Permission discrete access control method and device

Abstract

The invention discloses a permission discrete access control method and device, and relates to the technical field of databases, and the method comprises the steps: 1, creating basic elements in a database management system, the basic elements comprising a database subject, a database object and a database label, 2, respectively carrying out marking classification on the database subject, the database object and the database operation authority by using database labels, and 3, creating an access control strategy based on the database subject, the database object and the database operation authority which are marked and classified by using the labels, and storing the access control strategy. Each access control strategy defines a database subject with a corresponding label, and an operation behavior with a corresponding label is allowed on a database object with a corresponding label, and step 4, when the database management system receives an SQL command of the database subject, obtaining the database subject, the database object and a database operation authority according to the SQL command, and sending the database subject, the database object and the database operation authority to the database management system. And matching with an access control strategy in the database management system, if matching succeeds, allowing to continue to execute the SQL command, otherwise, forbidding to continue to execute the SQL command.

Description

Technical Field

[0001] The invention discloses a method and a device, and relates to the technical field of databases, in particular to a permission separation access control method and a device. Background Art

[0002] Access control is the management of user access rights to data resources by the database management system. It is mainly used to identify whether the user has the permission to access data resources. Access here includes reading and writing. If the access control system determines that the user has the access rights to the corresponding data resources, the user is allowed to access the data resources; otherwise, the user's access is denied. Through access control, the security of data resources in the system can be effectively improved.

[0003] However, in some database management systems, permission settings are relatively simple, with great security risks and cannot be adjusted. Access control strategies are not flexible enough to achieve more fine-grained permission separation access control and cannot meet higher-level and more customer-friendly access control requirements. Summary of the invention

[0004] In view of the problems of the prior art, the present invention provides a permission separation access control method and device to solve the problems that database permission separation management and duty separation access control management are inflexible, prone to errors, and difficult to expand scenarios.

[0005] The specific scheme proposed by the present invention is:

[0006] The present invention provides a permission separation access control method, comprising:

[0007] Step 1: Create basic elements in the database management system, including database subject, database object and database label.

[0008] Step 2: Use database tags to classify database subjects, database objects, and database operation permissions.

[0009] Step 3: Create and store access control policies based on database subjects, database objects, and database operation permissions classified by tags. Each access control policy defines the database subjects with corresponding tags and the operations with corresponding tags allowed on the database objects with corresponding tags.

[0010] Step 4: When the database management system receives the SQL command from the database subject, it obtains the database subject, database object and database operation permissions according to the SQL command, and matches them with the access control policy in the database management system. If the match is successful, the SQL command is allowed to continue to execute, otherwise the SQL command is prohibited from continuing to execute.

[0011] Furthermore, in the aforementioned access control method of separation of rights, the database subject in step 1 refers to the user and its collection managed by the database management system, as well as each process representing the user, and the database object refers to the database object operated by the database subject.

[0012] In step 2, database tags are used to mark users with the same or similar attributes, database operation permissions, and operation behaviors as the same tags.

[0013] Use database labels to label data objects with the same or similar data sensitivity with the same label,

[0014] Database tags are used to mark database operation permissions with the same or similar data processing methods for objects with the same tag.

[0015] Furthermore, in the step 2 of the privilege separation access control method, the database subject is marked and classified using database tags. When the database subject is a database administrator, the number of database tags of the database administrator is limited, and the multi-rights of the database administrator are separated according to the database operation permission configuration.

[0016] Furthermore, in the aforementioned access control method of separation of rights, the basic elements in step 2 can be marked with multiple database tags, and each database tag can mark multiple basic elements.

[0017] In step 3, the basic elements represented by the database tags can be set in batches through the database access control policy.

[0018] Furthermore, in step 4 of the aforementioned access control method for separation of rights, the specific steps include:

[0019] Step 41: Receive the SQL command of the database subject through the database management system,

[0020] Step 42: Parse the SQL command through syntax analysis and semantics to obtain the database subject, database object and database operation permissions.

[0021] Step 43: Match the database subject, database object and database operation permissions of the SQL command with the access control policy in the database management system. If an access control policy created using a database tag is matched, the match is successful and the SQL command is allowed to continue to execute. Otherwise, the SQL command is prohibited from continuing to execute.

[0022] The present invention also provides a permission separation access control device, comprising an element management module, a marking module, an access control policy management module and an access control module.

[0023] The element management module creates basic elements in the database management system, wherein the basic elements include database subjects, database objects and database labels.

[0024] The marking module uses database tags to mark and classify database subjects, database objects and database operation permissions.

[0025] The access control policy management module creates and stores access control policies based on database subjects, database objects, and database operation permissions classified by tags. Each access control policy defines a database subject with a corresponding tag and allows operations with the corresponding tag to be performed on a database object with the corresponding tag.

[0026] When the database management system receives the SQL command from the database subject, the access control module obtains the database subject, database object and database operation permissions according to the SQL command, and matches them with the access control policy in the database management system. If the match is successful, the SQL command is allowed to continue to execute, otherwise the SQL command is prohibited from continuing to execute.

[0027] Furthermore, the database subject managed by the element management module of the privilege separation access control device refers to the users and their collections managed by the database management system, as well as the processes representing the users, and the database object refers to the database object operated by the database subject.

[0028] The tagging module uses database tags to tag users with the same or similar attributes, database operation permissions, and operation behaviors with the same tags.

[0029] Use database labels to label data objects with the same or similar data sensitivity with the same label,

[0030] Database tags are used to mark database operation permissions with the same or similar data processing methods for objects with the same tag.

[0031] Furthermore, the marking module of the privilege separation access control device uses database tags to mark and classify database subjects. When the database subject is a database administrator, the number of database tags of the database administrator is limited, and the database administrator's multiple rights are separated according to the database operation permission configuration.

[0032] Furthermore, the marking module of the access control device with separated permissions can mark the basic elements using multiple database tags, so that each database tag can mark multiple basic elements.

[0033] The access control policy management module can perform batch settings on the basic elements represented by database tags through database access control policies.

[0034] Furthermore, the access control module of the access control device with separate rights receives the SQL command of the database subject through the database management system.

[0035] Parse SQL commands through syntax analysis and semantics to obtain database subjects, database objects and database operation permissions.

[0036] The database subject, database object, and database operation permissions of the SQL command are matched with the access control policy in the database management system. If an access control policy created using a database tag is matched, the match is successful and the SQL command is allowed to continue executing. Otherwise, the SQL command is prohibited from continuing executing.

[0037] The benefits of the present invention are:

[0038] The method of the present invention, by labeling and classifying each participating element of database access control, then performing access control policy management based on the label, and performing access control based on the access control policy, can not only set the type of administrator according to needs, but also autonomously and flexibly assign permissions to each type of administrator, thereby realizing separation of permissions and duties, and improving security, flexibility and management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a schematic diagram of the application framework of the method of the present invention.

[0040] Figure 2 It is a schematic flow chart of the method of the present invention.

[0041] Figure 3 It is a schematic diagram of the access control process executed by the present invention. DETAILED DESCRIPTION

[0042] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0043] Example 1

[0044] The present invention provides a permission separation access control method, comprising:

[0045] Step 1: Create basic elements in a database management system, wherein the basic elements include a database subject, a database object, and a database label.

[0046] The database subject refers to the users and their collections managed by the database management system, as well as the various processes representing the users. The database object refers to the database objects operated by the database subject, which may include but are not limited to databases, files, schemas, tables, views, sequences, stored procedures, functions, etc.

[0047] Database operations mainly refer to operations on database objects, including management-related DCL operations, metadata management-related DDL operations, data record operations DML operations, system management-related commands, etc.

[0048] Database labels refer to the categories used to classify various entities in the database.

[0049] Step 2: Use database tags to mark and classify database subjects, database objects, and database operation permissions respectively.

[0050] Database tags are used to mark users with the same or similar attributes, database operation permissions, and operation behaviors as the same tags. Users with the same tags can be considered as the same group of users. The tags are marked as tags. j , j>0, the user can be represented as user i , i>0, user user i Tagged as tag j , represented by user i(j) .

[0051] Database tags are used to label data objects with the same or similar data sensitivity with the same tag. Database objects with the same tag can be considered as the same group of objects. The objects can be represented as obj k , k>0. Object obj k Tagged as tag j , represented by obj k(j) .

[0052] Database operation permissions with the same or similar data processing methods for objects are marked with the same label using database labels. Database operation permissions with the same label can be regarded as the same group of operations, and the operation can be represented as op. m , m>0, object op m Tagged as tag j , denoted as op m(j) .

[0053] Step 3: Create and store access control policies based on database subjects, database objects, and database operation permissions classified by tags.

[0054] Each access control policy defines a database subject with a corresponding label and allows operations with the corresponding label to be performed on the database object with the corresponding label. The access control policy can be expressed as policy(user i(i′) , obj k(k′) , op m(m′) ,>.

[0055] Step 4: When the database management system receives the SQL command from the database subject, it obtains the database subject, database object and operation according to the SQL command, and matches them with the access control policy in the database management system. If the match is successful, the SQL command is allowed to continue to execute, otherwise the SQL command is prohibited from continuing to execute.

[0056] The specific steps include:

[0057] Step 41: Receive the SQL command of the database subject through the database management system,

[0058] Step 42: Parse the SQL command through syntax analysis and semantics to obtain the combination of "user v object - operation", which can be expressed as union (user i″ , obj k″ , op m″ >,

[0059] Step 43: Combine the database subject, database object, and database operation permissions of the SQL command into UNIO <user i″ , obj k″ , op m″ >Match with the access control policy in the database management system. If a matching access control policy created with a database tag is found, the user user in the access control policy obtained by parsing the SQL command i″ The user tag that is the same as this policy i′ Marked, object obj k″ The object tag that is the same as this policy k , marked, database operation permission op m″ The same operation permission tag as this policy m′ Marked,

[0060] If the match is successful, the SQL command can be executed continuously; otherwise, the SQL command cannot be executed continuously.

[0061] Example 2

[0062] Based on Example 1, in step 2 of the method of the present invention, the basic elements can be marked using multiple database tags, and each database tag can mark multiple basic elements.

[0063] In step 3, the basic elements represented by the database tags can be set in batches through the database access control policy.

[0064] In step 2, the database subject can be categorized using database tags. When the database subject is a database administrator, the number of database tags for the database administrator is limited, and the multiple rights of the database administrator are separated according to the database operation permission configuration. That is, the permissions of various database administrators can also be managed through the access control policies created by the administrator user tag, object tag, and operation permission tag.

[0065] Through the above steps and methods, flexible management of database access control policies can be achieved, thereby realizing flexible database access control, realizing flexible configuration of separation of authority and separation of duties, improving access control policy management efficiency and reducing costs.

[0066] Example 3

[0067] The present invention also provides a permission separation access control device, comprising an element management module, a marking module, an access control policy management module and an access control module.

[0068] The element management module creates basic elements in the database management system, wherein the basic elements include database subjects, database objects and database labels.

[0069] The marking module uses database tags to mark and classify database subjects, database objects and database operation permissions.

[0070] The access control policy management module creates and stores access control policies based on database subjects, database objects, and database operation permissions classified by tags. Each access control policy defines a database subject with a corresponding tag and allows operations with the corresponding tag to be performed on a database object with the corresponding tag.

[0071] When the database management system receives the SQL command from the database subject, the access control module obtains the database subject, database object and database operation permissions according to the SQL command, and matches them with the access control policy in the database management system. If the match is successful, the SQL command is allowed to continue to execute, otherwise the SQL command is prohibited from continuing to execute.

[0072] As the contents of information interaction between modules in the above-mentioned device, execution of readable program process, etc. are based on the same concept as the embodiment of the method of the present invention, the specific contents can be found in the description of the embodiment of the method of the present invention, and will not be repeated here.

[0073] Similarly, the device of the present invention classifies the participating elements of database access control by labels, then manages the access control policy based on the labels, and performs access control based on the access control policy. It can not only set the type of administrator according to needs, but also independently and flexibly assign permissions to each type of administrator, thereby realizing separation of permissions and duties, and improving security, flexibility and management efficiency.

[0074] It should be noted that not all steps and modules in the above-mentioned processes and device structures are necessary, and some steps or modules can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or some components in multiple independent devices may be implemented together.

[0075] The above-described embodiments are only preferred embodiments for fully illustrating the present invention, and the protection scope of the present invention is not limited thereto. Equivalent substitutions or changes made by those skilled in the art based on the present invention are within the protection scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. A permission separation access control method, characterized in that include: Step 1: Create basic elements in the database management system, including database subject, database object and database label. Step 2: Use database tags to classify database subjects, database objects, and database operation permissions. Step 3: Create and store access control policies based on database subjects, database objects, and database operation permissions classified by tags. Each access control policy defines the database subjects with corresponding tags and the operations with corresponding tags allowed on the database objects with corresponding tags. Step 4: When the database management system receives the SQL command from the database subject, it obtains the database subject, database object and database operation permissions according to the SQL command, and matches them with the access control policy in the database management system. If the match is successful, the SQL command is allowed to continue to execute, otherwise the SQL command is prohibited from continuing to execute.

2. A method for access control based on separation of rights according to claim 1, characterized in that In step 1, the database subject refers to the users and their collections managed by the database management system, as well as the processes representing the users. The database object refers to the database object operated by the database subject. In step 2, database tags are used to mark users with the same or similar attributes, database operation permissions, and operation behaviors as the same tags. Use database labels to label data objects with the same or similar data sensitivity with the same label, Database tags are used to mark database operation permissions with the same or similar data processing methods for objects with the same tag.

3. A method for access control based on separation of rights according to claim 1, characterized in that In step 2, database tags are used to mark and classify database subjects. When the database subject is a database administrator, the number of database tags for the database administrator is limited, and the database administrator's multiple rights are separated according to the database operation permission configuration.

4. The access control method according to claim 1, characterized in that In step 2, the basic elements can be marked with multiple database tags, and each database tag can mark multiple basic elements. In step 3, the basic elements represented by the database tags can be set in batches through the database access control policy.

5. The access control method according to claim 1, characterized in that In step 4, the specific steps include: Step 41: Receive the SQL command of the database subject through the database management system, Step 42: Parse the SQL command through syntax analysis and semantics to obtain the database subject, database object and database operation permissions. Step 43: Match the database subject, database object and database operation permissions of the database subject SQL command with the access control policy in the database management system. If an access control policy created using a database tag is matched, the match is successful and the SQL command is allowed to continue executing. Otherwise, the SQL command is prohibited from continuing executing.

6. A permission separation access control device, characterized in that It includes element management module, tag module, access control policy management module and access control module. The element management module creates basic elements in the database management system, wherein the basic elements include database subjects, database objects and database labels. The marking module uses database tags to mark and classify database subjects, database objects and database operation permissions. The access control policy management module creates and stores access control policies based on database subjects, database objects, and database operation permissions classified by tags. Each access control policy defines a database subject with a corresponding tag and allows operations with the corresponding tag to be performed on a database object with the corresponding tag. When the database management system receives the SQL command from the database subject, the access control module obtains the database subject, database object and database operation permissions according to the SQL command, and matches them with the access control policy in the database management system. If the match is successful, the SQL command is allowed to continue to execute, otherwise the SQL command is prohibited from continuing to execute.

7. The access control device according to claim 6, characterized in that The database subject managed by the element management module refers to the users and their collections managed by the database management system, as well as the various processes representing the users. The database object refers to the database object operated by the database subject. The tagging module uses database tags to tag users with the same or similar attributes, database operation permissions, and operation behaviors with the same tags. Use database labels to label data objects with the same or similar data sensitivity with the same label, Database tags are used to mark database operation permissions with the same or similar data processing methods for objects with the same tag.

8. The access control device of claim 6, characterized in that The marking module uses database tags to mark and classify database subjects. When the database subject is a database administrator, the number of database tags for the database administrator is limited, and the database administrator's multiple rights are separated according to the database operation permission configuration.

9. The access control device of claim 6, characterized in that The marking module can use multiple database tags to mark basic elements, so that each database tag can mark multiple basic elements. The access control policy management module can perform batch settings on the basic elements represented by database tags through database access control policies.

10. The access control device of claim 6, characterized in that The access control module receives SQL commands from the database subject through the database management system. Parse SQL commands through syntax analysis and semantics to obtain database subjects, database objects and database operation permissions. The database subject, database object, and database operation permissions of the SQL command are matched with the access control policy in the database management system. If an access control policy created using a database tag is matched, the match is successful and the SQL command is allowed to continue executing. Otherwise, the SQL command is prohibited from continuing executing.

Images