A business data rights management method, device, terminal equipment and storage medium

Abstract

The present application relates to the field of data management technology, and in particular to a business data rights management method, apparatus, terminal device and storage medium. The method comprises: collecting metadata corresponding to business data in the corresponding data source business system according to each configured data source information, and obtaining a metadata set. According to the selected metadata granularity, business line management architecture information, and organizational management structure information, the business category to which the unit metadata corresponding to the metadata granularity belongs is annotated to obtain a business attribution label for the unit metadata, and the corresponding business data rights manager is annotated for the unit metadata; the access permission request information of the corresponding business data is configured according to the unit metadata selected by the user; according to the access permission request information, the business data rights manager annotated with the unit metadata and the rights management unit of the corresponding data source business system are sent to effectively solve the business data rights management problems in multiple business systems, etc.

Description

Technical Field

[0001] The present application relates to the field of data management technology, and in particular to a business data authority management method, apparatus, terminal device and storage medium. Background Art

[0002] Business analysts need to obtain business data from various business systems to analyze business situations. For example, business analysts need to collect metadata of the corresponding business data libraries and tables in advance according to the business type, so that business analysts can have an overview of the data structure of the business type, and then select and collect the corresponding target business data based on the metadata according to business needs.

[0003] However, there are many types of business data contained in the business system, and the users of various business data are different, and the data range that can be read is different. In short, due to the large number of business systems and the permission settings of each business system, it is difficult for business analysts to check each business system one by one and obtain the corresponding business data.

[0004] Therefore, there is an urgent need for a rights management platform in the prior art. Summary of the invention

[0005] In view of this, the embodiments of the present application provide a business data authority management method, apparatus, terminal device and storage medium, which can effectively solve business data authority management problems in multiple business systems.

[0006] In a first aspect, an embodiment of the present application provides a business data rights management method, including:

[0007] Receive data source information of each metadata to be collected configured by the user;

[0008] Obtain metadata corresponding to business data in the business system of the corresponding data source information collection for each of the data source information to obtain a metadata set, wherein the metadata set is used to configure access rights for the corresponding business data;

[0009] According to the selected metadata granularity, business line management architecture information, and organizational management structure information, the business category to which the unit metadata corresponding to the metadata granularity belongs is marked to obtain a business attribution label for the unit metadata, and the corresponding business data authority manager is marked for the unit metadata;

[0010] According to the unit metadata selected by the user, configure the access permission request information of the corresponding business data;

[0011] According to the access permission request information, the access permission of the corresponding business data is obtained from the business data permission manager annotated in the unit metadata and the permission management unit of the corresponding data source business system.

[0012] In some embodiments, the data source information includes: data source ID, target database type, Java database connection, account number, password and target database name;

[0013] The receiving of data source information of each metadata to be collected configured by the user, and collecting metadata corresponding to the business data in the corresponding data source business system according to each data source information, to obtain a metadata set, includes:

[0014] Receiving the data source information configured by the user through the configuration page;

[0015] According to the target database type in each of the data source information, determine the metadata collection method corresponding to the target database type; use the metadata collection method to access the corresponding source data system and collect the corresponding metadata according to the Java database connection, the account number and the password, and use the data source ID to mark the metadata to obtain the metadata set.

[0016] In some embodiments, determining the metadata collection method corresponding to the target database type according to the target database type in each data source information includes:

[0017] Build each corresponding scheduled task according to each database type;

[0018] When executing each of the scheduled tasks, the configured data source information is scanned, and metadata is collected using a metadata collection method that matches the database type.

[0019] In some embodiments, the access permission request information includes: data source ID, database type, user information, unit metadata, access permission type and permission validity period;

[0020] The configuring the access permission request information of the corresponding business data according to the unit metadata selected by the user includes:

[0021] Displaying each unit metadata in the metadata set on a metadata browsing page according to each data source ID;

[0022] Receive the target unit metadata selected by the user on the metadata browsing page, obtain the data source ID and database type corresponding to the target unit metadata, and obtain the access permission type, permission validity period and user information configured according to the target unit metadata to obtain the access permission request information.

[0023] In some embodiments, the access permission request information further includes: whether to delete a mark;

[0024] The method also includes: using a scheduled synchronization task to scan whether the validity period of the permission in each standard access permission information has expired, wherein the standard access permission information is the access permission request information that has been authorized; updating the deletion mark in the expired standard access permission information determined according to the validity period of the permission to yes, and synchronizing the corresponding access permission information to the permission management unit of the corresponding data source business system so that the permission management unit can delete the standard access permission information; and deleting the expired standard access permission information stored locally at the same time.

[0025] In some embodiments, obtaining the access rights of the corresponding business data from the business data rights manager annotated by the unit metadata and the rights management unit of the corresponding data source business system according to the access rights request information includes:

[0026] Sending the access permission request information to the business data permission manager annotated by the metadata, and when obtaining authorization information given by the business data permission manager, marking the access permission request information as standard access permission information;

[0027] The authorized standard access authority information is registered to the authority management unit of the corresponding data source business system using the authorization application method of the corresponding database type, so as to enable the corresponding authority in the authority management unit of the data source business system.

[0028] In some embodiments, the access permission request information includes: whether to synchronize flag;

[0029] When the authorization information given by the business data authority manager is obtained, marking the access authority request information as standard access authority information includes:

[0030] If the authorization information is obtained, the access permission request information is marked as standard access permission information by updating the state of the synchronization mark to yes, otherwise the default state of the synchronization mark is kept as no;

[0031] The method further includes: using a scheduled synchronization task to scan synchronization marks in each standard access authority information, and registering the standard access authority information corresponding to a state of "no" in the synchronization mark into a corresponding authority management unit of a data source business system.

[0032] In a second aspect, an embodiment of the present application provides a business data rights management device, including:

[0033] The metadata collection module is used to receive the data source information of each metadata to be collected configured by the user, and collect the metadata corresponding to the business data in the corresponding data source business system according to each data source information to obtain a metadata set, wherein the metadata set is used to configure the access rights of the corresponding business data;

[0034] A business marking module is used to mark the business category to which the unit metadata corresponding to the metadata granularity belongs according to the selected metadata granularity, business line management architecture information, and organizational management structure information, obtain the business attribution label of the unit metadata, and mark the corresponding business data authority manager for the unit metadata;

[0035] A permission request information configuration module, used to configure the permission request information of the corresponding business data according to the unit metadata selected by the user;

[0036] The access permission acquisition module is used to obtain the access permission of the corresponding business data from the business data permission manager annotated in the unit metadata and the permission management unit of the corresponding data source business system according to the access permission request information.

[0037] In a third aspect, an embodiment of the present application provides a terminal device, the terminal device comprising a processor and a memory, the memory storing a computer program, and the processor being used to execute the computer program to implement a business data authority management method provided in the first aspect of the present application.

[0038] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program. When the computer program is executed on a processor, it implements a business data authority management method provided in the first aspect of the present application.

[0039] The embodiments of the present application have the following beneficial effects:

[0040] Receive the data source information of each metadata to be collected configured by the user, and collect the metadata corresponding to the business data in the corresponding data source business system according to each data source information, and obtain a metadata set, wherein the metadata set is used to configure the access rights of the corresponding business data; according to the selected metadata granularity, business line management architecture information, and organizational management structure information, annotate the business category to which the unit metadata corresponding to the metadata granularity belongs, obtain the business attribution label of the unit metadata, and annotate the corresponding business data authority manager for the unit metadata, thereby realizing business separation. Then, according to the unit metadata selected by the user, configure the access right request information of the corresponding business data; according to the access right request information, obtain the corresponding access right of the corresponding business data from the business data authority manager annotated by the unit metadata and the authority management unit of the corresponding data source business system. Thus, the authority management of the business data is realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 A framework diagram of the business data rights management platform of an embodiment of the present application is shown;

[0043] Figure 2 A flow chart showing a method for managing business data rights according to an embodiment of the present application is shown;

[0044] Figure 3 A schematic diagram showing a configuration page in the business data authority management method of an embodiment of the present application;

[0045] Figure 4 A schematic diagram showing a configuration sub-page in the business data authority management method of an embodiment of the present application is shown;

[0046] Figure 5 A structural schematic diagram of a business data rights management device according to an embodiment of the present application is shown.

[0047] Description of main component symbols:

[0048] 110 - business line management architecture information module; 120 - organization management structure information module; 130 - data authority management module; 410 - metadata collection module; 420 - business annotation module; 430 - authority request information configuration module; 440 - access authority acquisition module. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0050] The components of the embodiments of the present application generally described and shown in the drawings herein may be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0051] Hereinafter, the terms "including", "having" and their cognates that can be used in various embodiments of the present application are intended only to indicate specific features, numbers, steps, operations, elements, components or a combination of the foregoing items, and should not be understood as first excluding the existence of one or more other features, numbers, steps, operations, elements, components or a combination of the foregoing items or increasing the possibility of one or more features, numbers, steps, operations, elements, components or a combination of the foregoing items. In addition, the terms "first", "second", "third" and the like are only used to distinguish descriptions and cannot be understood as indicating or implying relative importance.

[0052] Unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meanings as those generally understood by those skilled in the art to which the various embodiments of the present application belong. The terms (such as those defined in generally used dictionaries) will be interpreted as having the same meanings as the contextual meanings in the relevant technical field and will not be interpreted as having idealized meanings or overly formal meanings unless clearly defined in the various embodiments of the present application.

[0053] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0054] This application provides a business data rights management platform, such as Figure 1As shown, the business data permission management platform includes a business line management architecture information module 110, an organization management structure information module 120 and a data permission management module 130. Among them, the business line management architecture information module 110 is used to manage the mapping relationship between business types and corresponding responsible departments. Specifically, it is presented in a hierarchical tree structure and marked with the affiliated departments. The organization management structure information module 120 is used to manage department heads and corresponding organizational departments. Specifically, it is presented in a hierarchical tree structure and marked with the person in charge. The data permission management module 130 is used to implement the business data permission management method of the embodiment of the present application. The method first obtains metadata according to the data source information configured by the user; then displays each metadata, and configures the access permission request information of the corresponding real business data according to the selected metadata. The access permission request information is sent to the corresponding person in charge, and after authorization, the obtained standard access permission information is synchronized to the corresponding data source business system.

[0055] The business data rights management method is described below in conjunction with some specific embodiments.

[0056] Figure 2 A flow chart of a business data rights management method according to an embodiment of the present application is shown. Exemplarily, the business data rights management method includes the following steps:

[0057] S110, receiving data source information of each metadata to be collected configured by the user, and collecting metadata corresponding to the business data in the corresponding data source business system according to each data source information, to obtain a metadata set, wherein the metadata set is used to configure access rights for the corresponding business data.

[0058] Furthermore, the data source information includes: data source ID, target database type, Java database connection, account number, password and target database name.

[0059] The step S110 receives the data source information of each metadata to be collected configured by the user, and collects metadata corresponding to the business data in the corresponding data source business system according to each data source information, to obtain a metadata set, including:

[0060] S111, receiving the data source information configured by the user through the configuration page, specifically including:

[0061] On the configuration page, you can customize the data source jdbc connection (Java database connection), customize the business data range corresponding to the data source jdbc connection according to business needs, and finally the data source business system provides the corresponding metadata. The data source information customized on the configuration page includes data source ID, data source name, data source type, jdbc connection, account, password (encrypted text display) and database name. Among them, the same data source type can be configured with multiple jdbc connections. For example, if there are multiple mysql business systems, you can configure multiple data sources. At the same time, you can also delete the configured data source. Among them, JDBC is JavaDatabase Connectivity, which is Java database connection.

[0062] The data source ID is a unique identifier that runs through the entire metadata information. For example, based on the data source ID, you can reversely check which data source (data source business system) the table or field comes from, and based on the data source ID, you can get more information about the corresponding metadata, such as the data source name, data source type, and data source jdbc connection. Data source types include mysql, doris, oracle, hive, greenplum, and mongoDB. Among them, configure the database name (optional). It is applicable to the case where only one db metadata is used. According to the database name, you can directly check which db's metadata in the data source business system is used. Configure the database name (optional). It is applicable to the case where only one db metadata is used. According to the database name, you can directly check which db's metadata in the data source business system is used. For example Figure 3 As shown, you can enter the configuration page through the "Edit" button Figure 4 The configuration subpage shown is used to configure the data source type, data source name, remarks, and the driver name, link string, library name, account number, and password in the connection information.

[0063] S112, according to the target database type in each of the data source information, determine the metadata collection method corresponding to the target database type; use the metadata collection method to access the corresponding source data system and collect the corresponding metadata according to the Java database connection, the account and the password, and use the data source ID to mark the metadata to obtain the metadata set.

[0064] Furthermore, in step S112, determining the metadata collection method corresponding to the target database type according to the target database type in each of the data source information includes:

[0065] Build each corresponding scheduled task according to each database type;

[0066] When executing each of the scheduled tasks, the configured data source information is scanned, and metadata is collected using a metadata collection method that matches the database type.

[0067] For example, through the scheduled task xljob component, a scheduled task is configured for each database type, and then the configured jdbc connection is scanned. The user of the jdbc connection will preset the scope of metadata that can be collected according to the authorization scope. For example, a jdbc connection of mysql can only collect all table and field information under database A. Or the jdbc connection given by hive can collect table and field information under all databases, and the scope of the collected metadata depends on the authorization scope of the connection user. According to different data source types, metadata collection methods are pre-built in to collect metadata. For example, mysql collects metadata through the information_schema library, and oracle obtains metadata through table information such as dba_tables. The content corresponding to the collected metadata includes but is not limited to the database name, table name, table description, table type, table row number, table capacity, and table creation time, etc. Table field information includes but is not limited to field name, field comment, field type, whether it is a partition field, and whether it is a primary key. Different data source types may have some differences, and try to include more fields compatible with information of different data source types.

[0068] The above-mentioned xxljob is a distributed task scheduling platform, whose core design goal is to be fast to develop, easy to learn, lightweight, and easy to expand. It is now open source and connected to the online product lines of many companies, ready to use out of the box.

[0069] Currently, metadata collection methods corresponding to common database types such as MySQL, Oracle, Hive, and Doris are built-in. When adding a new database type, the metadata collection method can be expanded and developed based on the scheduled task framework. Among them, the collected metadata such as tables and fields are stored in a unified storage structure. For example, table metadata includes data source type, database name, table name, table comment, table type, business type, etc., and field metadata includes data source type, database name, table name, field name, field description, field type, and whether it is a partition field, etc., that is, the metadata collected from different data source types are stored in a unified data structure, and the metadata can be viewed at a glance on the metadata management page.

[0070] S120, according to the selected metadata granularity, business line management architecture information, and organizational management structure information, the business category to which the unit metadata corresponding to the metadata granularity belongs is marked, a business attribution label of the unit metadata is obtained, and the corresponding business data authority manager is marked for the unit metadata. The unit metadata may be based on a granularity such as a table or a library.

[0071] Exemplarily, the collected metadata is tagged with business category at the table granularity. The platform is designed with a business line management architecture information module 110, which is presented in a hierarchical tree structure and marked with the department to which it belongs. At the same time, the platform is designed with an organizational management structure, which is presented in a hierarchical tree structure and marked with the person in charge. A table can only belong to one business category. The person in charge of the final indirect mapping table, if other users need to use the table, needs to submit access permission request information to apply for access permission, and the person in charge is responsible for approving the access permission request. Based on the business attribution label, you can also know the department to which the table belongs. This process is manually marked in combination with the source business system.

[0072] S130: Configure access permission request information of the corresponding business data according to the unit metadata selected by the user.

[0073] Furthermore, the access permission request information includes: data source ID, database type, user information, unit metadata, access permission type and permission validity period.

[0074] Exemplarily, the access permission request information includes the following five permission types:

[0075] (I) Data source ID, database type, user, table, permission type, permission validity period, synchronization flag (flag on whether to push to the permission management unit of the data source business system), and deletion flag.

[0076] (ii) Data source ID, database type, role, table, permission type, permission validity period, synchronization flag, and deletion flag.

[0077] (III) Data source ID, database type, user, database, permission type, permission validity period, synchronization flag, and deletion flag.

[0078] (IV) Data source ID, database type, role, database, permission type, permission validity period, whether to synchronize and whether to delete.

[0079] (V) Database type, role, user, and whether to delete the database.

[0080] Among them, the permission types include read, write, create and all permissions, which can also be developed and expanded as needed, and this application does not impose any restrictions; the validity period of the permission refers to the comparison between the deadline applied by the user and the current time to determine whether it has expired; the synchronization mark refers to whether it is synchronized to the permission management unit of the corresponding data source business system (Y means it has been synchronized, and N means it has not been synchronized); the deletion mark uses logical mark deletion rather than physical deletion to ensure that the permission relationship is deleted on the platform and is also deleted synchronously in the permission management unit of the data source business system, because the permission management unit of the data source business system usually does not have a setting for the user permission validity period.

[0081] The configuring the access permission request information of the corresponding business data according to the unit metadata selected by the user includes:

[0082] Displaying each unit metadata in the metadata set on a metadata browsing page according to each data source ID;

[0083] Receive the target unit metadata selected by the user on the metadata browsing page, obtain the data source ID and database type corresponding to the target unit metadata, and obtain the access permission type, permission validity period and user information configured according to the target unit metadata to obtain the access permission request information.

[0084] S140, obtaining corresponding access rights for corresponding business data from the business data authority manager annotated in the unit metadata and the authority management unit of the corresponding data source business system according to the access authority request information.

[0085] According to the business attribution label, we can know the department to which the table belongs. This process is manually marked in combination with the source business system. The platform controls permissions based on roles. Business personnel can determine the visibility of metadata, such as table information and field information, according to the scope of authorized roles. However, there is no real permission to use the table. For example, to query a table, it is necessary to initiate a permission application based on the metadata of the visible table. It will be combined with OA and eventually go to the head of the marked department for permission approval. After approval, authorization will be carried out so that business users can actually use the table data.

[0086] Furthermore, in step S140, according to the access permission request information, obtaining corresponding access permissions for corresponding business data from the business data permission manager annotated by the unit metadata and the permission management unit of the corresponding data source business system includes:

[0087] Sending the access permission request information to the business data permission manager annotated by the metadata, and when obtaining authorization information given by the business data permission manager, marking the access permission request information as standard access permission information;

[0088] The authorized standard access authority information is registered to the authority management unit of the corresponding data source business system using the authorization application method of the corresponding database type, so as to open the corresponding access authority in the authority management unit of the data source business system.

[0089] The platform will synchronize each piece of standard access permission information after authorization to the permission management unit of the data source business system. The permission management unit of the data source business system is differentiated according to the database type. For example, doris and mysql are based on role control, and hive is based on ranger control. Each authorization method is different. The platform provides packaged authorization application methods for registration according to the different standard access permission information. For example, doris is a set of authorization application methods (registration methods), and hive is a set of authorization application methods (registration methods), but the input format of the permission relationship is unified as mentioned above. If a database type is added, such as mongoDB, the platform development can add a mongoDB authorization application method.

[0090] It is understandable that the access permission request information also includes: whether to synchronize. When the authorization information given by the business data permission manager is obtained, marking the access permission request information as standard access permission information includes:

[0091] If the authorization information is obtained, the access permission request information is marked as standard access permission information by updating the state of the synchronization flag to yes; otherwise, the default state of the synchronization flag is kept to be no.

[0092] The method comprises: using a real-time synchronization task to scan synchronization marks in each standard access authority information, and registering the standard access authority information corresponding to the state of "no" in the synchronization mark into the authority management unit of the corresponding data source business system.

[0093] After the platform authorizes users or roles based on the metadata granularity of tables or libraries, it will immediately synchronize to the permission management unit of the data source business system according to the database type to which the library or table belongs (obtain the jdbc link according to the data source ID, connect to the permission management unit for registration, and activate the corresponding permissions in the permission management unit), such as doris, hive. If the synchronization is successful, the synchronization permission mark is modified to Y, indicating that it has been synchronized to the permission management unit. If there are factors such as network jitter that cause real-time synchronization to fail, but the mark is still N, it can be compensated by timing to ensure final consistency.

[0094] The synchronization to the permission management unit is based on the database type to determine which authorization application method built into the platform is called, so when a new database type is added, the authorization application method can be expanded and developed.

[0095] This application calls the same authorization application method for scheduled synchronization and real-time synchronization. Scheduled synchronization is just a change to scheduled call of the authorization application method. Scan the standard access permission information in real time according to the database type. If the synchronization mark is yes, check the connection according to the data source ID, connect to the permission management unit of the data source business system, and synchronize the unsynchronized standard access permission information of the platform to the permission management unit of each data source business system.

[0096] In one implementation, the access permission request information further includes: whether to delete a mark.

[0097] The method also includes: using a scheduled synchronization task to scan whether the validity period of the permission in each standard access permission information has expired, wherein the standard access permission information is the access permission request information that has been authorized; updating the deletion mark in the expired standard access permission information determined according to the validity period of the permission to yes, and synchronizing the corresponding standard access permission information to the permission management unit of the corresponding data source business system so that the permission management unit can delete the standard access permission information; and deleting the expired standard access permission information stored locally at the same time.

[0098] The scheduled synchronization task scans the validity period of the user's standard access permission information, and judges based on the current time. If it expires, it will be deleted in the permission management unit of the data source business system. Among them, if the existing authorization is deleted on the platform and marked as logical deletion, the scheduled synchronization task also needs to synchronize the scanned deletion information to the permission management unit.

[0099] The metadata information of this application uses tables as the granularity to mark the business ownership, so as to isolate permissions and meet the business's requirements for data security. At the same time, the link information can be modified and deleted at any time through the configuration page. It supports multiple database types, such as MySQL, Oracle, and Hive, and supports the expansion of new database types. It is synchronized to the data source permission system at a scheduled time, and can also support the synchronization of deletion relationships to the data source permission system by marking the logical deletion of platform permissions.

[0100] Figure 5 A schematic diagram of the structure of a business data rights management device according to an embodiment of the present application is shown. Exemplarily, the business data rights management device includes: a metadata collection module 410 , a business annotation module 420 , a rights request information configuration module 430 and an access rights acquisition module 440 .

[0101] The metadata collection module 410 is used to receive the data source information of each metadata to be collected configured by the user, and collect metadata corresponding to the business data in the corresponding data source business system according to each data source information to obtain a metadata set, wherein the metadata set is used to configure the access rights of the corresponding business data;

[0102] The business marking module 420 is used to mark the business category to which the unit metadata corresponding to the metadata granularity belongs according to the selected metadata granularity, the business line management architecture information, and the organizational management structure information, obtain the business attribution label of the unit metadata, and mark the corresponding business data authority manager for the unit metadata;

[0103] The permission request information configuration module 430 is used to configure the permission request information of the corresponding business data according to the unit metadata selected by the user;

[0104] The access permission obtaining module 440 is used to obtain the access permission of the corresponding business data from the business data permission manager annotated in the unit metadata and the permission management unit of the corresponding data source business system according to the access permission request information.

[0105] It can be understood that the device of this embodiment corresponds to the business data authority management method of the above embodiment, and the optional items in the above embodiment are also applicable to this embodiment, so they will not be described repeatedly here.

[0106] The present application also provides a terminal device. Exemplarily, the terminal device includes a processor and a memory, wherein the memory stores a computer program, and the processor runs the computer program to enable the terminal device to execute the functions of each module in the above-mentioned business data authority management method or the above-mentioned business data authority management device.

[0107] Among them, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, including a central processing unit (CPU), a graphics processing unit (GPU), a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or at least one of other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc., which can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application.

[0108] The memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electric erasable programmable read-only memory (EEPROM), etc. The memory is used to store a computer program, and the processor may execute the computer program accordingly after receiving an execution instruction.

[0109] The present application also provides a computer-readable storage medium for storing the computer program used in the above terminal device. For example, the computer-readable storage medium may include but is not limited to: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0110] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and structure diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in an alternative implementation, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the structure diagram and / or the flow diagram, and the combination of boxes in the structure diagram and / or the flow diagram, can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0111] In addition, the functional modules or units in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0112] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a smart phone, a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.

[0113] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A business data rights management method, characterized in that: include: Receive data source information of each metadata to be collected configured by the user, and collect metadata corresponding to business data in the corresponding data source business system according to each data source information, to obtain a metadata set, wherein the metadata set is used to configure access rights to the corresponding business data; According to the selected metadata granularity, business line management architecture information, and organizational management structure information, the business category to which the unit metadata corresponding to the metadata granularity belongs is marked to obtain a business attribution label for the unit metadata, and the corresponding business data authority manager is marked for the unit metadata; The access permission request information of the corresponding business data is configured according to the unit metadata selected by the user; the access permission request information includes: data source ID, database type, user information, unit metadata, access permission type and permission validity period; wherein, the access permission request information of the corresponding business data is configured according to the unit metadata selected by the user, including: displaying each unit metadata in the metadata set on a metadata browsing page according to each data source ID; receiving the target unit metadata selected by the user on the metadata browsing page, obtaining the data source ID and database type corresponding to the target unit metadata, and obtaining the access permission type, permission validity period and user information configured according to the target unit metadata, to obtain the access permission request information; According to the access permission request information, the corresponding access permission of the corresponding business data is obtained from the business data permission manager annotated in the unit metadata and the permission management unit of the corresponding data source business system; the corresponding access permission of the corresponding business data is obtained from the business data permission manager annotated in the unit metadata and the permission management unit of the corresponding data source business system according to the access permission request information, including: sending the access permission request information to the business data permission manager annotated in the metadata, and when obtaining the authorization information given by the business data permission manager, marking the access permission request information as standard access permission information; registering the authorized standard access permission information with the permission management unit of the corresponding data source business system using the authorization application method of the corresponding database type, so as to open the corresponding access permission in the permission management unit of the data source business system.

2. The business data rights management method according to claim 1, characterized in that: The data source information includes: data source ID, target database type, Java database connection, account number, password and target database name; The receiving of the data source information of each metadata to be collected configured by the user, and collecting metadata corresponding to the business data in the corresponding data source business system according to each data source information, to obtain a metadata set, includes: Receiving the data source information configured by the user through the configuration page; According to the target database type in each of the data source information, determine the metadata collection method corresponding to the target database type; use the metadata collection method to access the corresponding source data system and collect the corresponding metadata according to the Java database connection, the account number and the password, and use the data source ID to mark the metadata to obtain the metadata set.

3. The business data rights management method according to claim 2, characterized in that: The step of determining the metadata collection method corresponding to the target database type according to the target database type in each of the data source information includes: Build each corresponding scheduled task according to each database type; When executing each of the scheduled tasks, the configured data source information is scanned, and metadata is collected using a metadata collection method that matches the database type.

4. The business data rights management method according to claim 3, characterized in that: The access permission request information also includes: whether to delete the mark; The method also includes: using a scheduled synchronization task to scan whether the validity period of the permission in each standard access permission information has expired, wherein the standard access permission information is the access permission request information that has been authorized; updating the deletion mark in the expired standard access permission information determined according to the validity period of the permission to yes, and synchronizing the corresponding standard access permission information to the permission management unit of the corresponding data source business system so that the permission management unit can delete the standard access permission information; and deleting the expired standard access permission information stored locally at the same time.

5. The business data rights management method according to claim 1, characterized in that: The access permission request information includes: whether to synchronize the flag; When the authorization information given by the business data authority manager is obtained, marking the access authority request information as standard access authority information includes: If the authorization information is obtained, the access permission request information is marked as standard access permission information by updating the state of the synchronization flag to yes, otherwise the default state of the synchronization flag is kept to no; The method further includes: using a scheduled synchronization task to scan synchronization marks in each standard access authority information, and registering the standard access authority information corresponding to a state of "no" in the synchronization mark into a corresponding authority management unit of a data source business system.

6. A business data rights management device, characterized in that: include: The metadata collection module is used to receive the data source information of each metadata to be collected configured by the user, and collect the metadata corresponding to the business data in the corresponding data source business system according to each data source information to obtain a metadata set, wherein the metadata set is used to configure the access rights of the corresponding business data; A business marking module is used to mark the business category to which the unit metadata corresponding to the metadata granularity belongs according to the selected metadata granularity, business line management architecture information, and organizational management structure information, obtain the business attribution label of the unit metadata, and mark the corresponding business data authority manager for the unit metadata; A permission request information configuration module is used to configure the access permission request information of the corresponding business data according to the unit metadata selected by the user; wherein the access permission request information includes: data source ID, database type, user information, unit metadata, access permission type and permission validity period; wherein the permission request information configuration module is specifically used to: display each unit metadata in the metadata set on the metadata browsing page according to each data source ID; receive the target unit metadata selected by the user on the metadata browsing page, obtain the data source ID and database type corresponding to the target unit metadata, and obtain the access permission type, permission validity period and user information configured according to the target unit metadata, and obtain the access permission request information; An access permission acquisition module is used to obtain access permissions for corresponding business data from the business data permission manager annotated in the unit metadata and the permission management unit of the corresponding data source business system according to the access permission request information; the access permission acquisition module is specifically used to: send the access permission request information to the business data permission manager annotated in the metadata, and when obtaining the authorization information given by the business data permission manager, mark the access permission request information as standard access permission information; register the authorized standard access permission information with the permission management unit of the corresponding data source business system using the authorization application method of the corresponding database type, so as to open the corresponding access permission in the permission management unit of the data source business system.

7. A terminal device, characterized in that: The terminal device includes a processor and a memory, the memory stores a computer program, and the processor is used to execute the computer program to implement the business data authority management method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed on a processor, implements the business data authority management method according to any one of claims 1-5.

Images