A data warehouse data authority control method based on apisix

Abstract

The present invention relates to a data warehouse data authority control method based on apisix, and relates to the technical field of authority control, including: writing gateway configuration information; the gateway configuration information includes preset business groups, routing groups, access relationships and user information; receiving user access requests; the user access requests include request headers, request paths and data authority parameters requested by target users; according to user access requests, reading gateway configuration information, obtaining business groups of target users, and performing routing relationship judgments and data authority parameter judgments; when the conditions for authority judgment are met, allowing the target user to access the target data service. The beneficial effects of the present invention are: the present invention realizes a unified export of data services by centrally managing all data access requests at the gateway level. Regardless of which data warehouse or data service a user requests to access, all requests must undergo authority verification and access control by the gateway.

Description

Technical Field

[0001] The present invention relates to the technical field of authority control, and more specifically, to a data warehouse data authority control method based on apisix. Background Art

[0002] Traditional data permission control usually relies on the role-based access control (RBAC) model. This model manages data access by assigning users to specific roles and granting certain permissions to these roles. Although the RBAC model simplifies permission management to a certain extent, it is insufficient in dealing with complex and diverse data permission requirements. Especially in the multi-data warehouse environment of group enterprises, the RBAC model lacks the ability to control fine-grained data permissions at the resource level.

[0003] Specifically, the RBAC model mainly focuses on the correspondence between roles and permissions, and lacks fine-grained permission verification for specific data resources (such as data tables, columns, documents, or records). It cannot dynamically adjust access rights to specific data resources based on the user's role, nor can it accurately control to the record level. This means that the RBAC model is difficult to achieve unified verification and management of diverse data permission fields in different data services. Although some improved models based on RBAC have control over data permissions, the controlled data fields and control modes are single, and cannot meet the needs of different database management system data services for permission control of different permission fields and locations.

[0004] At the same time, as the scale of the enterprise expands, the number of users and types of permissions continue to increase, and the complexity and maintenance cost of permission management also increase. Especially when multiple data warehouse systems coexist, the workload of cross-system permission configuration and maintenance of the RBAC system is huge.

[0005] Therefore, in a group enterprise environment where each data warehouse provides different data services, how to provide a unified data export to achieve refined control over data permission fields of different data services, how to overcome the shortcomings of traditional RBAC solutions that cannot perform resource-level data permission verification, and how to reduce the labor cost of permission configuration have become urgent issues facing the current data management field. Summary of the invention

[0006] The purpose of the present invention is to address the deficiencies in the prior art and to propose a data warehouse data authority control method based on apisix.

[0007] In a first aspect, a data warehouse data authority control method based on apisix is ​​provided, comprising:

[0008] S1. Write gateway configuration information; the gateway configuration information includes preset service groups, routing groups, access relationships and user information;

[0009] S2. Receive a user access request; the user access request includes a request header, a request path, and data permission parameters requested by the target user, the request header includes authentication information of the target user, and the request path includes the target data service;

[0010] S3. Read the gateway configuration information according to the user access request, obtain the service group of the target user, and perform authority judgment, including:

[0011] According to the access relationship, determine whether the target user's business group is allowed to access the target data service under the routing group;

[0012] Determine whether the data permission parameter requested by the target user is within the data permission range of the routing group;

[0013] S4. When all conditions for authority determination are met, the target user is allowed to access the target data service.

[0014] Preferably, S1 comprises:

[0015] S101. Obtain information of each data service through each data warehouse API, where the information of the data service includes data range parameters and business attributes of the data service;

[0016] S102, creating a routing group according to the data range parameter of the data service;

[0017] S103, creating a service group according to the service attributes of the data service;

[0018] S104, obtaining user information;

[0019] S105, determining access relations according to requirements;

[0020] S106: Write the routing group, service group, user information and access relationship into the gateway.

[0021] Preferably, in S2, the data permission parameters requested by the target user are all data permission parameters of the target user or part of the data permission parameters of the target user.

[0022] Preferably, in S104, obtaining user information includes: collecting user information through various data warehouse APIs and / or manually creating user information.

[0023] Preferably, in S2, the user access request further includes a request body and request parameters, the data permission parameters requested by the target user are located in the request body or request parameters, and the data permission parameters are a single value or a list.

[0024] In a second aspect, a data warehouse data authority control device based on apisix is ​​provided, which is used to execute any method described in the first aspect, and the device includes a gateway and a management platform;

[0025] Wherein, the management platform is used to write gateway configuration information to the gateway;

[0026] The gateway is used to receive a user access request, and according to the user access request, read the gateway configuration information, obtain the service group of the target user, and perform authority judgment; when the conditions for authority judgment are met, the gateway allows the target user to access the target data service.

[0027] In a third aspect, an apisix-based data warehouse data authority control system is provided for executing any of the methods described in the first aspect, including:

[0028] A writing module, used to write gateway configuration information; the gateway configuration information includes preset service groups, routing groups, access relations and user information;

[0029] A receiving module, configured to receive a user access request; the user access request includes a request header, a request path, and data permission parameters requested by a target user, the request header includes authentication information of the target user, and the request path includes a target data service;

[0030] The authority judgment module is used to read the gateway configuration information according to the user access request, obtain the service group of the target user, and perform authority judgment, including:

[0031] According to the access relationship, determine whether the target user's business group is allowed to access the target data service under the routing group;

[0032] Determine whether the data permission parameter requested by the target user is within the data permission range of the routing group;

[0033] The access module is used to allow the target user to access the target data service when the conditions for authority judgment are met.

[0034] According to a fourth aspect, a computer storage medium is provided, wherein a computer program is stored in the computer storage medium; when the computer program is executed on a computer, the computer executes any method described in the first aspect.

[0035] The beneficial effects of the present invention are:

[0036] 1. The present invention realizes a unified export of data services by centrally managing all data access requests at the gateway level. No matter which data warehouse or data service a user requests to access, all requests must go through the gateway's permission verification and access control. This unified management mode not only improves the security of data access, but also simplifies the entry configuration of data services and reduces the security vulnerabilities that may be caused by multiple entries. At the same time, the unified export makes it easier for the system to monitor and audit all data access behaviors, providing higher controllability and transparency for the enterprise's data management.

[0037] 2. In a group data warehouse environment, the present invention provides permission management between multiple data warehouse systems through centralized management of the management platform and gateway. The system can automatically process the permission configuration of each data warehouse, reduce the complexity of cross-system permission management, and improve management efficiency.

[0038] 3. The present invention centrally manages data permissions and business metadata through the management platform, automatically generates and updates gateway configuration files, and reduces the workload of manual configuration and maintenance. Unlike the traditional RBAC model that requires a lot of manual intervention and configuration, the system of the present invention has a high degree of automation, which greatly reduces maintenance costs.

[0039] 4. The present invention realizes refined control of data permissions at the gateway level and supports permission management at multiple granularities such as row level. The user's data access permissions can be precisely limited to a row in the data table, meeting the data security requirements in complex business scenarios and preventing excessive data exposure.

[0040] 5. The present invention supports dynamic permission configuration, and can automatically adjust the user's permission range according to the user's permission attributes and business requirements. Compared with the traditional static permission configuration, the present invention greatly improves the flexibility of the system to cope with business changes and can quickly respond to changes in user permission requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a flowchart of a data warehouse data authority control method based on apisix;

[0042] Figure 2 A schematic diagram showing the relationship between gateway configuration information;

[0043] Figure 3 A flowchart of a permission control method executed by a permission control device;

[0044] Figure 4 This is a structural diagram of a data warehouse data authority control system based on apisix. DETAILED DESCRIPTION

[0045] The present invention is further described below in conjunction with embodiments. The description of the following embodiments is only used to help understand the present invention. It should be noted that for ordinary persons in the art, without departing from the principle of the present invention, the present invention can also be modified in some ways, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

[0046] Embodiment 1:

[0047] Embodiment 1 of the present invention provides a data warehouse data authority control device based on apisix, such as Figure 3 As shown, the device includes a gateway and a management platform.

[0048] Wherein, the management platform is used to write gateway configuration information to the gateway.

[0049] The gateway is used to receive a user access request, and according to the user access request, read the gateway configuration information, obtain the service group of the target user, and perform authority judgment; when the conditions for authority judgment are met, the gateway allows the target user to access the target data service.

[0050] Based on the above device, Example 1 of the present application also provides a data warehouse data authority control method based on apisix, such as Figure 1 As shown, including:

[0051] S1. Write gateway configuration information; the gateway configuration information includes preset service groups, routing groups, access relationships and user information.

[0052] like Figure 2 As shown, each user belongs to multiple business groups. Business groups, routing groups, and routing matching rules determine the corresponding access relationships. Users and routing groups determine the scope of data permissions. Routing groups and routing matching rules are many-to-many relationships, and routing matching rules correspond to one data service.

[0053] Among them, the preset business group includes business identification information. The preset routing group includes routing matching rules and an identification of whether data permissions need to be verified. If the identification is true, it means that data permission verification is required, and the location of the data permission parameter must be specified. The data permission parameter is located in the request parameter or request body of the user access request in S2, and can be a single value or a list. The data permission parameter is used to fine-grainedly control the scope of entries returned by the data warehouse data service, which directly affects the return results of the data resources.

[0054] The preset access relationship includes whether the current route group and the current business group are allowed to access this sub-route. The preset user information includes the authentication method, the business group list (1 or more), and the data permission range list of each route group (can be one or more, or unlimited).

[0055] For example, Figure 3 As shown, data warehouse A provides two data services, one is data service A / a that verifies the company code comCode in the url parameter, and the other is public data service A / b that does not verify data permissions. Data warehouse B provides two data services, one is data service B / c that verifies the company code comCode in the url parameter, and the other is public data service B / d that verifies the data element code buCode in the request body.

[0056] The location of the data elements in the request body is as follows:

[0057] {

[0058] "query":{

[0059] "buCode":""

[0060] "others": {...}

[0061] }

[0062] }

[0063] The management platform obtains gateway configuration information based on the API of the data warehouse. For example:

[0064] User u1 is allowed to access data services a, b, c, and d, and the company code is unrestricted and the data element code is bu1.

[0065] User u2 is allowed to access data services a, b, d, while the company code is com2 and the data element codes are bu2 and bu3.

[0066] One of the configuration methods provided in this case is as follows.

[0067] The preset routing groups include: routing group p1, routing group p2 and routing group p3.

[0068] Among them, the prefix of the routing group p1 is: / api / com, the flag for verifying data permissions is true, and the location of the data permission parameter is specified as: url parameter, and the company code comCode needs to be verified in the url parameter.

[0069] The prefix of the routing group p2 is: / api / bu, the flag for verifying data permissions is true, and the location of the data permission parameter is specified as: request body, and the data element code query.buCode needs to be verified in the request body.

[0070] The prefix of routing group p3 is: / api / common, and the flag for verifying data permissions is false.

[0071] The preset business groups include: business group b1 and business group b2.

[0072] The preset user information includes:

[0073] When the user authentication is u1, the business group to which he belongs is b1, and the data permission range list of each routing group is as follows: the routing group p1 verifies that the company code is not restricted, and the routing group p2 verifies that the data element code is bu1.

[0074] When the user authentication is u2, the business group to which he belongs is b2, and the data permission range list of each routing group is: the routing group p1 verification company code is com2, and the routing group p2 verification data element code is bu2, bu3.

[0075] The preset access relationships include:

[0076] b1,p1,A / a

[0077] Among them, b1,p1,A / a means that business group b1 is allowed to access data service A / a through routing group p1. Similarly, other access relationships include:

[0078] b1,p1,B / c

[0079] b1,p2,B / d

[0080] b1,p3,A / b

[0081] b2,p1,A / a

[0082] b2,p3,A / b

[0083] b2,p2,B / d

[0084] The above configuration is only one implementation of the method of the present invention. The specific configuration should be optimized according to the actual business needs and user attributes of the user. For example, when the business group b1 allows access to all data services, it can be represented by * in the access relationship to reduce unnecessary configuration redundancy without affecting the overall concept of the present invention.

[0085] S2. Receive a user access request; the user access request includes a request header, a request path, and data permission parameters requested by the target user, the request header includes the authentication information of the target user to distinguish the user's identity, and the request path includes the target data service.

[0086] In S2, the user access request also includes a request body and request parameters. The data permission parameters requested by the target user are located in the request body or request parameters. The data permission parameters are a single value or a list. It should be noted that the request parameters and request body are the contents required by the data service itself. The gateway is only responsible for permission verification and will not modify these contents.

[0087] S3. Read the gateway configuration information according to the user access request, obtain the service group of the target user, and perform authority judgment, including:

[0088] Based on the access relationship, determine whether the target user's business group is allowed to access the target data service under the routing group.

[0089] Determine whether the data permission parameter requested by the target user is within the data permission range of the routing group.

[0090] S4. When all conditions for authority determination are met, the target user is allowed to access the target data service.

[0091] For example, the permissions are satisfied as follows:

[0092] User u1 belongs to business group b1, and the data service requested is B / d (check the data element code buCode in the request body).

[0093] The prefix of the routing group p2 is: / api / bu, the flag of verifying data permissions is true, and the location of the data permission parameter is specified as: request body, and the data element code query.buCode needs to be verified in the request body. For example, the data element code allowed to be accessed is bu1.

[0094] The request path in the user access request is expressed as: / api / bu / B / d.

[0095] The request body is:

[0096] {

[0097] "query": {

[0098] "buCode": "bu1",

[0099] "others": { ...}

[0100] }

[0101] }

[0102] The permission judgment process is as follows:

[0103] Based on the access relationship, determine whether the target user's business group is allowed to access the target data service under the routing group.

[0104] Specifically, according to the access relationship b1, p2, B / d preset in the gateway configuration information, the service group b1 of the user u1 is allowed to access the B / d service under the routing group p2.

[0105] Determine whether the data permission parameter requested by the target user is within the data permission range of the routing group.

[0106] Specifically, query.buCode in the request body is bu1, and the data permission of user u1 to routing group p2 is bu1, and the permissions match.

[0107] It can be seen that both conditions for permission judgment are met, and the permission component in the gateway allows user u1 to access data service B / d.

[0108] As another example, the situation where the permissions are not satisfied is as follows:

[0109] User u2 belongs to business group b2, and the data service requested is B / c (verify company code comCode in the URL parameter).

[0110] The prefix of the route group p1 is: / api / com, the flag of verifying data permissions is true, and the location of the data permission parameter is specified as: url parameter, and the company code comCode needs to be verified in the url parameter. For example, the company code allowed to access is com2.

[0111] The request path in the user access request is expressed as: / api / com / B / c?comCode=com1.

[0112] The permission judgment process is as follows:

[0113] Based on the access relationship, determine whether the target user's business group is allowed to access the target data service under the routing group.

[0114] Specifically, the service group b2 of user u2 is not allowed to access the B / c service under the routing group p1.

[0115] Determine whether the data permission parameter requested by the target user is within the data permission range of the routing group.

[0116] If we continue to check, the URL parameter comCode of the request is com1, but the data permission of user u2 for routing group p1 is com2. Furthermore, even if we continue to check the data permission parameters, we will find that the user permissions do not match.

[0117] In this example, since at least one of the conditions is not met (actually neither condition is met), the gateway permission component returns an exception and denies user u2 access to data service B / c.

[0118] Embodiment 2:

[0119] Based on Example 1, Example 2 of the present application provides a more specific data warehouse data authority control method based on apisix, including:

[0120] S1. Write gateway configuration information; the gateway configuration information includes preset service groups, routing groups, access relationships and user information.

[0121] S1 includes:

[0122] S101. Obtain information of each data service through each data warehouse API, where the information of the data service includes data range parameters and business attributes of the data service.

[0123] S102: Create a routing group according to the data range parameter of the data service.

[0124] S103: Create a service group according to the service attributes of the data service.

[0125] S104: Obtain user information.

[0126] In S104, obtaining user information includes: collecting user information through various data warehouse APIs and / or manually creating user information.

[0127] S105: Determine the access relationship according to the demand.

[0128] In the data authority control device, the access relationship is determined by the content provided by the management platform.

[0129] S106: Write the routing group, service group, user information and access relationship into the gateway.

[0130] In addition, a gateway permission component needs to be written with the following functions: when a user accesses a data service, the gateway will first determine whether the current user's business group can access this sub-route under the current routing group, and then determine whether the parameters of the current routing group data permission position meet the current user's data range for the current routing group. If both conditions are met, access to the data service is allowed; if any condition is not met, an exception is returned.

[0131] S2. Receive a user access request; the user access request includes a request header, a request path, and data permission parameters requested by a target user, the request header includes authentication information of the target user, and the request path includes a target data service.

[0132] In S2, the data permission parameters requested by the target user are all data permission parameters of the target user or part of the data permission parameters of the target user.

[0133] Some data permission parameters can be the data range currently required. Compared with some methods that obtain data permission ranges through additional components and forward data ranges to request data services, this method allows users to only request the data range currently required during actual access. The beneficial effects are: increased flexibility of user access; reduced data entries returned this time, improved security; and reduced bandwidth pressure on gateways and data services.

[0134] S3. Read the gateway configuration information according to the user access request, obtain the service group of the target user, and perform authority judgment, including:

[0135] According to the access relationship, determine whether the target user's business group is allowed to access the target data service under the routing group;

[0136] Determine whether the data permission parameter requested by the target user is within the data permission range of the routing group.

[0137] S4. When all conditions for authority determination are met, the target user is allowed to access the target data service.

[0138] It should be noted that the parts in this embodiment that are the same or similar to those in Embodiment 1 can be referenced to each other and will not be described in detail in this application.

[0139] Embodiment 3:

[0140] Based on Examples 1 and 2, Example 3 of the present application provides a data warehouse data authority control system based on apisix, such as Figure 4 As shown, including:

[0141] A writing module, used to write gateway configuration information; the gateway configuration information includes preset service groups, routing groups, access relations and user information;

[0142] A receiving module, configured to receive a user access request; the user access request includes a request header, a request path, and data permission parameters requested by a target user, the request header includes authentication information of the target user, and the request path includes a target data service;

[0143] The authority judgment module is used to read the gateway configuration information according to the user access request, obtain the service group of the target user, and perform authority judgment, including:

[0144] According to the access relationship, determine whether the target user's business group is allowed to access the target data service under the routing group;

[0145] Determine whether the data permission parameter requested by the target user is within the data permission range of the routing group;

[0146] The access module is used to allow the target user to access the target data service when the conditions for authority judgment are met.

[0147] Specifically, the method provided in this embodiment is a system corresponding to the method provided in Embodiments 1 and 2. Therefore, the parts in this embodiment that are the same or similar to Embodiments 1 and 2 can be referenced to each other and will not be repeated in this application.

[0148] In summary, the present invention realizes a unified export of data services by centrally managing all data access requests at the gateway level. Regardless of which data warehouse or data service a user requests to access, all requests must go through the gateway's permission verification and access control. This unified export mechanism effectively reduces the fragmented management of data services and ensures that all data access follows consistent security policies and permission control rules. This method helps enterprises establish standardized data access processes and management specifications, and improves overall data governance capabilities and efficiency.

Claims

1. A data warehouse data authority control method based on apisix, characterized in that: include: S1. Write gateway configuration information; The gateway configuration information includes preset service groups, routing groups, access relationships and user information; S1 includes: S101. Obtain information of each data service through each data warehouse API, where the information of the data service includes data range parameters and business attributes of the data service; S102, creating a routing group according to the data range parameter of the data service; S103, creating a service group according to the service attributes of the data service; S104, obtaining user information; S105, determining access relations according to requirements; S106, writing the routing group, service group, user information and access relationship into a gateway; The preset user information includes the authentication method, the business group list, and the data permission range list of each routing group; S2. Receive a user access request; the user access request includes a request header, a request path, and data permission parameters requested by the target user, the request header includes authentication information of the target user, and the request path includes the target data service; S3. Read the gateway configuration information according to the user access request, obtain the service group of the target user, and perform authority judgment, including: According to the access relationship, determine whether the target user's business group is allowed to access the target data service under the routing group; Determine whether the data permission parameter requested by the target user is within the data permission range of the routing group; S4. When all conditions for authority determination are met, the target user is allowed to access the target data service.

2. The data warehouse data authority control method based on apisix according to claim 1 is characterized in that: In S2, the data permission parameters requested by the target user are all data permission parameters of the target user or part of the data permission parameters of the target user.

3. The data warehouse data authority control method based on apisix according to claim 2 is characterized in that: In S104, obtaining user information includes: collecting user information through various data warehouse APIs and / or manually creating user information.

4. The data warehouse data authority control method based on apisix according to claim 3 is characterized in that: In S2, the user access request also includes a request body and request parameters. The data permission parameters requested by the target user are located in the request body or the request parameters. The data permission parameters are a single value or a list.

5. A data warehouse data authority control device based on apisix, characterized in that: Used to execute the method according to any one of claims 1 to 4, the device comprises a gateway and a management platform; Wherein, the management platform is used to write gateway configuration information to the gateway; The gateway is used to receive a user access request, and according to the user access request, read the gateway configuration information, obtain the service group of the target user, and perform authority judgment; when the conditions for authority judgment are met, the gateway allows the target user to access the target data service.

6. A data warehouse data authority control system based on apisix, characterized in that: Used to perform the method according to any one of claims 1 to 4, comprising: A writing module, used to write gateway configuration information; the gateway configuration information includes preset service groups, routing groups, access relations and user information; A receiving module, configured to receive a user access request; the user access request includes a request header, a request path, and data permission parameters requested by a target user, the request header includes authentication information of the target user, and the request path includes a target data service; The authority judgment module is used to read the gateway configuration information according to the user access request, obtain the service group of the target user, and perform authority judgment, including: According to the access relationship, determine whether the target user's business group is allowed to access the target data service under the routing group; Determine whether the data permission parameter requested by the target user is within the data permission range of the routing group; The access module is used to allow the target user to access the target data service when the conditions for authority judgment are met.

7. A computer storage medium, characterized in that: The computer storage medium stores a computer program; when the computer program is executed on a computer, the computer executes any one of the methods described in claims 1 to 4.

Images