Methods, systems, and media for controlling data access permissions in full-text search systems

Abstract

This invention provides a method, system, and medium for controlling data access permissions in a full-text search system, comprising: a business system permission system access step, in which the business system dynamically configures permission dimension information and user permission acquisition interface information to a permission control component, and assembles data within the permission control component; a data synchronization step, in which the permission control component merges the assembled data, and the data synchronization component finally writes it to a storage center; a data query step, in which user permissions are matched with data permissions, combined with the user's input conditions, to generate a query statement for querying; and an output step, in which the content within the user's permission scope that meets the user's query conditions is output. This invention solves the problem of which data users can view in a full-text search system, ensures data security during searches, meets the data search permission control needs of different business systems, and has significant potential for widespread application.

Description

Technical Field

[0001] This invention belongs to the field of full-text search and data security, specifically relating to a method, system, and medium for controlling data access permissions in a full-text search system. Background Technology

[0002] In the era of "Internet Plus," many industries have begun to develop full-text search systems tailored to their specific characteristics to achieve fast and accurate data retrieval. Data, as a crucial component of corporate assets, possesses significant value; data breaches can lead to severe economic losses and the loss of core competitiveness. Therefore, ensuring that users can only search data within their authorized scope, preventing data leaks, and guaranteeing data security during searches have become critical issues for enterprise-level full-text search systems. Currently, most existing data access control methods are based on relational databases and are not suitable for full-text search systems based on non-relational databases.

[0003] Chinese patent document ZL201410375662.7 discloses a data access permission control method, belonging to the field of data access permission control. This method includes the following steps: a) establishing a data model; b) establishing an inheritance hierarchy between data types; c) establishing a user model; d) creating a domain-specific language for data access permissions; e) defining data access permissions; f) establishing a data access proxy; g) performing permission judgment; and h) returning the results to the user through the data access proxy. However, although this patent document mentions a data access permission control method suitable for non-relational databases, this method is not suitable for full-text search systems that only focus on data search operations. Full-text search systems only need to ensure that users do not access data beyond their authorized permissions during searches; which data users can access is the responsibility of the data management system (business system). Therefore, this method requires the business system to cooperate in modifying its data access permission system, posing a risk of intrusion into the business system's data access permission control system and thus having certain shortcomings.

[0004] Chinese patent document ZL201510434185.1 discloses a method for implementing data access control. This method includes: initialization; establishing associations between various containers; when a user accesses a database object in the system, finding the corresponding identifier; generating a query constraint expression; constructing an ORM expression; and returning the access result. However, this patent document is applicable to application systems using relational databases for storage, and using SQL cannot solve the problem of achieving full-text search using word segmentation queries.

[0005] Therefore, the field of full-text search urgently needs a flexible data access control method that can adapt to different permission control systems. Summary of the Invention

[0006] To address the shortcomings of existing technologies, the purpose of this invention is to provide a method, system, and medium for controlling data access permissions in a full-text search system.

[0007] A data access permission control method for a full-text search system provided by the present invention includes:

[0008] The steps for integrating the business system's permission system are as follows: The business system dynamically configures permission dimension information and user permission acquisition interface information into the permission control component, and then assembles the data in the permission control component.

[0009] In the data synchronization process, the access control component merges the assembled data, and finally the data synchronization component writes it to the storage center.

[0010] The data query process involves matching user permissions with data permissions, combining the conditions entered by the user during the query, to generate a query statement, and then performing the query.

[0011] The output step outputs the content that matches the user's query criteria and falls within the user's permission scope.

[0012] Preferably, the business system permission system access step includes:

[0013] The steps for configuring permission dimension information are as follows: Business systems configure permission dimension information according to their own business authorization scenarios. Permission dimension information includes: authorization dimension information and permission rule information.

[0014] The user permission acquisition interface configuration steps are as follows: the business system provides an interface that can obtain the user permission object set of a user based on the username, and the interface address is configured in the permission control component;

[0015] The data assembly step involves assembling the configured permission dimension information data within the permission control component.

[0016] Preferably, the assembled data includes: main content and permission content;

[0017] The permissions include: data authorization flags, whitelist of data permission object sets, and blacklist of data permission object sets. The data authorization flag has two states: 0 indicates that the data is not authorized and can be searched by all users during data query; 1 indicates that the data is authorized and can only be searched by users with the required permissions during data query.

[0018] Preferably, the data synchronization step includes:

[0019] In the data push step, the business system pushes the assembled and processed data to the search system through a data synchronization request;

[0020] In the data writing step, the data synchronization component writes the data from the search system to the storage center; the storage center is used to store and index business data.

[0021] Preferably, in the data push step, after receiving the synchronization request, the permission control component will merge the data permission object set information in the assembled data.

[0022] Preferably, the data query step includes:

[0023] In the process of obtaining user permissions, after receiving a user's search request, the permission control component of the search system will call the user permission acquisition interface configured when the business system's permission system is integrated to obtain the user permission object set information and merge the user permission object set information.

[0024] The step of assembling query conditions involves the search component combining the user permission information (after merging and processing the permission component) as query conditions into the query statement, performing the query, and returning content that meets the user's query conditions within the user's permission scope.

[0025] Preferably, the data permission object set information processing method includes: concatenating permission objects from the same data permission object set into a string, separating different permission objects with spaces, and then pushing it to the search system.

[0026] Preferably, the user permission object set information processing method includes: concatenating permission objects from the same user permission object set into a string, with different elements separated by spaces.

[0027] A data access permission control system for a full-text search system includes:

[0028] The business system permission system access module is used to dynamically configure permission dimension information and user permission acquisition interface information of the business system to the permission control component, and to assemble the data in the permission control component.

[0029] The data synchronization module is used by the access control component to merge the assembled data, and finally the data synchronization component writes it to the storage center.

[0030] The data query module is used to match user permissions with data permissions, combine the conditions entered by the user during the query, generate a query statement, and perform the query.

[0031] The output module is used to output content that meets the user's query criteria and falls within the user's permission scope.

[0032] A computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of a data access permission control method for a full-text search system.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] 1. By setting the system so that users can only search for content that meets their search criteria within their own permissions, this invention solves the problem of which data users can view in a full-text search system, thus ensuring data security during the search process;

[0035] 2. By supporting dynamic configuration of permission dimensions through data access permission control methods, this invention flexibly adapts to the permission control systems of different business systems, thus meeting the data search permission control needs of different business systems.

[0036] 3. By separating data access permissions from business logic and using a proxy approach, this invention is transparent to developers, easy to use, scalable, and portable, and has great potential for widespread application.

[0037] 4. By effectively avoiding the performance and security issues associated with using SQL statement concatenation, the present invention offers better performance and security. Attached Figure Description

[0038] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0039] Figure 1 Flowchart of data access permission control method;

[0040] Figure 2 This is a schematic diagram of a data access permission control model. Detailed Implementation

[0041] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0042] This invention provides a data access permission control method, system, and medium for a full-text search system to address the question of which data users can view in a full-text search system, thereby ensuring data security during searches. To achieve the above objective, this invention provides a data access permission control model suitable for search scenarios. Figure 2 Based on this model, a data access permission control method and system for a full-text search system are proposed. Figure 1 ).

[0043] Data access control models suitable for search scenarios include:

[0044] Permission Dimensions: Composed of authorization dimensions and permission rules. Authorization dimensions refer to the way data is authorized to users, such as authorization by organization, role, or account. Permission rules refer to whether permissions are inherited, with three possibilities: no inheritance, upward inheritance, and downward inheritance. Different combinations of authorization dimensions and permission rules can create new permission dimensions. For example, when a role is combined with a no-inheritance permission rule, a user can only view data that their own role has permission to access; when a role is combined with an upward inheritance permission rule, a user can view data that their own role has permission to access, as well as data that all sub-roles under their own role have permission to access; when an organization is combined with a downward inheritance permission rule, once data is authorized to a department, employees in that department and all its subordinate organizations have permission to access that data.

[0045] Permission object: A specific permission entity, such as an organization, a role, or an account. Due to the introduction of permission rules, permission objects can be either direct permission objects or inherited permission objects. Direct permission objects refer to permission objects that a user directly possesses or whose data is directly authorized; inherited permission objects refer to permission objects that a user indirectly possesses or whose data is indirectly authorized through inheritance.

[0046] User permission object set: The collection of permission objects that a user possesses under the same permission dimension, such as a role object set. When the permission rule for a certain permission dimension is inherited downwards, the user permission object set must include direct permission objects and indirect permission objects, as shown in Table 1.

[0047] Data permission object set: A collection of permission objects that are authorized to access data under the same permission dimension, such as a set of role objects. Data permission object sets can exist in two forms: whitelist and blacklist. A whitelist indicates which permission objects have been authorized to access the data; a blacklist indicates which permission objects are prohibited from accessing the data. When the permission rules for a certain permission dimension are inherited upwards, the data permission object set must include both direct and indirect permission objects, as shown in Table 1.

[0048] Matching rules: IN and NOT IN. When the data permission object set is a whitelist, the matching rule is IN. Under the IN rule, the result is true if at least one object in the user permission object set exists in the data permission object set; otherwise, the result is false. When the data permission object set is a blacklist, the matching rule is NOT IN. Under the NOT IN rule, the result is false if at least one object in the user permission object set exists in the data permission object set; otherwise, the result is true. A user has access to the data only when all NOT IN rules are true and at least one IN rule is true.

[0049] There is a many-to-many relationship between data and permission dimensions, meaning a single piece of data may have authorization relationships across multiple permission dimensions, and a single permission dimension may be applied to authorize multiple pieces of data. There is also a one-to-one relationship between permission dimensions and data permission object sets. A single data permission object set contains multiple permission objects, meaning data may be authorized to multiple permission objects on a given permission dimension. Similarly, there is a many-to-many relationship between users and permission dimensions, and a one-to-one relationship between permission dimensions and user permission object sets.

[0050] Table 1. Relationship between permission object sets and permission rules

[0051]

[0052] A data access permission control method for a full-text search system provided by the present invention includes the following steps:

[0053] The steps for integrating the business system's permission system involve dynamically configuring permission dimension information and user permission acquisition interface information into the permission control component, and then assembling the data within the permission control component. Specifically, this includes:

[0054] The steps for configuring permission dimension information are as follows: Business systems configure permission dimension information according to their own business authorization scenarios. Permission dimension information includes: authorization dimension information and permission rule information.

[0055] The user permission acquisition interface configuration steps are as follows: the business system provides an interface that can obtain the user permission object set of a user based on the username, and the interface address is configured in the permission control component.

[0056] The data assembly step involves assembling the configured permission dimension information data within the permission control component.

[0057] The assembled data includes: main content and permission content. Main content refers to the data used for full-text search. Permission content refers to the content used to determine whether a user has the necessary access permissions for the data during a search. Permission content includes data authorization flags, a whitelist of data permission object sets, and a blacklist of data permission object sets. Data authorization flags have two states: 0 indicates that the data is not authorized, meaning it can be searched by all users during a data query; 1 indicates that the data is authorized, meaning it can only be searched by users with the required permissions during a data query.

[0058] The data synchronization process involves the access control component merging the assembled data before the data synchronization component finally writes it to the storage center. Specifically, this includes:

[0059] In the data push process, the business system pushes the assembled and processed data to the search system via a data synchronization request. Specifically, upon receiving the synchronization request, the access control component merges the data permission object sets within the assembled data. The specific processing method is as follows: permission objects within the same permission object set are concatenated into a single string, with different permission objects separated by spaces, before being pushed to the search system.

[0060] In the data writing step, the data synchronization component writes the data from the search system to the storage center.

[0061] Elasticsearch, an open-source distributed full-text search engine, serves as the storage center for storing and indexing business data. The following indexing rules apply to permission content: the data type (type) of the data authorization marker is "keyword"; the data type of the data permission object set whitelist and data permission object set blacklist is "text," using a whitespace tokenizer.

[0062] The data query process involves matching user permissions with data permissions, combining this with the conditions entered by the user during the query, to generate a query statement, and then performing the query. Specifically, this includes:

[0063] The steps for obtaining user permissions are as follows: After receiving a user's search request, the permission control component calls the user permission acquisition interface configured when the business system's permission system was integrated to obtain the user permission object set information and then merges this information. Specifically, permission objects within the same permission object set are concatenated into a single string, with different elements separated by spaces.

[0064] The step of assembling query conditions involves the search component combining the user permission information (processed by the permission component) as query conditions into the query statement for Elasticsearch (ES) query. During the query, data is filtered based on the user permission information, ultimately returning only content that matches the user's query conditions and falls within the scope of their permissions.

[0065] The output step outputs the content that matches the user's query criteria and falls within the user's permission scope.

[0066] This invention also provides a data access control system for a full-text search system, comprising:

[0067] The business system permission system access module is used to dynamically configure permission dimension information and user permission acquisition interface information of the business system to the permission control component, and to assemble the data in the permission control component.

[0068] The data synchronization module is used by the access control component to merge the assembled data and then write it to the storage center.

[0069] The data query module is used to match user permissions with data permissions, combine the conditions entered by the user during the query, generate a query statement, and perform the query.

[0070] The output module is used to output content that meets the user's query criteria and falls within the user's permission scope.

[0071] The present invention also provides a computer-readable storage medium storing a computer program, wherein the steps of a data access permission control method for a full-text search system are implemented when the computer program is executed by a processor.

[0072] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0073] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A method for controlling data access permissions in a full-text search system, characterized in that, include: The steps for integrating the business system's permission system are as follows: The business system dynamically configures permission dimension information and user permission acquisition interface information into the permission control component, and then assembles the data in the permission control component. In the data synchronization process, the access control component merges the assembled data, and finally the data synchronization component writes it to the storage center. The data query process involves matching user permissions with data permissions, combining the conditions entered by the user during the query, to generate a query statement, and then performing the query. The output step outputs the content that matches the user's query criteria within the user's permission scope. The steps for accessing the business system's permission system include: The steps for configuring permission dimension information are as follows: Business systems configure permission dimension information according to their own business authorization scenarios. Permission dimension information includes: authorization dimension information and permission rule information. The user permission acquisition interface configuration steps are as follows: the business system provides an interface that can obtain the user permission object set of a user based on the username, and the interface address is configured in the permission control component; The data assembly step involves assembling the configured permission dimension information data within the permission control component. The assembled data includes: main content and permission content; The permissions include: data authorization flag, whitelist of data permission object sets, and blacklist of data permission object sets; the data authorization flag has two states: when it is 0, it means that the data is not authorized and can be searched by all users when querying data; when it is 1, it means that the data is authorized and can only be searched by users with permissions when querying data. The data query steps include: In the process of obtaining user permissions, after receiving a user's search request, the permission control component of the search system will call the user permission acquisition interface configured when the business system's permission system is integrated to obtain the user permission object set information and merge the user permission object set information. The step of assembling query conditions involves the search component combining the user permission information (after merging and processing the permission component) as query conditions into the query statement, performing the query, and returning content that meets the user's query conditions within the user's permission scope.

2. The data access permission control method for a full-text search system according to claim 1, characterized in that, The data synchronization steps include: In the data push step, the business system pushes the assembled and processed data to the search system through a data synchronization request; In the data writing step, the data synchronization component writes the data from the search system to the storage center; the storage center is used to store and index business data.

3. The data access permission control method for a full-text search system according to claim 2, characterized in that, In the data push step, after receiving the synchronization request, the permission control component will merge the data permission object set information in the assembled data.

4. The data access permission control method for a full-text search system according to claim 3, characterized in that, The data permission object set information processing method includes: concatenating permission objects from the same data permission object set into a string, separating different permission objects with spaces, and then pushing it to the search system.

5. The data access permission control method for a full-text search system according to claim 1, characterized in that, The method for processing user permission object set information includes: concatenating permission objects from the same user permission object set into a single string, with different elements separated by spaces.

6. A data access permission control system for a full-text search system, characterized in that, include: The business system permission system access module is used to dynamically configure permission dimension information and user permission acquisition interface information of the business system to the permission control component, and to assemble the data in the permission control component. The data synchronization module is used by the access control component to merge the assembled data, and finally the data synchronization component writes it to the storage center. The data query module is used to match user permissions with data permissions, combine the conditions entered by the user during the query, generate a query statement, and perform the query. The output module is used to output content that meets the user's query criteria and is within the user's permission scope. The business system permission system access module includes: The steps for configuring permission dimension information are as follows: Business systems configure permission dimension information according to their own business authorization scenarios. Permission dimension information includes: authorization dimension information and permission rule information. The user permission acquisition interface configuration steps are as follows: the business system provides an interface that can obtain the user permission object set of a user based on the username, and the interface address is configured in the permission control component; The data assembly step involves assembling the configured permission dimension information data within the permission control component. The assembled data includes: main content and permission content; The permissions include: data authorization flag, whitelist of data permission object sets, and blacklist of data permission object sets; the data authorization flag has two states: when it is 0, it means that the data is not authorized and can be searched by all users when querying data; when it is 1, it means that the data is authorized and can only be searched by users with permissions when querying data. The data query module includes: In the process of obtaining user permissions, after receiving a user's search request, the permission control component of the search system will call the user permission acquisition interface configured when the business system's permission system is integrated to obtain the user permission object set information and merge the user permission object set information. The step of assembling query conditions involves the search component combining the user permission information (after merging and processing the permission component) as query conditions into the query statement, performing the query, and returning content that meets the user's query conditions within the user's permission scope.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the full-text search system data access permission control method as described in any one of claims 1 to 5.

Images