format; when the authority verification module is used to perform authority verification on the request information based on the access authority associated with the second access database, the authority verification module is specifically used to perform the following operations:

[0024] Obtaining the accessible data column corresponding to the business keyword from the access permission, if the accessible data column includes the data column to be accessed, and the request query format belongs to the permitted query format in the access permission, then determining that the permission verification of the request information is passed; the permitted query format is used to indicate the number of query nesting levels allowed for the second access database;

[0025] If the accessible data column does not include the to-be-accessed data column, or the request query format does not belong to the permitted query format in the access permission, it is determined that the permission verification of the requested information fails.

[0026] In a possible implementation, the first permission information includes an output condition; the output condition is used to indicate a data condition that the first access database is allowed to be obtained; the data execution module is used to execute the second business processing request for the second access database, and when the business request data is obtained, the data execution module is specifically used to perform the following operations:

[0027] Execute the second business processing request on the second access database to obtain execution result data;

[0028] If the execution result data does not meet the output condition, the empty data is determined as the business request data, or the execution result data is screened based on the output condition to obtain the business request data;

[0029] If the execution result data meets the output condition, the execution result data is determined as the business request data.

[0030] In a possible implementation, the data execution module is used to execute the second service processing request on the second access database, and when the execution result data is obtained, the data execution module is specifically used to perform the following operations:

[0031] Parsing the second business processing request to obtain M query instructions included in the second business processing request and an instruction execution order corresponding to the M query instructions; M is a positive integer;

[0032] Based on the instruction execution order corresponding to the M query instructions, the second business processing request is split into M query statements, and the M query statements are executed in sequence on the second access database to obtain execution result data corresponding to the M query statements respectively.

[0033] In a possible implementation, the data execution module is used to filter the execution result data based on the output condition. When the business request data is obtained, the data execution module is specifically used to perform the following operations:

[0034] Obtain P data items included in the execution result data, and obtain a screening data column from the output condition; P is a positive integer;

[0035] The P data items are grouped based on the screening data column to obtain Q data groups; Q is a positive integer less than or equal to P, and each data group includes one or more data items;

[0036] Based on the number of data items included in each data group and Q, the execution result data is screened to obtain the business request data.

[0037] In a possible implementation, when the data execution module is used to send a request result for the first business processing request to the first business object based on the business request data, the data execution module is specifically used to perform the following operations:

[0038] Determine the business request data as a request result for the first business processing request, and send the request result to the first business object;

[0039] Alternatively, obtain the business requirements included in the first business processing request, obtain standard data indicators corresponding to the business requirements, perform statistics and integration on the business request data based on the business requirements to obtain business statistical information, parse the business statistical information based on the standard data indicators to obtain business analysis results, determine the business request data and the business analysis results as the request results for the first business processing request, and send the request results to the first business object.

[0040] In a possible implementation, the first permission information includes first permission information associated with the first business object; when the data execution module is used to send a request result for the first business processing request to the first business object based on the business request data, the data execution module is specifically used to perform the following operations:

[0041] If the first access database includes the first access database of the first business object, a request result for the first business processing request and a data completion prompt message are sent to the first business object based on the business request data, so that the first business object determines the business data to be requested from the first business processing request based on the first authority information of the first business object, obtains the business data to be supplemented from the business data to be requested based on the first business processing request, and determines the business data to be supplemented and the request result as the target result of the first business processing request; the business data to be requested is the business data in the first access database of the first business object, except for the second access database corresponding to the first business object.

[0042] In a possible implementation, the data processing device further includes a space creation module, and the space creation module is specifically configured to perform the following operations:

[0043] Obtaining permission information of a business object; the business object includes a first business object;

[0044] Create a collaboration space for the business object, store the permission information of the business object in the collaboration space, and associate the collaboration space with the data storage space of the business object;

[0045] The data updating module is used to obtain the first permission information associated with the first access database. When creating the second access database based on the first permission information and the first access database, the data updating module is specifically used to perform the following operations:

[0046] Acquire a request business object corresponding to the first access database, and acquire first permission information of the request business object from a request cooperation space corresponding to the request business object; the business object includes the request business object;

[0047] By requesting the request cooperation space corresponding to the request business object, the database content in the first access database is requested from the data storage space associated with the request cooperation space, and the second access database is created based on the database content in the first access database.

[0048] On the one hand, an embodiment of the present application provides a computer device, including a processor, a memory, and an input and output interface;

[0049] The processor is connected to the memory and the input / output interface respectively, wherein the input / output interface is used to receive and output data, the memory is used to store a computer program, and the processor is used to call the computer program so that a computer device including the processor executes the method in one aspect of an embodiment of the present application.

[0050] On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is suitable for being loaded and executed by a processor so that a computer device having the processor executes the method in one aspect of the embodiment of the present application.

[0051] In one aspect, an embodiment of the present application provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method provided in various optional ways in one aspect of the embodiment of the present application. In other words, when the computer instruction is executed by the processor, the method provided in various optional ways in one aspect of the embodiment of the present application is implemented.

[0052] Implementing the embodiments of the present application will have the following beneficial effects:

[0053] In an embodiment of the present application, a first business processing request sent by a first business object is obtained, and a first access database is determined based on the first business processing request; first permission information associated with the first access database is obtained, and a second access database is created based on the first permission information and the first access database, and the first business processing request is updated to a second business processing request based on the second access database; the second business processing request is executed for the second access database to obtain business request data, and a request result for the first business processing request is sent to the first business object based on the business request data. Through the above process, the computing resources provided by the trusted third-party object are fully utilized to process the first business processing request involving data of all parties for the first business object, and then the first permission information is used to limit the scope of use of the data to prevent data leakage. While performing secure computing, the first business object does not need to prepare, configure, and maintain computing resources by itself, which reduces the resource overhead of the first business object, and does not need to use cryptography with high overhead for data encryption or multi-party secure computing with high communication overhead, so computing efficiency can be guaranteed even when the data scale is large. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 This is a network interaction architecture diagram provided by an embodiment of the present application;

[0056] Figure 2 It is a scenario schematic diagram of a data processing method provided in an embodiment of the present application;

[0057] Figure 3 This is a data processing method provided by the embodiment of the present application. Figure 1 ;

[0058] Figure 4 This is a schematic diagram of a scenario for creating a collaborative space provided in an embodiment of the present application;

[0059] Figure 5 This is a data processing method provided by the embodiment of the present application. Figure 2 ;

[0060] Figure 6 It is a business processing flow chart provided by an embodiment of the present application;

[0061] Figure 7 is a schematic diagram of a data processing device provided in an embodiment of the present application;

[0062] Figure 8 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0064] Among them, if it is necessary to collect object (such as user, etc.) data in this application, a prompt interface or pop-up window will be displayed before and during the collection. The prompt interface or pop-up window is used to prompt the user that certain data is currently being collected. Only after the user confirms the prompt interface or pop-up window, the relevant steps of data acquisition will be started, otherwise it will end. Moreover, the acquired user data will be used in reasonable and legal scenarios or purposes. Optionally, in some scenarios where user data needs to be used but has not been authorized by the user, authorization can be requested from the user, and the user data can be used when the authorization is passed.

[0065] It is understandable that in the specific implementation of this application, the user data involved, when the following embodiments of this application are applied to specific products or technologies, needs to obtain user permission or consent, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of the relevant regions.

[0066] Among them, Structured Query Language (SQL) is a special-purpose programming language used to manage relational database management systems or perform stream processing in relational stream data management systems.

[0067] In the examples of this application, see Figure 1 , Figure 1 is a network interaction architecture diagram provided by an embodiment of the present application, such as Figure 1 As shown, the network interaction architecture diagram may include a computer device 101 and a business device cluster, and the business device cluster may include business devices 102a, business devices 102b, business devices 102c, ..., business devices 102n, wherein there may be a communication connection between the business device clusters, for example, there is a communication connection between the business device 102a and the business device 102b, and there is a communication connection between the business device 102a and the business device 102c. At the same time, any business device in the business device cluster may have a communication connection with the computer device 101, for example, there is a communication connection between the business device 102a and the computer device 101, wherein the above-mentioned communication connection does not limit the connection method, and may be directly or indirectly connected through a wired communication method, or directly or indirectly connected through a wireless communication method, or through other methods, and this application does not limit it here.

[0068] It should be understood that Figure 1 Each business device in the business device cluster shown may belong to a different business object, or multiple business devices may belong to the same business object, for example, business device 102a, business device 102b belong to business object A, business device 102c belongs to business object B, and business device 102n belongs to business object C. Each business device may be installed with an application client provided by a trusted third-party object to which computer device 101 belongs. When the application client runs in each business device, each business device may communicate with the above-mentioned third-party object through the application client. Figure 1 The computer devices 101 shown perform data interaction, so that the computer device 101 can receive business data from each business device. The application client can be an independent client or an embedded sub-client integrated in a client (such as an instant messaging client, a social client, a browser client, etc.), which is not limited here.

[0069] like Figure 1The computer device shown can be a computing resource (i.e., a computing machine) provided by a trusted third-party object for the business objects corresponding to each business device for computing business processing requests. Taking the business device 102b corresponding to the first business object as an example, each business object can store its own business data in a cloud server provided by a trusted third party, and upload data usage rights (i.e., permission information) for its own business data. The computer device can create a cooperation space for business objects with cooperation needs, and call the storage data of different business objects through access control for joint computing. The cooperation space is a logical concept and does not require a real physically isolated computing machine to implement. Among them, the permission information of the business object is used to indicate the restriction conditions when the business object provides its own business data to other business objects.

[0070] Specifically, the business object includes a first business object (i.e., the initiator of the computing request). The computer device 101 can obtain the first business object, that is, the first business processing request sent by the business device 102b, determine the first access database indicated by the first business processing request, and obtain the first permission information associated with the first access database. Based on the first permission information and the first access database, a second access database is created (i.e., the data content that the computer device 101 has the right to access), and the first business processing request is updated. The second business processing request is executed based on the second access database to obtain the business request data. Furthermore, the computer device 101 can send a request result for the first business processing request to the first business object (business device 102b) based on the business request data. The first business processing request may include data query instructions, such as SQL instructions, for example, "(SELECT COUNT( ) FROM orders WHERE status = 'completed') AS completed_orders", a SELECT-FROM-WHERE statement can be called a query block. This SQL instruction is used to instruct to query the orders with the status of "completed" in the table named "orders", and calculate the number of orders that meet the conditions through the COUNT aggregate function, and name the queried result "completed_orders". The first access database determined in the SQL instruction example is the table "orders". It can be understood that the number of first access databases determined from the first business processing request can be one or more, and the business objects involved can also be multiple. The actual situation is determined by the needs of the first business object.

[0071] For example, the first business object may request to calculate the relevant business data of itself and its partners, or may request to calculate the relevant business data of its partners. The partners may include one or more business objects, and the first access databases associated with one business object may also be one or more. The process in which the computer device 101 creates the second access database based on the first permission information and the first access database is that the computer device 101 determines from the first permission information that it can access part of the data content in the first access database, and creates the second access database for the part of the data content. The first permission information is the permission range configured by the data subordinate party associated with the first access database. If the first access database includes the first access database of the first business object and the first access database of the second business object (i.e., the partner), the computer device 101 needs to obtain the first permission information associated with the two first access databases respectively.

[0072] Through the above process, a trusted third-party object is introduced to establish a cooperation space for cooperating business objects, provide computing resources for joint computing or analysis of data, and process the first business processing request involving data of all parties for the first business object. While using the first permission information to limit the scope of data use and prevent data leakage, and performing secure computing, the first business object does not need to prepare, configure, and maintain computing resources by itself, thereby reducing the resource overhead of the first business object, and does not need to use expensive cryptography for data encryption or multi-party secure computing with high communication overhead. Even when the data scale is large, computing efficiency can be guaranteed.

[0073] For details, see Figure 2 , Figure 2 This is a scenario diagram of a data processing method provided by an embodiment of the present application. Taking the data processing method applied to advertising revenue analysis as an example, advertisers and parties involved in advertising store business data on the same cloud server (provided by a trusted third-party object). When advertisers and parties involved in advertising want to collaborate in analyzing advertising delivery effect data, the trusted third-party object can use the data stored by the two parties for calculation. For example, a cooperation space is established for the two parties. The cooperation space can be considered as a centralized data clean room. A data clean room is generally a trusted computing space created by isolation means such as access control. It can be used to integrate and calculate data from multiple parties. The cooperation space is a logical isolation space, where logical isolation refers to isolation at the logical level, separating different resources, services or users, but they may run in the same physical environment.

[0074] Take the advertiser as the first business object (the initiator of the computing task) as an example. Figure 2As shown, the computer device corresponding to the trusted third-party object can receive the first business processing request sent by the first business object. At this time, the first business processing request can include an SQL instruction requesting to calculate the advertising delivery effect data and a request to analyze the advertising delivery effect. The computer device corresponding to the trusted third-party object, the created collaboration space can include a computing cluster and a structured language computing engine (SQL computing engine), the computing cluster is a processing resource pool including at least two computing nodes; the computing node is a node with data processing capabilities, which can be used to remotely access and process business data; the SQL computing engine is an engine that allows the use of SQL statements to query and analyze data. The computer device can jointly process the first business processing request through the computing cluster and the SQL computing engine, and determine the first access database from the first business processing request. The first access database is the storage location of the business data that needs to be accessed as indicated in the first business processing request, for example, it can be one or more data tables.

[0075] The computer device can obtain the first permission information associated with the first access database, and the first permission information is the data usage permission uploaded by the business object indicated by the first access database obtained by the computer device. If the first business processing request indicates that part of the business data of the first business object and part of the business data of the second business object need to be used, that is, the first access database includes the first access database of the first business object and the first access database of the second business object, then the first permission information includes the data usage permission uploaded by the first business object and the last data usage permission of the second business object. Among them, the second business object is the first business processing request (i.e., computing task) initiated by the first business object, and the indicated participant indicates that the first business processing request needs to use the business data of the second business object, and the second business object may include one or more business objects. It can be understood that the database content (the actual business data therein) of the first access database determined by the computer device is stored in the data warehouse of the cloud server provided by the trusted third-party object. The data warehouse includes business data 1, business data 2, ..., business data n, where n is a positive integer. The n business data can belong to n business objects respectively, or multiple business data can belong to the same business object. The business data of different business objects are isolated from each other and cannot be connected to each other. In addition to the business objects corresponding to the business data, they can only be accessed by trusted third-party objects with certain access permissions.

[0076] The computer device can remotely access the data warehouse (i.e., the data storage space of the business object) through the SQL computing engine, determine the database content of the first access database from the business database, and then determine the accessible business data in the first access database through the first permission information, determine the second database name based on the first database name of the first access database, and form the second access database with the second database name and the accessible data. For example, if the first database name of the first access database is "table.a", please refer to Table 1, which is an example of a partial database content of the first access database. The first permission information uploaded by the business object corresponding to "table.a" indicates that the column permissions of the "table.a" table are restricted to id, Click_rate and date, and the row permission is date!=20210716, that is, only the data columns named "id", "Click_rate" and "date" can be accessed, and the data in the "date" data column is not equal to "20210716", that is, the id and Click_rate indicated by the data row with date=20210716 in the "table.a" table cannot be accessed:

[0077] Table 1 (table.a)

[0078]

[0079] The computer device can create a second access database through an SQL instruction, such as "CREATE OR REPLACE TEMPORARY VIEWtable.a_authorized AS SELECT id, Click_rate, date FROM table.a WHERE date!=20210716". At this time, the second database name can be expressed as "table.a_authorized". For example, see Table 2, which is an example of partial database content of the second access database. The data content in Table 2 is the accessible business data content:

[0080] Table 2 (table.a_authorized)

[0081]

[0082] The computer device may update the first business processing request to a second business processing request, for example, changing "table.a" in the first business processing request to "table.a_authorized" to obtain the second business processing request. The computer device executes the second business processing request for the second access database to obtain business request data. If the first business processing request indicates that a business analysis needs to be performed on the business request data, such as an analysis of the effectiveness of advertising, the computer device performs business analysis based on the business request data to obtain a business analysis result. The business analysis result may include advertising placement recommendations for advertisers, such as recommendations to increase advertising placement in a certain time period in the future. The computer device may use the business request data and the business analysis result as a request result for the first business processing request, and send the request result to the first business object.

[0083] Through the above process, a trusted third-party object is introduced to establish a cooperation space for cooperating business objects, provide computing resources for joint computing or analysis of data, and process the first business processing request involving data of all parties for the first business object. The access rights in the first permission information are used to limit the use scope of rows and columns in the first access database to prevent data leakage. While performing secure computing, the first business object and the participating parties do not need to prepare, configure, and maintain computing resources by themselves, thereby reducing the resource overhead of the first business object and the participating parties, and do not need to use expensive cryptography for data encryption or multi-party secure computing with high communication overhead. Even when the data scale is large, computing efficiency can be guaranteed; at the same time, when performing data computing, the required business data can be mounted on the same computing unit for remote access, without the need to physically move the required business data to the cooperation space, thereby reducing storage overhead.

[0084] It is understandable that the business equipment mentioned in the embodiments of the present application may also be a computer device, and the computer equipment in the embodiments of the present application includes but is not limited to a terminal device or a server. In other words, the computer device may be a server or a terminal device, or it may be a system composed of a server and a terminal device. Among them, the terminal device mentioned above may be an electronic device, including but not limited to mobile phones, tablet computers, desktop computers, laptop computers, PDAs, vehicle-mounted devices, augmented reality / virtual reality (AR / VR) devices, helmet displays, smart TVs, wearable devices, smart speakers, digital cameras, cameras and other mobile Internet devices (mobile internet device, MID) with network access capabilities, or terminal devices in scenarios such as trains, ships, and flights. Figure 1As shown in , the terminal device may be a desktop computer (as shown in business device 102b), a mobile phone (as shown in business device 102a), a tablet computer (as shown in business device 102c) or a laptop computer (as shown in business device 102n), etc. Figure 1 Only some of the devices are listed. The servers mentioned above can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, vehicle-road collaboration, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0085] Optionally, the data involved in the embodiments of the present application can be stored in a computer device, or the data can be stored based on cloud storage technology or a blockchain network, which is not limited here.

[0086] See also Figure 3 , Figure 3 This is a data processing method provided by the embodiment of the present application. Figure 1 .like Figure 3 As shown, it is applied to a trusted third-party object to describe the data processing process, which includes the following steps:

[0087] Step S301: obtaining a first business processing request sent by a first business object, and determining a first access database based on the first business processing request.

[0088] In an embodiment of the present application, a computer device can receive a first business processing request sent by a first business object, and complete the processing process of the first business processing request in a collaborative space. Wherein, the first business object is the initiator of the computing task of data cooperative analysis, and the first business processing request may include a data query instruction, and optionally, may also include a result data analysis request, etc., wherein the data query instruction is used to indicate the specific computing request of the first business processing request, such as an SQL instruction, etc., and the result data analysis request is used to indicate the purpose of analyzing the data obtained by the data query instruction. For example, the SQL instruction can be expressed as "SELECT id, data FROM table_a WHERE data!=20210716". Wherein, id, data is used to indicate that the data column to be queried is the data column corresponding to the data column name id and data, table_a is used to indicate that the table name of the table to be queried is table_a, and data!=20210716 is used to indicate the query condition, that is, to query the data whose value in the data column date is not equal to 20210716, and the first access database determined based on the SQL instruction is table_a. It is understandable that the first business processing request may request calculation of its own and partner's business data, or may only request calculation of partner's business data, that is, table_a in the above SQL instruction example may belong to the partner, that is, the second business object.

[0089] It can be understood that there can be multiple second business objects, that is, the first business object can conduct data cooperation analysis with multiple participants. The specific second business object is determined by the owner of the first access database determined in the first business processing request sent by the first business object, that is, if there are three first access databases, and one of the first access databases belongs to the first business object, the other two first access databases can belong to two different second business objects respectively.

[0090] Step S302: acquiring first authority information associated with the first access database, creating a second access database based on the first authority information and the first access database, and updating the first service processing request to a second service processing request based on the second access database.

[0091] In an embodiment of the present application, a computer device obtains first permission information associated with a first access database through a collaboration space. The first permission information is uploaded by a requesting business object obtained by the computer device when creating a collaboration space for the requesting business object, and is used to indicate the data usage scope of the business data of the requesting business object by other business objects. For example, if the first access database belongs to a second business object A, the first permission information is the data usage scope uploaded by the second business object A. The requesting business object refers to the business object to which the first access database associated with the first business request belongs. The computer device can determine the access scope of the data based on the first permission information, determine the accessible data from the first access database based on the access scope, and create a second access database for the accessible data. The database name of the second access database is determined by the database name of the first access database, and the two can be associated. For example, the database name of the first access database can be "table.b", and the database name of the second access database can be expressed as "table.b_authorized". The database content of the second access database can be the accessible data determined from the first access database. The second access database can be used to indicate the data content that the computer device can access for the first business processing request. Furthermore, the computer device may update the first business processing request to a second business processing request based on the second access database. For example, the computer device may update the database name "table.b" of the first access database in the SQL instruction in the first business processing request to the database name "table.b_authorized" of the second access database to obtain the second business processing request.

[0092] Step S303: execute the second service processing request on the second access database to obtain service request data, and send a request result for the first service processing request to the first service object based on the service request data.

[0093] In an embodiment of the present application, the computer device may execute the second business processing request for the second access database to obtain business request data. The business request data may include the execution result of the SQL instruction in the second business processing request, or, when the SQL instruction in the second business processing request includes function calculation (for example, count function, sum function, avg function), the business request data may include the query result obtained by executing the SQL instruction in the second business processing request from the second access database and the calculation result of the function calculation performed on the query result.

[0094] The computer device may send a request result for the first business processing request to the first business object based on the business request data. If the first business processing request only includes SQL instructions, the computer device may determine the business request data as the request result of the first business processing request, and send the request result to the first business object. If the first business processing request includes SQL instructions and a request for data analysis of the results obtained by the SQL instructions, the computer device may determine the business request data and the analysis results of the business request data as the request result of the first business processing request, and send the request result to the first business object. For example, when the first business object is an advertiser and wants to cooperate with the parties involved in advertising to analyze the advertising delivery effect data, the advertising delivery effectiveness can be analyzed based on the business request data (i.e., the delivery data related to the advertisement). For example, the business request data can be used to analyze the number of times the advertisement is displayed, the click-through rate (the ratio of the number of times the advertisement is clicked to the number of times it is displayed), the conversion rate (the proportion of users who actually purchase the product or service after clicking the advertisement), the expenditure (the funds invested in the advertisement), the cost per click (the average cost per click of the advertisement), the cost per conversion (the average cost per conversion), etc., so that the first business object (advertiser) can understand the delivery effect of the advertisement based on the delivery effectiveness and optimize future advertising delivery strategies.

[0095] It is understandable that before the computer device obtains the first service processing request sent by the first service object, the computer device also needs to create a cooperation space for the first service object and its partners. Figure 4 , Figure 4 is a schematic diagram of a scenario for creating a collaborative space provided in an embodiment of the present application, such as Figure 4 As shown, the computer device corresponding to the trusted third-party object can obtain the permission information (permission information 1, permission information 2, ..., permission information n) uploaded by the business objects (including business object C1, business object C2, ..., business object Cn), where the business objects include the first business object.

[0096] For example, here, business object C1 is taken as the first business object, and business objects C2, ..., business objects Cn are the various participants or partners who conduct data cooperation analysis with the first business object. The computer device creates a cooperation space for the business object, stores the permission information of each business object in the cooperation space, and associates the cooperation space with the data storage space of each business object. The permission information 1 of the first business object includes the first permission information of the first business object. Optionally, the computer device can provide a permission configuration template before the permission information of each business object, so that each business object can use the permission configuration template for simple configuration to obtain its own permission information.

[0097] For example, the first permission information may include access permissions, which may include data row and column permissions and operator access permissions. A business object may configure the database and table permissions of the data that can be used by other business objects except itself in the data row and column permissions, as well as the row and column permissions that can be used in each table, that is, the data rows and data columns that can be accessed in each table.

[0098] Optionally, the business object can configure the execution permissions of each operator (i.e., business keywords, such as SELECT, JOIN, UDAF, etc.) in the SQL query statement in the operator access permissions. For example, it can include but is not limited to the data columns that the business object is allowed to execute SELECT, WHERE, UNION, HAVING, etc.; whether JOIN must be executed before calculation, and the data columns that JOIN is allowed to execute; whether the primary key is allowed to be GROUP BY, and the data columns that are allowed to be GROUP BY; the UDFs and UDAFs that are allowed to be used and the corresponding data columns that are allowed to be calculated by these functions; whether subqueries are allowed, etc.

[0099] Optionally, the first permission information may also include output conditions. The business object may configure in the output conditions whether the result data of the SQL query statement needs to be restricted. The output conditions are used to indicate the restriction conditions on the data provided to other business objects, such as whether the output result data must be the result after using UDAF; whether the amount of data with different result values ​​needs to exceed a specified threshold; whether the output needs to meet K-anonymity, T-closeness, L-diversity, and the corresponding K, T, L values; whether the output result data needs to meet differential privacy (DP), and the privacy budget threshold allowed by DP. In general, the public attributes in a data table can be divided into three categories: identifiers, quasi-identifiers, and sensitive data. An identifier is generally a unique identifier for a single piece of data, such as name, address, phone number, etc.; a quasi-identifier refers to an identifier that is not unique, such as a zip code, age, birthday, etc., but can help manage related data; sensitive data refers to data such as advertising data, purchase preferences, salary, etc., which are the most valuable data for research or analysis in a data table. Among them, K-anonymity requires that in the output data, each equivalence class with the same attribute value of the specified identifier (identifier or quasi-identifier) ​​contains at least K records. T-closeness is to ensure that in the same quasi-identifier type group, the distribution of sensitive information is close to that of the entire data, and does not exceed the threshold T. L-diversity ensures that there are at least L sensitive attributes with different contents in the same type of data. Differential privacy refers to adding a small amount of noise to the data to protect the privacy of user data while ensuring the accuracy of function calculation.

[0100] Through the above process, a trusted third-party object is introduced to establish a cooperation space for the cooperating business objects, separate computing (i.e., cooperation space) from storage (i.e., data storage space), and associate the data storage space of the business object with the cooperation space. There is no need to move the business data of the business object to the cooperation space, thereby reducing data movement overhead and data storage overhead. Moreover, the cooperation space is a virtual logical concept, not a physically closed space like a closed domain. Therefore, computing resources can be provided to perform joint computing or analysis of data for multiple different business objects, thereby realizing resource reuse and sharing, and improving resource utilization. At the same time, when processing the first business processing request involving data of all parties for the first business object, while using the first permission information to limit the scope of data use, prevent data leakage, and perform secure computing, the first business object does not need to prepare, configure, and maintain computing resources by itself, thereby reducing the resource overhead of the first business object, and does not need to use cryptography with high overhead for data encryption or multi-party secure computing with high communication overhead. Even when the data scale is large, computing efficiency can be guaranteed.

[0101] See also Figure 5 , Figure 5 This is a data processing method provided by the embodiment of the present application. Figure 2 . Applied to trusted third-party objects, such as Figure 5 As shown, it is used to describe the data processing process, which includes the following steps:

[0102] Step S501: obtaining a first business processing request sent by a first business object, and determining a first access database based on the first business processing request.

[0103] In the embodiment of the present application, the specific implementation process of step S501 can be referred to as follows. Figure 3 The specific description of step S301 shown in FIG. 1 is not repeated here.

[0104] Step S502: acquiring first authority information associated with the first access database, creating a second access database based on the first authority information and the first access database, and updating the first service processing request to a second service processing request based on the second access database.

[0105] In an embodiment of the present application, a computer device can obtain the first permission information associated with a first access database, determine the access scope in the first permission information, and obtain accessible business data from the first access database based on the access scope, that is, the computer device can determine the business object associated with the first access database, obtain the data usage permission uploaded by the business object as the first permission information, and determine the access scope in the first access database therefrom. For example, there are data columns 1, data columns 2, data columns 3, and data columns 4 in the first access database. If the access scope determined based on the first permission information indicates that the trusted third-party object corresponding to the computer device can only access data columns 1 and data columns 4, that is, it has access rights to data columns 1 and data columns 4 in the first access database, then the computer device can determine all data contents corresponding to data columns 1 and data columns 4 as accessible business data.

[0106] Optionally, when a business object uploads permission information to a trusted third-party object, it can upload permission information for other business objects. In this case, the request business object associated with the first access database can be obtained, and the first permission information uploaded by the request business object can be obtained. Alternatively, when a business object uploads permission information to a trusted third-party object, it can upload different permission information for different other business objects, that is, provide different data for different business objects. In this case, the request business object associated with the first access database can be obtained, and the first permission information uploaded by the request business object for the first business object can be obtained, such as business object 1 uploads permission information 1 for business object 2, and uploads permission information 2 for business objects 3 and business objects 4. Assuming that the first business object is business object 1, and the request business object includes business object 3 and business object 4, permission information 2 uploaded by business object 1 for business objects 3 and business objects 4 can be obtained, and permission information 2 is determined as the first permission information.

[0107] The computer device determines the second database name based on the first database name of the first access database. In general, for ease of understanding, the second database name generated by the computer device is associated or indicative with the first database name. For example, if the first database name is "table.c", the second database name can be expressed as "table.c_authorized", indicating an authorized database for the database "table.c". The computer device can use the above-determined accessible business data as database content, combine the second database name with the database content, and generate a second access database.

[0108] Optionally, the number of first access databases is N, where N is a positive integer; the specific implementation process of the computer device creating the second access database based on the first permission information and the first access database may also be: the computer device obtains the request business objects corresponding to the N first access databases, and can create the second access database of the request business object based on the first permission information of each request business object and the first access database of the request business object.

[0109] Alternatively, the computer device obtains the request business objects corresponding to N first access databases respectively. If the N request business objects include the first business object, that is, when the first business object initiates a first business processing request, it includes requesting its own business data for business processing, then the computer device directly determines the first access database of the first business object as the second access database of the first business object.

[0110] Since the first business object has full access rights to the first access database of the first business object, but the access rights of the computer device corresponding to the trusted third-party object to the first access database of the first business object are determined by the first permission information uploaded by the first business object, when the first permission information uploaded by the first business object does not include full access rights to the first access database of the first business object, the computer device can send incomplete permission prompt information to the first business object after determining the second access database, to remind the first business object to supplement the corresponding access rights, or directly supplement the part of the data that is not authorized to be accessed in the second access database. For the second access database of the second business object, the computer device can create a second access database of the second business object based on the first permission information of the second business object, that is, the first access database of the second business object. Among them, the second business object is a business object other than the first business object among the N request business objects. If the first business object is not included in the N request business objects, the second access database of the request business object can be created directly based on the first permission information of each request business object and the first access database of the request business object.

[0111] It should be noted that before receiving the first business processing request of the first business object, the computer device may also obtain the permission information of the business object; wherein the business object includes the first business object. The computer device may create a cooperation space for the business object, store the permission information of the business object in the cooperation space, and associate the cooperation space with the data storage space of the business object. Optionally, the specific implementation process of the computer device obtaining the first permission information associated with the first access database and creating the second access database based on the first permission information and the first access database may also be: the computer device obtains the request business object corresponding to the first access database, and obtains the first permission information of the request business object from the request cooperation space corresponding to the request business object; the business object includes the request business object; the permission information of the request business object includes the first permission information of the request business object. Further, the computer device requests the database content in the first access database from the data storage space associated with the request cooperation space through the request cooperation space corresponding to the request business object, and creates the second access database based on the database content in the first access database.

[0112] The first service processing request can be updated to a second service processing request based on the second access database. Specifically, the first database name included in the first service processing request can be updated to the second database name corresponding to the first database name to obtain the second service processing request. At this time, the data query statement in the first service processing request is updated to the update query statement in the second service processing request. For example, the data query statement is "select fromtable.a union all select From table.b", the first database name includes "table.a" and "table.b", where, assuming that the second database name corresponding to the first database name "table.a" is "table.a_authorized", and the second database name corresponding to the first database name "table.b" is "table.b_authorized", then the update query statement "select from table.a_authorized union allselect from table.b_authorized".

[0113] Step S503: perform authority verification on the second business processing request.

[0114] In an embodiment of the present application, the first permission information includes access rights, and the implementation process of the computer device performing permission verification on the second business processing request may be: the computer device performs request parsing on the second business processing request to obtain the request information corresponding to the second business processing request. Among them, the request information may include a business keyword and a data column to be accessed corresponding to the business keyword, as well as a request query format, wherein the business keyword refers to the execution operator in the update query statement included in the second business processing request, such as select, avg, count, etc.; the data column to be accessed corresponding to the business keyword is used to indicate the specific data location of the business keyword in the second access database; the request query format is used to indicate the statement format of the update query statement, which may include a single-layer query format and a nested query format (i.e., a SQL subquery, which refers to another query statement nested in an SQL query statement). The computer device may further perform permission verification on the request information based on the access rights associated with the second access database.

[0115] Furthermore, the computer device obtains the accessible data column corresponding to the business keyword from the access permission. Specifically, the computer can determine the configuration form in the access permission based on the access permission. If the access permission is configured in a whitelist form, when the business keyword exists in the access permission, the computer device can directly obtain the accessible data column associated with the business keyword from the access permission. When the business keyword does not exist in the access permission, the computer device determines that the accessible data column corresponding to the business keyword is empty. If the access permission is configured in a restrictive list form, the computer device can match the business keyword with the access permission. If the business keyword does not exist in the access permission, it can be determined that the business keyword can access any data column associated with the access permission, and the computer device can determine all data columns in the second access database as accessible data columns corresponding to the business keyword; if the business keyword exists in the access permission, the computer device obtains the accessible data column configured for the business keyword in the access permission. If the access permission is configured in a blacklist form, when the business keyword does not exist in the access permission, it can be determined that the business keyword can access any data column associated with the access permission, and the computer device can determine all data columns in the second access database as accessible data columns corresponding to the business keyword. When the business keyword exists in the access permission, the computer device determines that the accessible data column corresponding to the business keyword is empty.

[0116] If the accessible data column includes the data column to be accessed, and the request query format belongs to the permitted query format in the access permission, it is determined that the permission verification of the request information has passed. The permitted query format is used to indicate the number of query nesting levels allowed for the second access database. If the accessible data column does not include the data column to be accessed, or the request query format does not belong to the permitted query format in the access permission, it is determined that the permission verification of the request information has not passed. In the process of verifying the operator (i.e., business keyword) permission in the request query format by the computer device, the inheritance relationship of each data column in the SQL instruction can be constructed in a privacy lineage manner, and the operator permission configured for each data column against the business object (i.e., the configuration related to the business keyword in the first permission information) is judged to determine whether the use of the business keyword is violated, and whether the request query format meets the number of query nesting levels allowed for the second access database, so as to determine whether the operator permission of the request query format is supported.

[0117] For example, there is an SQL query statement "SELECT Department FROM (SELECT Department,AVG(Salary) AS AvgSalary FROM Employees GROUP BY Department) AS SubQueryWHERE AvgSalary>50000". A query statement "SELECT Department FROM AvgSalary ASSubQuery WHERE AvgSalary>50000" is nested in the query statement "SELECT Department FROM AvgSalary ASSubQuery WHERE AvgSalary>50000". Assuming that Employees is the second access database, the data table AvgSalary is generated through the Department column and the Salary column in the second access database Employees. If the accessible data columns corresponding to the business keyword SELECT include the Department column and the Salary column, then the business keyword SELECT has access rights to the data table AvgSalary, that is, the computer device can execute the entire query, including the AVG(Salary) part of the inner subquery, and obtain the final execution result, that is, the permission verification is passed. If the accessible data columns corresponding to the business keyword SELECT include the Department column but not the Salary column, the computer device can execute the outer query "SELECT Department FROM AvgSalary" during the permission detection process, but cannot execute the AVG(Salary) part of the inner subquery. However, due to the violation of operator permissions (that is, the business keyword does not have permissions for the Salary column), the database management system will refuse to execute this nested subquery, resulting in the computer device being unable to obtain the final execution result, that is, the permission verification fails.

[0118] If the computer device fails to verify the authority of the request information, a request failure message is sent to the first business object. If the computer device passes the authority verification of the request information, a second business processing request is executed on the second access database to obtain the business request data.

[0119] Step S504: execute the second service processing request on the second access database to obtain service request data.

[0120] In an embodiment of the present application, the first permission information includes an output condition, which is used to indicate the data condition that the first access database is allowed to be obtained. Since the second access database is determined by the first access database, the output condition is also used to indicate the data condition that the second access database is allowed to be obtained. The specific implementation process of the computer device executing the second business processing request for the second access database and obtaining the business request data can be: the computer device executes the second business processing request for the second access database and obtains the execution result data. Specifically, the computer device parses the second business processing request to obtain the M query instructions included in the second business processing request and the instruction execution order corresponding to the M query instructions; M is a positive integer. For example, there is a second business processing request including an SQL query instruction of "SELECT2AVG (data 1) FROM table a WHERE data 2 IN (SELECT1 data 3 FROM table b)", which includes two SELECT instructions and one AVG instruction, and the execution order is SELECT1, SELECT2, AVG. It is understandable that the business keywords SELECT1 and SELECT2 do not have numeric subscripts in the actual SQL query statement. The numeric subscripts are used here only to distinguish the two existing identical business keywords to clearly indicate the execution order of the two identical business keywords.

[0121] The computer device splits the second business processing request into M query statements based on the instruction execution order corresponding to the M query instructions. For example, the SQL statement in the above example is split, and the three query statements obtained can be respectively expressed as "SELECT data 3 FROM table b", that is, query data 3 from table b, and the query result is recorded as A here, so as to express the subsequent query statement; "SELECT data 1 FROM table a WHERE data 2 IN A", and the query result is recorded as B here; "avg (B)". Further, the computer device executes M query statements in sequence for the second access database to obtain the execution result data corresponding to the M query statements. In the SQL statement in the above example, the second access database may include table a and table b. Optionally, based on the output condition in the first permission information, the execution result data corresponding to the M query statements can be determined, wherein one query statement among the M query statements may be executed based on another query statement. Therefore, there is an instruction execution order. Specifically, the execution result data i of the i-th query statement can be obtained, where i is a positive integer less than or equal to M; if the i+1-th query statement is executed based on the i-th query statement, then based on the execution result data i of the i-th query statement, the i+1-th query statement is executed to obtain the initial result data i+1 of the i+1-th query statement, and the i+1-th query statement is obtained. The first permission information i+1 of the second access database associated with the i+1th query statement is obtained. Based on the output condition in the first permission information i+1, the initial result data i+1 is screened to obtain the execution result data i+1 of the i+1th query statement; if the i+1th query statement is executed separately, the i+1th query statement is executed to obtain the initial result data i+1 of the i+1th query statement, and the first permission information i+1 of the second access database associated with the i+1th query statement is obtained. Based on the output condition in the first permission information i+1, the initial result data i+1 is screened to obtain the execution result data i+1 of the i+1th query statement. Until the execution result data corresponding to the M query statements are obtained.

[0122] That is, the output result of the second business processing request can be screened, and since the intermediate data is invisible to the initiator (i.e., the first business object), the security of the data can be guaranteed. Alternatively, in order to further improve the security of the data, the query statements can also be screened based on the first permission information of the second access database associated with each query statement.

[0123] If the execution result data does not meet the output conditions, the computer device determines the empty data as the business request data. Optionally, if the business object associated with the second access database is configured in the output conditions that the amount of data with different result values ​​needs to exceed a specified quantity threshold (for example, it can be 2), and the output result data needs to meet L-diversity, as well as the corresponding L value. The computer device can filter the execution result data based on the output conditions to obtain the business request data. Specifically, obtain the P data items included in the execution result data, and obtain the filter data column from the output conditions; P is a positive integer. The computer device groups the P data items based on the filter data column to obtain Q data groups; Q is a positive integer less than or equal to P, and each data group includes one or more data items. The computer device can filter the execution result data based on the number of data items included in each data group and Q to obtain the business request data. Specifically, the computer device determines from the execution result data whether Q is greater than or equal to L. If Q is greater than or equal to L, the computer device further obtains a data group in which the number of data items included in the data group is greater than or equal to a specified number threshold, and determines the data group as the service request data. If Q is less than L, the computer device determines the second service request data to be empty.

[0124] For example, there is an execution result data in Table 3:

[0125] Table 3

[0126]

[0127] As shown in Table 3, it includes 4 data columns (name, age, zip code, purchase preference) and 6 data items (3 fitness equipment, 1 book, 2 cooking tools), and the filter data column obtained based on the output condition is the purchase preference. Then, based on the filter data column (purchase preference), the 6 data items are grouped to obtain 3 data groups (fitness equipment, books, cooking tools), wherein the first data group includes 3 fitness equipment data items, the second data group includes 1 book data item, and the third data group includes 2 cooking tool data items. Assuming that the specified quantity threshold in the output condition is 2 and the L value is 3 at this time, when the computer device determines from the execution result data that Q is greater than 3, the computer device further obtains a data group in which the number of data items included in the data group is greater than or equal to 2, and determines the data group as the business request data. For example, see the results shown in Table 4. As shown in Table 4, it includes 4 data columns (name, age, zip code, purchase preference) and 5 data items (3 fitness equipment, 2 cooking tools):

[0128] Table 4

[0129]

[0130] Optionally, if the business object associated with the second access database is configured in the output condition that the output result data needs to meet K-anonymity (K-anonymity) and the corresponding K value (for example, 2), the computer device detects whether the data table corresponding to the execution result data meets the corresponding K value. If the execution result data does not meet the K value, the computer device determines that the execution result data is empty. Alternatively, the execution result data is anonymized to obtain an anonymized protection result, and the anonymized protection result is determined as the business request data.

[0131] For example, there is an execution result data in Table 5:

[0132] Table 5

[0133]

[0134] As shown in Table 5, it includes 4 data columns (name, age, zip code, purchase preference) and 8 data items, among which the name is an identifier, the age and zip code are quasi-identifiers, and the purchase preference is sensitive data. The computer device can delete the data column corresponding to the identifier, or perform fuzzy processing on the data column corresponding to the quasi-identifier to obtain the business request data. For example, see Table 6:

[0135] Table 6

[0136]

[0137] As shown in Table 6, the computer device deletes the name column and uses the symbol " ", the specific values ​​in the age column are summarized into an age group for fuzzy processing. For data such as postal codes, if all numbers are replaced by symbols " "Instead, the data will lose a lot of meaningful information. Computer equipment can delete one of the digits and replace it with a symbol." " is replaced by ", and the rest of the numbers are retained. This ensures that when an attacker queries data through a specified identifier, he can find at least two pieces of data. For example, by querying Frank's age 36 and zip code 102201 in Table 5, his purchase preferences can be obtained from Table 6 with two pieces of data with different purchase preferences, and Frank's real data cannot be located. In this way, the privacy of business request data is protected through means such as anonymization, so that attackers cannot directly locate a single piece of data through queries, causing data leakage.

[0138] If the execution result data meets the output condition, the computer device determines the execution result data as the business request data.

[0139] Step S505: Send a request result for the first business processing request to the first business object based on the business request data.

[0140] In an embodiment of the present application, if the first business processing request only includes SQL instructions, the computer device can determine the business request data as the request result for the first business processing request, and send the request result to the first business object. Optionally, if the first business processing request includes SQL instructions and business requirements for the execution results of the SQL instructions, the computer device can obtain the business requirements included in the first business processing request, obtain the standard data indicators corresponding to the business requirements, statistically integrate the business request data based on the business requirements, obtain business statistical information, parse the business statistical information based on the standard data indicators, obtain business parsing results, determine the business request data and the business parsing results as the request result for the first business processing request, and send the request result to the first business object. If the business object indicated by the data processing method in the embodiment of the present application is an advertiser and an advertising delivery participant, the computer device can analyze the advertising delivery effect of the business request data based on the business requirements in the first business processing request, obtain the analysis results, and send the business request data and the analysis results as the request results to the first business object, so that the first business object can make subsequent advertising delivery strategy adjustments based on the request results. Optionally, the analysis result may include a delivery strategy suggestion for the advertisement delivery, which is used to assist the first business object in making subsequent adjustments to the advertisement delivery strategy.

[0141] Optionally, the first permission information includes the first permission information associated with the first business object, and the specific implementation process of the computer device sending the request result for the first business processing request to the first business object based on the business request data can also be: if the first access database includes the first access database of the first business object, the computer device sends the request result for the first business processing request and the data completion prompt message to the first business object based on the business request data, so that the first business object determines the business data to be requested from the first business processing request based on the first permission information of the first business object, obtains the business data to be supplemented from the business data to be requested based on the first business processing request, and determines the business data to be supplemented and the request result as the target result of the first business processing request. Wherein, the data completion prompt message is used to prompt the first business object that data completion or permission completion is required when the computer device has insufficient access rights to all database contents in the first access database (that is, the computer device cannot fully access the first access based on the first permission information). The business data to be requested is the business data in the first access database of the first business object, except the second access database corresponding to the first business object (that is, the business data that the computer device has no right to access based on the first permission information).

[0142] Among them, the trusted third-party object can be considered as a cloud service object for providing computing and storage services. Each business object can store its own business data in the cloud environment provided by the trusted third-party object, and the business data of different business objects are independent and isolated from each other in the cloud environment. The trusted third-party object can establish a cooperation space for each participant (such as the requesting business object associated with the first business processing request) participating in a certain business (such as the first business processing request) in the cloud environment, and realize joint access and processing of the business data of each participant through the first permission information provided by each participant.

[0143] Through the above process, a trusted third-party object is introduced to establish a cooperation space for the cooperating business objects, separate the computing (i.e., cooperation space) from the storage (i.e., data storage space), and associate the data storage space of the business object with the cooperation space, so that the business data of the business object does not need to be moved to the cooperation space, thereby reducing the data movement overhead and data storage overhead; and the cooperation space is a virtual logical concept, not a physically closed space like a closed domain, so that multiple computing tasks are allowed to run on the same computer at the same time, making full use of computing resources, realizing resource reuse and sharing, improving resource utilization, saving computing task queuing time, and improving computing efficiency; at the same time, for the first business object to process the first business processing request involving the data of all parties, the access rights (including row and column rights and operator rights) in the first permission information are used to limit the scope of data use and the use of SQL operators, prevent data leakage, and perform secure computing, and the verification of access rights only requires less resources; the output conditions in the first access right information are used to anonymize the execution result data and other operations to further protect the privacy of business data. At the same time, the first business object does not need to prepare, configure, and maintain computing resources by itself, which reduces the resource overhead of the first business object. There is no need to use expensive cryptography for data encryption or multi-party secure computing with high communication overhead, which reduces the complexity of calculations and ensures computing efficiency even when the data scale is large.

[0144] See also Figure 6 , Figure 6 This is a business processing flow chart provided by the embodiment of the present application. Figure 6 As shown, it is used to describe the business processing process after creating a collaborative space, including a trusted third-party object and an initiator (a first business object). The business processing process includes the following steps:

[0145] Step S601: Send a first service processing request.

[0146] In an embodiment of the present application, the initiator, that is, the first business object, can send a first business processing request (i.e., a data cooperation computing task) to a trusted third-party object through a business device. The first business processing request may include an SQL instruction and a business requirement for the result of executing the SQL instruction. The initiator can request to calculate the business data of the second business object (participant) through the first business processing request, or request to calculate the business data of the first business object and the business data of the second business object.

[0147] Step S602, configuring computing resources.

[0148] In the embodiment of the present application, after receiving the first business processing request sent by the initiator, the computer device corresponding to the trusted third-party object can configure computing resources for the first business processing request, that is, provide computing resources to process the business content indicated by the first business processing request. For example, determine and provide the number or configuration of computing machines required to run to process the first business processing request.

[0149] Step S603: perform authority resolution and verification.

[0150] In an embodiment of the present application, a computer device can determine a first access database based on a first business processing request, obtain first permission information associated with the first access database, create a second access database based on the first permission information and the first access database, and update the first business processing request to a second business processing request based on the second access database. Furthermore, the first permission information includes access permissions, and the computer device performs request parsing on the second business processing request to obtain request information corresponding to the second business processing request. Based on the access permissions associated with the second access database, the request information is authenticated. For the specific implementation process, please refer to the following. Figure 5 The specific description of step S502 and step S503 shown in the figure will not be repeated here.

[0151] Step S604, determining whether the authority resolution verification is successful.

[0152] In the embodiment of the present application, the computer device determines whether the authority resolution verification of the second business processing request is successful. If the authority resolution verification of the second business processing request is unsuccessful, that is, the authority verification of the request information fails, then the process jumps to step S605. If the authority resolution verification of the second business processing request is successful, that is, the authority verification of the request information passes, then the process jumps to step S606.

[0153] Step S605: Send execution error information to the initiator.

[0154] In an embodiment of the present application, the computer device sends execution error information to the initiator, so that the initiator receives the execution error information and determines whether to resend the business processing request based on the execution error information.

[0155] Step S606: execute the second service processing request.

[0156] In the embodiment of the present application, the computer device executes the second service processing request on the second access database to obtain execution result data.

[0157] Step S607, verifying the output conditions of the execution result data.

[0158] In an embodiment of the present application, the first permission information includes an output condition, and the computer device performs output condition verification on the execution result data based on the output condition.

[0159] Step S608, whether the execution result data meets the output conditions.

[0160] In an embodiment of the present application, the computer device determines whether the execution result data meets the output conditions. If the execution result data does not meet the output conditions, the process jumps to step S609, or the computer device filters the execution result data based on the output conditions to obtain business request data; if the execution result data meets the output conditions, the process jumps to step S610.

[0161] Step S609: Send execution error information to the initiator.

[0162] In an embodiment of the present application, the computer device sends execution error information to the initiator, so that the initiator receives the execution error information and determines whether to resend the business processing request based on the execution error information.

[0163] Step S610, sending the request result to the initiator.

[0164] In an embodiment of the present application, the computer device may determine the execution result data as the business request data, determine the business request data as the request result for the first business processing request, and send the request result to the initiator. Optionally, the computer device may obtain the business requirements included in the first business processing request, obtain the standard data indicators corresponding to the business requirements, statistically integrate the business request data based on the business requirements to obtain business statistical information, parse the business statistical information based on the standard data indicators to obtain business analysis results, determine the business request data and the business analysis results as the request result for the first business processing request, and send the request result to the initiator. For the specific implementation process, please refer to Figure 5 The specific description of step S505 shown in FIG. 1 is not repeated here.

[0165] See also Figure 7 , Figure 7 Schematic diagram of a data processing device provided in an embodiment of the present application. The data processing device may be a computer program (including program code, etc.) running in a computer device. For example, the data processing device may be an application software. The data processing device may be used to execute the corresponding steps in the method provided in an embodiment of the present application. Figure 7 As shown, the data processing device 700 can be used to Figure 3 and Figure 5 The computer device in the corresponding embodiment, specifically, the data processing device may include: a space creation module 11, a request acquisition module 12, a data update module 13, a permission verification module 14, and a data execution module 15.

[0166] A request acquisition module 12, configured to acquire a first business processing request sent by a first business object, and determine a first access database based on the first business processing request;

[0167] The data updating module 13 is used to obtain the first permission information associated with the first access database, create a second access database based on the first permission information and the first access database, and update the first service processing request to the second service processing request based on the second access database;

[0168] The data execution module 15 is used to execute the second service processing request on the second access database, obtain service request data, and send a request result for the first service processing request to the first service object based on the service request data.

[0169] In a possible implementation, when the data updating module 13 is used to create the second access database based on the first permission information and the first access database, the data updating module 13 is specifically used to perform the following operations:

[0170] Determine the access scope in the first permission information, and obtain the accessible business data from the first access database based on the access scope;

[0171] Based on the first database name of the first access database, the second database name is determined, the accessible business data is used as the database content, and the second database name and the database content are combined into a second access database.

[0172] In a possible implementation, the number of first access databases is N, where N is a positive integer; when the data updating module 13 is used to create the second access database based on the first permission information and the first access database, the data updating module 13 is specifically used to perform the following operations:

[0173] Obtain request business objects corresponding to N first access databases respectively;

[0174] If the N requested business objects include the first business object, the first access database of the first business object is determined as the second access database of the first business object, and the second access database of the second business object is created based on the first permission information of the second business object and the first access database of the second business object; the second business object is the business object other than the first business object among the N requested business objects.

[0175] In a possible implementation, the first permission information includes access rights; the data processing device 700 further includes a permission verification module 14, and the permission verification module 14 is specifically configured to perform the following operations:

[0176] Parsing the second service processing request to obtain request information corresponding to the second service processing request;

[0177] Performing permission verification on the request information based on the access permission associated with the second access database;

[0178] If the authority verification of the request information fails, a request failure message is sent to the first business object;

[0179] If the authority verification of the request information is passed, a process of executing the second service processing request on the second access database to obtain service request data is performed.

[0180] In a possible implementation, the request information includes a business keyword and a data column to be accessed corresponding to the business keyword, and a request query format; when the authority verification module 14 is used to perform authority verification on the request information based on the access authority associated with the second access database, the authority verification module 14 is specifically used to perform the following operations:

[0181] Obtaining the accessible data column corresponding to the business keyword from the access permission, if the accessible data column includes the data column to be accessed, and the request query format belongs to the permitted query format in the access permission, then determining that the permission verification of the request information is passed; the permitted query format is used to indicate the number of query nesting levels allowed for the second access database;

[0182] If the accessible data column does not include the to-be-accessed data column, or the request query format does not belong to the permitted query format in the access permission, it is determined that the permission verification of the requested information fails.

[0183] In a possible implementation, the first permission information includes an output condition; the output condition is used to indicate the data condition that the first access database is allowed to be obtained; the data execution module 15 is used to execute the second service processing request for the second access database, and when the service request data is obtained, the data execution module 15 is specifically used to perform the following operations:

[0184] Execute the second business processing request on the second access database to obtain execution result data;

[0185] If the execution result data does not meet the output condition, the empty data is determined as the business request data, or the execution result data is screened based on the output condition to obtain the business request data;

[0186] If the execution result data meets the output condition, the execution result data is determined as the business request data.

[0187] In a possible implementation, the data execution module 15 is used to execute the second service processing request on the second access database. When the execution result data is obtained, the data execution module 15 is specifically used to perform the following operations:

[0188] Parsing the second business processing request to obtain M query instructions included in the second business processing request and an instruction execution order corresponding to the M query instructions; M is a positive integer;

[0189] Based on the instruction execution order corresponding to the M query instructions, the second business processing request is split into M query statements, and the M query statements are executed in sequence on the second access database to obtain execution result data corresponding to the M query statements respectively.

[0190] In a possible implementation, the data execution module 15 is used to filter the execution result data based on the output condition. When the business request data is obtained, the data execution module 15 is specifically used to perform the following operations:

[0191] Obtain P data items included in the execution result data, and obtain a screening data column from the output condition; P is a positive integer;

[0192] The P data items are grouped based on the screening data column to obtain Q data groups; Q is a positive integer less than or equal to P, and each data group includes one or more data items;

[0193] Based on the number of data items included in each data group and Q, the execution result data is screened to obtain the business request data.

[0194] In a possible implementation, when the data execution module 15 is used to send a request result for the first business processing request to the first business object based on the business request data, the data execution module 15 is specifically used to perform the following operations:

[0195] Determine the business request data as a request result for the first business processing request, and send the request result to the first business object;

[0196] Alternatively, obtain the business requirements included in the first business processing request, obtain standard data indicators corresponding to the business requirements, perform statistics and integration on the business request data based on the business requirements to obtain business statistical information, parse the business statistical information based on the standard data indicators to obtain business analysis results, determine the business request data and the business analysis results as the request results for the first business processing request, and send the request results to the first business object.

[0197] In a possible implementation, the first permission information includes first permission information associated with the first business object; when the data execution module 15 is used to send a request result for the first business processing request to the first business object based on the business request data, the data execution module 15 is specifically used to perform the following operations:

[0198] If the first access database includes the first access database of the first business object, a request result for the first business processing request and a data completion prompt message are sent to the first business object based on the business request data, so that the first business object determines the business data to be requested from the first business processing request based on the first authority information of the first business object, obtains the business data to be supplemented from the business data to be requested based on the first business processing request, and determines the business data to be supplemented and the request result as the target result of the first business processing request; the business data to be requested is the business data in the first access database of the first business object, except for the second access database corresponding to the first business object.

[0199] In a possible implementation, the data processing device 700 further includes a space creation module 11, and the space creation module 11 is specifically configured to perform the following operations:

[0200] Obtaining permission information of a business object; the business object includes a first business object;

[0201] Create a collaboration space for the business object, store the permission information of the business object in the collaboration space, and associate the collaboration space with the data storage space of the business object;

[0202] The data updating module 13 is used to obtain the first permission information associated with the first access database. When creating the second access database based on the first permission information and the first access database, the data updating module 13 is specifically used to perform the following operations:

[0203] Acquire a request business object corresponding to the first access database, and acquire first permission information of the request business object from a request cooperation space corresponding to the request business object; the business object includes the request business object;

[0204] By requesting the request cooperation space corresponding to the request business object, the database content in the first access database is requested from the data storage space associated with the request cooperation space, and the second access database is created based on the database content in the first access database.

[0205] See also Figure 8 , Figure 8 Schematic diagram of the structure of a computer device provided in an embodiment of the present application. Figure 8 As shown, the computer device in the embodiment of the present application may include: a processor 801, a network interface 804 and a memory 805. In addition, the above-mentioned computer device 800 may also include: a user interface 803, and at least one communication bus 802. Among them, the communication bus 802 is used to realize the connection and communication between these components. Among them, the user interface 803 may include a display screen (Display), a keyboard (Keyboard), and the user interface 803 may optionally include a standard wired interface and a wireless interface. The network interface 804 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 805 may be a high-speed RAM memory, or it may be a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 805 may optionally also be at least one storage device located away from the aforementioned processor 801. As Figure 8 As shown, the memory 805 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a device control application program.

[0206] The network interface 804 may provide a network communication element; the user interface 803 is mainly used to provide an input interface for the user; and the processor 801 may be used to call the device control application stored in the memory 805 to perform the following operations:

[0207] Acquire a first business processing request sent by a first business object, and determine a first access database based on the first business processing request;

[0208] Acquire first permission information associated with the first access database, create a second access database based on the first permission information and the first access database, and update the first service processing request to a second service processing request based on the second access database;

[0209] A second service processing request is executed on the second access database to obtain service request data, and a request result for the first service processing request is sent to the first service object based on the service request data.

[0210] In a possible implementation, when the processor 801 is used to create the second access database based on the first permission information and the first access database, it is specifically used to perform the following operations:

[0211] Determine the access scope in the first permission information, and obtain the accessible business data from the first access database based on the access scope;

[0212] Based on the first database name of the first access database, the second database name is determined, the accessible business data is used as the database content, and the second database name and the database content are combined into a second access database.

[0213] In a possible implementation, the number of first access databases is N, where N is a positive integer; when the processor 801 is configured to create a second access database based on the first permission information and the first access database, the processor 801 is specifically configured to perform the following operations:

[0214] Obtain request business objects corresponding to N first access databases respectively;

[0215] If the N requested business objects include the first business object, the first access database of the first business object is determined as the second access database of the first business object, and the second access database of the second business object is created based on the first permission information of the second business object and the first access database of the second business object; the second business object is the business object other than the first business object among the N requested business objects.

[0216] In a possible implementation manner, the first permission information includes access rights; and the processor 801 is further configured to perform the following operations:

[0217] Parsing the second service processing request to obtain request information corresponding to the second service processing request;

[0218] Performing permission verification on the request information based on the access permission associated with the second access database;

[0219] If the authority verification of the request information fails, a request failure message is sent to the first business object;

[0220] If the authority verification of the request information is passed, a process of executing the second service processing request on the second access database to obtain service request data is performed.

[0221] In a possible implementation, the request information includes a business keyword and a data column to be accessed corresponding to the business keyword, and a request query format; the processor 801 is used to perform the following operations when performing permission verification on the request information based on the access permission associated with the second access database:

[0222] Obtaining the accessible data column corresponding to the business keyword from the access permission, if the accessible data column includes the data column to be accessed, and the request query format belongs to the permitted query format in the access permission, then determining that the permission verification of the request information is passed; the permitted query format is used to indicate the number of query nesting levels allowed for the second access database;

[0223] If the accessible data column does not include the to-be-accessed data column, or the request query format does not belong to the permitted query format in the access permission, it is determined that the permission verification of the requested information fails.

[0224] In a possible implementation, the first permission information includes an output condition; the output condition is used to indicate a data condition that the first access database is allowed to be obtained; the processor 801 is used to execute the second service processing request for the second access database, and when the service request data is obtained, specifically to perform the following operations:

[0225] Execute the second business processing request on the second access database to obtain execution result data;

[0226] If the execution result data does not meet the output condition, the empty data is determined as the business request data, or the execution result data is screened based on the output condition to obtain the business request data;

[0227] If the execution result data meets the output condition, the execution result data is determined as the business request data.

[0228] In a possible implementation, the processor 801 is configured to execute the second service processing request on the second access database, and when the execution result data is obtained, is specifically configured to perform the following operations:

[0229] Parsing the second business processing request to obtain M query instructions included in the second business processing request and an instruction execution order corresponding to the M query instructions; M is a positive integer;

[0230] Based on the instruction execution order corresponding to the M query instructions, the second business processing request is split into M query statements, and the M query statements are executed in sequence on the second access database to obtain execution result data corresponding to the M query statements respectively.

[0231] In a possible implementation, the processor 801 is used to filter the execution result data based on the output condition, and when the business request data is obtained, is specifically used to perform the following operations:

[0232] Obtain P data items included in the execution result data, and obtain a screening data column from the output condition; P is a positive integer;

[0233] The P data items are grouped based on the screening data column to obtain Q data groups; Q is a positive integer less than or equal to P, and each data group includes one or more data items;

[0234] Based on the number of data items included in each data group and Q, the execution result data is screened to obtain the business request data.

[0235] In a possible implementation, when the processor 801 is configured to send a request result for the first service processing request to the first service object based on the service request data, the processor 801 is specifically configured to perform the following operations:

[0236] Determine the business request data as a request result for the first business processing request, and send the request result to the first business object;

[0237] Alternatively, obtain the business requirements included in the first business processing request, obtain standard data indicators corresponding to the business requirements, perform statistics and integration on the business request data based on the business requirements to obtain business statistical information, parse the business statistical information based on the standard data indicators to obtain business analysis results, determine the business request data and the business analysis results as the request results for the first business processing request, and send the request results to the first business object.

[0238] In a possible implementation, the first permission information includes first permission information associated with the first business object; when the processor 801 is used to send a request result for the first business processing request to the first business object based on the business request data, it is specifically used to perform the following operations:

[0239] If the first access database includes the first access database of the first business object, a request result for the first business processing request and a data completion prompt message are sent to the first business object based on the business request data, so that the first business object determines the business data to be requested from the first business processing request based on the first authority information of the first business object, obtains the business data to be supplemented from the business data to be requested based on the first business processing request, and determines the business data to be supplemented and the request result as the target result of the first business processing request; the business data to be requested is the business data in the first access database of the first business object, except for the second access database corresponding to the first business object.

[0240] In a possible implementation manner, the processor 801 is further configured to perform the following operations:

[0241] Obtaining permission information of a business object; the business object includes a first business object;

[0242] Create a collaboration space for the business object, store the permission information of the business object in the collaboration space, and associate the collaboration space with the data storage space of the business object;

[0243] The processor 801 is used to obtain first permission information associated with the first access database, and when creating the second access database based on the first permission information and the first access database, specifically to perform the following operations:

[0244] Acquire a request business object corresponding to the first access database, and acquire first permission information of the request business object from a request cooperation space corresponding to the request business object; the business object includes the request business object;

[0245] By requesting the request cooperation space corresponding to the request business object, the database content in the first access database is requested from the data storage space associated with the request cooperation space, and the second access database is created based on the database content in the first access database.

[0246] In addition, it should be noted that: the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, the computer program is suitable for being loaded and executed by the processor Figure 3 or Figure 5 For details on the methods provided in each step, please refer to the Figure 3 or Figure 5 The implementation methods provided in each step are not repeated here. In addition, the description of the beneficial effects of adopting the same method is not repeated. For technical details not disclosed in the computer-readable storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application. As an example, the computer program can be deployed to execute on one computer device, or on multiple computer devices located in one place, or on multiple computer devices distributed in multiple locations and interconnected by a communication network.

[0247] The computer-readable storage medium may be the device provided in any of the aforementioned embodiments or the internal storage unit of the computer device, such as the hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. equipped on the computer device. Further, the computer-readable storage medium may also include both the internal storage unit of the computer device and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0248] The present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes Figure 3 or Figure 5 The methods provided in the various optional methods are therefore not described in detail here.

[0249] The terms "first", "second", etc. in the description, claims, and drawings of the embodiments of the present application are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, device, product, or equipment that includes a series of steps or units is not limited to the listed steps or modules, but optionally includes steps or modules that are not listed, or optionally includes other step units inherent to these processes, methods, devices, products, or equipment.

[0250] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0251] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in this description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0252] The method and related apparatus provided by the embodiment of the present application are described with reference to the method flow chart and / or structural diagram provided by the embodiment of the present application. Specifically, each process and / or box in the method flow chart and / or structural diagram, as well as the combination of the processes and / or boxes in the flow chart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable device to generate a machine, so that the instructions executed by the processor of the computer or other programmable device generate instructions for implementing the process in the process. Figure 1 Schematic diagram of one or more processes and / or structures Figure 1 The computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device, or are transmitted through a computer-readable storage medium. Computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The instruction device is implemented in the process Figure 1 Schematic diagram of one or more processes and / or structures Figure 1 These computer program instructions can also be loaded onto a computer or other programmable device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide the functions for implementing the process. Figure 1 A flow or multiple flows and / or structures illustrate the steps of the functions specified in one block or multiple blocks.

[0253] The steps in the method of the embodiment of the present application can be adjusted in order, combined and deleted according to actual needs.

[0254] The modules in the device of the embodiment of the present application can be merged, divided and deleted according to actual needs.

[0255] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A data processing method, characterized in that: Applied to a trusted third-party object, the trusted third-party object is used to create a request cooperation space for a request business object with cooperation needs, in which the business data of the request business object is called through access control to perform joint computing; the business data of the request business object is stored in the same cloud server provided by the trusted third-party object, and the request business object includes a first business object; The method comprises: Acquire a first business processing request sent by the first business object, and determine a first access database based on the first business processing request; obtaining first permission information associated with the first access database through the request cooperation space, creating a second access database based on the first permission information and the first access database, and updating the first business processing request to a second business processing request based on the second access database; the first permission information includes access rights; The second business processing request is parsed to obtain request information corresponding to the second business processing request; the request information includes a business keyword and a data column to be accessed corresponding to the business keyword, and a request query format; the business keyword refers to an execution operator in an update query statement included in the second business processing request, the data column to be accessed corresponding to the business keyword is used to indicate a specific data location of the business keyword in the second access database, the request query format is used to indicate a statement format of the update query statement, and the request query format includes a single-layer query format and a nested query format; Performing authority verification on the request information based on the access authority associated with the second access database; If the authority verification of the request information is passed, the computing resources configured by the trusted third-party object for the first business processing request are used to execute the second business processing request on the second access database to obtain business request data, and based on the business request data, a request result for the first business processing request is sent to the first business object.

2. The method according to claim 1, characterized in that: The creating a second access database based on the first permission information and the first access database includes: Determine the access scope in the first permission information, and acquire accessible business data from the first access database based on the access scope; Based on the first database name of the first access database, a second database name is determined, the accessible business data is used as database content, and the second database name and the database content are combined to form a second access database.

3. The method according to claim 1, characterized in that The number of the first access databases is N, where N is a positive integer; and the step of creating a second access database based on the first permission information and the first access database includes: Obtain request business objects corresponding to N first access databases respectively; If the N requested business objects include the first business object, the first access database of the first business object is determined as the second access database of the first business object, and the second access database of the second business object is created based on the first permission information of the second business object and the first access database of the second business object; the second business object is the business object among the N requested business objects except the first business object.

4. The method according to claim 1, characterized in that: The method further comprises: If the authority verification of the request information fails, a request failure message is sent to the first business object.

5. The method according to claim 1, characterized in that The performing authority verification on the request information based on the access authority associated with the second access database includes: Obtaining the accessible data column corresponding to the business keyword from the access permission, and if the accessible data column includes the data column to be accessed, and the request query format belongs to the permitted query format in the access permission, determining that the permission verification of the request information is passed; the permitted query format is used to indicate the number of query nesting levels allowed for the second access database; If the accessible data column does not include the to-be-accessed data column, or the request query format does not belong to the permitted query format in the access authority, it is determined that the authority verification of the request information fails.

6. The method according to claim 1, characterized in that The first permission information includes an output condition; the output condition is used to indicate the data condition that the first access database is allowed to be obtained; The executing the second service processing request on the second access database to obtain service request data includes: executing the second business processing request on the second access database to obtain execution result data; If the execution result data does not meet the output condition, the empty data is determined as the business request data, or the execution result data is screened based on the output condition to obtain the business request data; If the execution result data meets the output condition, the execution result data is determined as the business request data.

7. The method according to claim 6, characterized in that The executing the second service processing request on the second access database to obtain execution result data includes: Parsing the second business processing request to obtain M query instructions included in the second business processing request and an instruction execution order corresponding to the M query instructions, where M is a positive integer; Based on the instruction execution order corresponding to the M query instructions, the second business processing request is split into M query statements, and the M query statements are executed in sequence on the second access database to obtain execution result data corresponding to the M query statements respectively.

8. The method according to claim 6, characterized in that The step of screening the execution result data based on the output condition to obtain the business request data includes: Obtain P data items included in the execution result data, and obtain a screening data column from the output condition; P is a positive integer; The P data items are grouped based on the screening data column to obtain Q data groups; Q is a positive integer less than or equal to P, and each data group includes one or more data items; Based on the number of data items included in each data group and Q, the execution result data is screened to obtain the business request data.

9. The method according to claim 1, characterized in that: The sending a request result for the first business processing request to the first business object based on the business request data includes: Determine the service request data as a request result for the first service processing request, and send the request result to the first service object; Alternatively, obtain the business requirements included in the first business processing request, obtain the standard data indicators corresponding to the business requirements, perform statistics and integration on the business request data based on the business requirements to obtain business statistical information, parse the business statistical information based on the standard data indicators to obtain a business analysis result, determine the business request data and the business analysis result as the request result for the first business processing request, and send the request result to the first business object.

10. The method according to claim 1, characterized in that The first permission information includes first permission information associated with the first business object; and sending a request result for the first business processing request to the first business object based on the business request data includes: If the first access database includes the first access database of the first business object, a request result for the first business processing request and a data completion prompt message are sent to the first business object based on the business request data, so that the first business object determines the business data to be requested from the first business processing request based on the first authority information of the first business object, obtains the business data to be supplemented from the business data to be requested based on the first business processing request, and determines the business data to be supplemented and the request result as the target result of the first business processing request; the business data to be requested is the business data in the first access database of the first business object, except for the second access database corresponding to the first business object.

11. The method according to claim 1, characterized in that: The method further comprises: Acquire permission information of a business object; the business object includes the first business object; Creating a collaboration space for the business object, storing permission information of the business object in the collaboration space, and associating the collaboration space with the data storage space of the business object; The obtaining the first permission information associated with the first access database by requesting the cooperation space, and creating the second access database based on the first permission information and the first access database, includes: Acquire the request business object corresponding to the first access database, and acquire first permission information of the request business object from the request cooperation space corresponding to the request business object; the business object includes the request business object; The request cooperation space corresponding to the request business object is used to request the database content in the first access database from the data storage space associated with the request cooperation space, and a second access database is created based on the database content in the first access database.

12. A data processing device, characterized in that: The device is applied to a computer device corresponding to a trusted third-party object, the trusted third-party object is used to create a request cooperation space for a request business object with cooperation requirements, and the business data of the request business object is called in the request cooperation space through access control to perform joint computing; the business data of the request business object is stored in the same cloud server provided by the trusted third-party object, and the request business object includes a first business object; The device comprises: a request acquisition module, configured to acquire a first service processing request sent by the first service object, and determine a first access database based on the first service processing request; a data updating module, configured to obtain first permission information associated with the first access database through the request cooperation space, create a second access database based on the first permission information and the first access database, and update the first business processing request to a second business processing request based on the second access database; the first permission information includes access permission; an authority verification module, configured to perform request parsing on the second business processing request to obtain request information corresponding to the second business processing request; the request information includes a business keyword and a data column to be accessed corresponding to the business keyword, and a request query format; the business keyword refers to an execution operator in an update query statement included in the second business processing request, the data column to be accessed corresponding to the business keyword is used to indicate a specific data location of the business keyword in the second access database, the request query format is used to indicate a statement format of the update query statement, and the request query format includes a single-layer query format and a nested query format; The authority verification module is further used to perform authority verification on the request information based on the access authority associated with the second access database; A data execution module is used to, if the authority verification of the request information is passed, use the computing resources configured by the trusted third-party object for the first business processing request to execute the second business processing request on the second access database to obtain business request data, and send a request result for the first business processing request to the first business object based on the business request data.

13. A computer device, characterized in that: Includes processor, memory, input and output interfaces; The processor is connected to the memory and the input / output interface respectively, wherein the input / output interface is used to receive and output data, the memory is used to store a computer program, and the processor is used to call the computer program so that the computer device executes the method described in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded and executed by a processor, so that a computer device having the processor executes the method according to any one of claims 1 to 11.

15. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 11 is implemented.

Images