Data calculation method, system and equipment based on authority control and storage medium

Abstract

The invention provides a data calculation method, system and device based on authority control and a storage medium. The method comprises the steps that the calculation intention of a user and a pre-generated secret key used for authority verification are obtained; if the key is not in the validity period, feeding back that the key is expired; otherwise, obtaining the user permission identifier analyzed from the secret key and the target scheduling type of the corresponding user; if the target scheduling type is inconsistent with the scheduling type required by the calculation intention, feeding back no scheduling authorization; otherwise, determining an accessible data table corresponding to the user permission identifier; if the accessible data table is inconsistent with the data table required by the calculation intention, feeding back no data table access authorization; otherwise, executing the calculation task. According to the method, the authority of multiple scheduling types can be managed and controlled at the same time, the compatibility is high, unauthorized data access can be effectively prevented through serial verification of the secret key, the scheduling type and the data table authority, it is ensured that the system can execute tasks according to the authority, and the safety of the system is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data calculation method, system, device and storage medium based on authority control. Background Art

[0002] The data computing system is a system specifically used for complex computing and analysis of big data. It can query the execution logic corresponding to various computing intentions from the computing task query table (identified by x_query table) according to the various computing intentions passed by the user (identified by xq_id), and then obtain data from multiple data sources such as MySQL, HDFS (Hadoop Distributed File System), and network API according to the execution logic, and use MySQL, Spark, custom Jar, Restful and other computing engines for resource management and data computing. This system can flexibly process and analyze large amounts of data and support different data processing requirements and scenarios.

[0003] With the development of information technology, people have higher and higher requirements for the security of data computing systems. The key to ensuring data security is to manage the permissions of users during data access. For example, economic users only have the permission to view some general data and calculate some economic growth trends, but do not have the permission to calculate population distribution or analyze user travel methods; administrators have all data calculation permissions.

[0004] Considering the decentralized nature of data storage, for example, some are stored in MySQL and some are stored in HDFS, the traditional permission control method is to create accounts for each user on different databases. This permission control method has the following problems: The form of creating accounts can only control computing engines with account functions, such as MySQL and Spark, and is not applicable to custom jar or restful computing engines. If an account is created for each user on MySQL and HDFS, "zombie accounts" are likely to appear, occupying system resources. In addition, since data is stored in different systems, it is necessary to implement complex operations such as integration or connection of accounts between these different systems.

[0005] It can be seen that the above-mentioned permission management method cannot effectively guarantee the data security and flexibility of access control during data access. Therefore, how to provide a secure and compatible data calculation method is a technical problem that needs to be solved. Summary of the invention

[0006] One of the purposes of the present invention is to provide a data computing method, system, device and storage medium based on permission control, which can effectively ensure data security and flexibility of access control during data access. The embodiments of the present invention can be implemented as follows:

[0007] In the first aspect, an embodiment of the present invention provides a data calculation method based on permission control, the method comprising: obtaining the user's computing intention and a pre-generated key for permission verification; if the key is not within the validity period, feedback that the key is expired; otherwise, obtaining the user permission identifier parsed from the key and the target scheduling type of the corresponding user; if the target scheduling type is inconsistent with the scheduling type required by the computing intention, feedback that there is no scheduling authorization; otherwise, determining the accessible data table corresponding to the user permission identifier; if the accessible data table is inconsistent with the data table required by the computing intention, feedback that there is no data table access authorization; otherwise, executing the computing task.

[0008] In the second aspect, an embodiment of the present invention provides a data computing system based on permission control, including: an acquisition module, used to obtain the user's computing intention and a pre-generated key for permission verification; a verification module, used to feedback that the key is expired if the key is not within the validity period; otherwise, the acquisition module is used to obtain the user permission identifier parsed from the key and the target scheduling type of the corresponding user; the verification module is also used to feedback that there is no scheduling authorization if the target scheduling type is inconsistent with the scheduling type required by the computing intention; otherwise, a determination module is used to determine the accessible data table corresponding to the user permission identifier; the verification module is also used to feedback that there is no data table access authorization if the accessible data table is inconsistent with the data table required by the computing intention; otherwise, a computing module is used to execute computing tasks.

[0009] In a third aspect, an embodiment of the present invention provides a data computing device based on permission control, comprising: a memory for storing a computer program; and a processor for executing the computer program to implement a data computing method based on permission control as described in the aforementioned embodiment.

[0010] In a fourth aspect, an embodiment of the present invention provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the data calculation method based on permission control as described in the above embodiment is implemented.

[0011] The data calculation method, system, device and storage medium based on permission control provided by the embodiment of the present invention have the following advantages: the calculation intention of the user is obtained first, so as to ensure that the system clearly understands the task that the user expects to perform. By verifying the validity of the key, the use of expired keys can be effectively prevented, thereby enhancing the security of the system. Once the key verification is passed, the system will further confirm whether the user has the permission to perform the required scheduling type, ensuring that the user can only call the scheduling operation authorized by the user. If the user is not authorized accordingly, the system will refuse to execute, thereby avoiding unauthorized data access. In addition, the system will continue to verify the user's access rights to specific data tables, ensuring that the user can only access and operate the data tables for which he has been authorized. If the user lacks access rights to the required data tables, the system will provide timely feedback to prevent data leakage or unauthorized access. For users with appropriate permissions, the system will smoothly execute the calculation task. The entire process can manage permissions of multiple scheduling types at the same time, without the need for users to obtain permissions by registering accounts in different systems, and has strong compatibility. Through the serial verification of keys, scheduling types and data table permissions, not only unauthorized resource access is effectively prevented, but also users are ensured to perform operations according to established permissions, thereby improving the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 is a schematic flow chart of a data calculation method based on authority control provided in an embodiment of the present invention;

[0014] Figure 2 A schematic flow chart of a key generation process provided by an embodiment of the present invention;

[0015] Figure 3 Another schematic diagram of a data calculation method based on authority control provided by an embodiment of the present invention;

[0016] Figure 4 A functional module diagram of a data computing system based on authority control provided by an embodiment of the present invention;

[0017] Figure 5 A structural block diagram of a data computing device based on authority control provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0019] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0021] In the description of the present invention, it should be noted that if the terms "upper", "lower", "inside", "outside", etc. appear, the orientation or position relationship indicated is based on the orientation or position relationship shown in the drawings, or is the orientation or position relationship in which the product of the invention is usually placed when used. It is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0022] In addition, the terms “first”, “second”, etc., if used, are merely used to distinguish between the descriptions and should not be understood as indicating or implying relative importance.

[0023] It should be noted that, in the absence of conflict, the features in the embodiments of the present invention may be combined with each other.

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0025] First, the computing task query table involved in the embodiment of the present invention is introduced, which is recorded as the x_query table. The x_query table can be pre-configured and maintained by a computer device. As shown in Table 1, the structure of the x_query table mainly includes: a primary key xq_id (used to identify the computing intent), a computing task description (description), and an execution logic (plan). The x_query table is a structure that can also be dynamically expanded to support users to submit more customized computing task configurations. Table 1 shows an example of an x_query table.

[0026] It should be noted that the ellipsis in each table in the embodiments of the present invention is only used for schematic representation and does not constitute any form of limitation on the contents of the table. The ellipsis is used here to indicate the additional information or fields that the table may contain, but does not imply that the table content is limited to the displayed part.

[0027] Table 1

[0028]

[0029]

[0030] In the embodiment of the present invention, the function format of the execution logic (plan) is unified as follows: $${return value}=function_name("Execute statement", param1, param2, ...), where "Execute statement" is the execution statement of the function, such as SQL; param1, param2 are parameters, which can be empty, and multiple parameters are separated by commas. For example, in Table 1, the plan is $${sync_data_6556}=sync_mysql("SELECT*...), "sync_data_6556" is the return value, "sync_mysql" is the function name, and "SELECT*..." is the execution statement of the function.

[0031] Based on Table 1, the upstream program user can pass the xq_id with the calculation intention of "find_time_granularity_cont..." to the data technology system. The system can query the x_query table shown in Table 1 to obtain that the plan corresponding to the xq_id is "$${sync_na_1271}=sync_mysql("SELECT*FR..."). Then the system executes this execution logic to complete the calculation task.

[0032] In order to simultaneously manage the access rights of different data storage systems, the embodiment of the present invention designs a user permission table (x_user_permission), which can flexibly and finely implement data table access rights management to meet different data access requirements. At the same time, in order to manage different computing engines, especially customized computing engines that may not have permissions and accounts, the embodiment of the present invention improves the above computing task query table, which can include the following steps:

[0033] Step 1: Obtain an original computing task query table; the original computing task query table has multiple computing intent identifiers and record information corresponding to the computing intent identifiers;

[0034] As shown in Table 1, the recorded information refers to the task description and execution logic corresponding to the computing intent identifier.

[0035] Step 2: In each record information, add the scheduling type set and data table set required by the computing intent corresponding to the computing intent identifier to obtain the computing task query table;

[0036] In the embodiment of the present invention, xq_type is used to mark the scheduling type required for each computing intent xq_id, and dependent_tables is used to mark the data table required for each computing intent xq_id. The improved computing task query table is shown in Table 2.

[0037] Table 2

[0038]

[0039] In Table 2, if a computing intent only uses one scheduling type, such as only one of the four types of MySQL, Spark, Jar, and Restful, you can directly fill in the name of the scheduling type in xq_type. If multiple scheduling types are used at the same time, the names of multiple scheduling types are concatenated with commas. There is no order requirement between multiple scheduling types. Similarly, if a computing intent only uses a certain data table, you can directly write the corresponding table name in dependent_tables. If multiple tables are used at the same time, the names of multiple tables are concatenated with commas. There is no order requirement between multiple table names.

[0040] Step 3: Determine the accessible data tables for each user, and establish a correspondence between each user's user authority identifier and the accessible data table, and construct a user authority table based on all the correspondences.

[0041] In the embodiment of the present invention, the data table to which each user has access rights is first determined, and then a corresponding relationship between the user authority identifier authId and the table name of the data table is established to obtain the user authority table.

[0042] In order to perform more detailed access control on data, for example, to control user access to specific data tables, when setting access permissions, you can also choose to use a blacklist or whitelist to simplify permission management based on the number of tables that the user can access. The specific implementation process is as follows:

[0043] Step 4: Create blacklist records and whitelist records;

[0044] Step 5: If the proportion of the accessible data tables corresponding to the user to all the data tables in the database is greater than the preset threshold, fill in the inaccessible data tables corresponding to the user in the blacklist record, and leave the whitelist record empty; otherwise, fill in the accessible data tables of the user in the whitelist record, and leave the blacklist record empty;

[0045] Step 6: If the user's accessible data is all data tables, fill in the preset identifier in the whitelist record and leave the blacklist record empty.

[0046] As shown in Table 3, Table 3 is a user permission table created by an embodiment of the present invention. In Table 3, authId is the user's permission identifier for the table. It is generated by concatenating whitelist and blacklist with a connector "|" and taking MD5. It is unique and is the primary key of the user permission table. The asterisk (*) is a wildcard, indicating that the user can access all tables in the data table without restriction. The number of authId entries is less than or equal to the number of users. If two users have the same permission to access the table, then anthId is only recorded once, and data will not be inserted repeatedly, which compresses the data volume and completely gets rid of the permission system that relies on user accounts.

[0047]

[0048] Blacklist is an exclusion strategy. If a user can access most tables, but only a few tables cannot be accessed, then the names of the tables that are not allowed to be accessed can be added to the blacklist. The table names are in dictionary order, and the whitelist records are empty (NULL). For example, if there are 100 tables in a database, users can access 98 of them, and only 2 tables are sensitive data tables that are not allowed to be accessed, then the names of these 2 tables can be filled in the blacklist.

[0049] Whitelist is a restriction strategy. If a user can only access a few tables in a database, and most tables should not be accessed, the names of the tables that are allowed to be accessed can be included in the whitelist. The table names are in dictionary order, and the blacklist records are empty (NULL). For example, if in a database containing 200 tables, a user is only authorized to access 5 of them, the names of these 5 tables can be filled in the whitelist.

[0050] Based on the improved computing task query table and user authority table, the embodiment of the present invention provides a data computing method based on authority control. Figure 1 , Figure 1 is a schematic flow chart of a data calculation method based on permission control provided by an embodiment of the present invention. The execution subject of the method may be a computer device with data calculation capability, and the computer device may be, but is not limited to, a personal computer, a server, etc. The method may include the following steps:

[0051] S101: Obtain the user's computing intention and a pre-generated key for authority verification.

[0052] In one embodiment of the present invention, computing intent refers to the purpose or need of a user to process and analyze data in a data computing system, such as statistics of different data tables, calculation of population distribution, analysis of user travel methods, etc. Computing intent includes but is not limited to operations on data such as query, analysis, and conversion.

[0053] Among them, xq_id can be used as an identifier of a computing intent. When using the data computing system service, the user needs to pass the xq_id of a computing intent in his own business scenario. After receiving the xq_id, the system will execute the logic corresponding to the xq_id from the x_query table.

[0054] In one embodiment of the present invention, the key is generated by the generation process provided by the embodiment of the present invention. When a user uses the data computing system service, the system can generate a key based on the scheduling type (or computing engine) to which the user has authority, the user authority identifier of the user in the database, and other information, which provides a query basis for subsequently determining whether the user has the authority to call a scheduling type required by a certain computing intent and whether the user has the authority to process the data table required by the computing intent.

[0055] In an optional implementation manner, the scheduling type in the embodiment of the present invention may include but is not limited to: MySQL, Spark, custom Jar, Restful, etc.

[0056] S102: If the key is not within the validity period, feedback is given that the key is expired; otherwise, the user authority identifier parsed from the key and the target scheduling type of the corresponding user are obtained.

[0057] In one embodiment of the present invention, if the key is not within the validity period, it means that the user's scheduling type authorization has expired. At this time, it can be determined that the permission is invalid, blocking the execution of the computing task and preventing potential data security accidents. If the key is within the validity period, it means that the authorization is valid, and it can be further determined whether the user has the permission for the scheduling type required for the computing intention.

[0058] From the above, it is known that the computing task query table pre-improved in the embodiment of the present invention and the user authority table are created. In order to quickly complete the verification later, it is also possible to first determine the scheduling type required for the computing intention from the computing task query table based on the computing intention obtained in step S101, and query the accessible data table to which the user has access rights in the user authority table based on the user authority identifier obtained in step S102.

[0059] S103. If the target scheduling type is inconsistent with the scheduling type required by the computing intent, feedback is given that there is no scheduling authorization; otherwise, the accessible data table corresponding to the user authority identifier is determined.

[0060] In one embodiment of the present invention, each computing intent requires at least one scheduling type and a data table in a database to ensure that computing tasks can be completed sequentially.

[0061] It is understandable that if the target scheduling type is inconsistent with the scheduling type required by a certain computing intent, it means that the user lacks authorization for the scheduling type required by the computing intent. For example, if the scheduling type required by a certain computing intent is MySQL, but the user only has permission for Spark, then the user does not have permission to schedule MySQL and cannot execute the execution logic corresponding to the computing intent.

[0062] In an optional implementation, in an actual scenario, considering that a complex computing intent may need to split the computing logic into multiple steps, and call different data sources to perform mixed scheduling calculations. Therefore, a computing intent may require one or more scheduling types.

[0063] In an embodiment of the present invention, after determining that a user has permission for a scheduling type required for a certain computing intent, it can be further confirmed whether the user has permission to access a data table required for the computing intent, thereby achieving the effect of strengthening permission management and control.

[0064] S104. If the accessible data table is inconsistent with the data table required by the calculation intention, feedback is given that there is no data table access authorization; otherwise, the calculation task is executed.

[0065] In one embodiment of the present invention, each calculation intention also needs to use a data table in the data table to ensure that the calculation tasks can be completed sequentially.

[0066] If the data that the user has permission to access is inconsistent with the data table required by a calculation intent, it means that the user lacks authorization for the data table required by the calculation intent. For example, the data table required by a calculation intent is the Sales_Data table, but the user only has permission to access the Customer_Information table. If the user does not have permission to access the Sales_Data table, the execution logic corresponding to the calculation intent cannot be executed.

[0067] In an optional implementation, a calculation intent may require one or more data tables.

[0068] In one embodiment of the present invention, in order to enhance data security, for the key in step S101, the embodiment of the present invention provides the following: Figure 2 The key generation method shown, Figure 2 The schematic flow chart of the key generation process provided by the embodiment of the present invention may include the following steps:

[0069] Step a1, generate a random floating point number and determine the difference in days between the expiration date of the key and a preset fixed date.

[0070] In one embodiment of the present invention, an existing random algorithm can be used to generate a random floating point number with a preset number of digits after the decimal point. The number of digits can be flexibly designed by the user, such as 7 digits or 8 digits, etc., which is not limited here. For example, in one embodiment, a random floating point number with 7 or 8 digits after the decimal point can be generated using Java's java.util.Random algorithm.

[0071] In one embodiment of the present invention, the user can flexibly determine the expiration date of the key, and then specify a fixed date, such as the epoch time (1970-01-01), and use these two dates to determine the validity period of the key, which provides a basis for subsequent verification of whether the permission authorization is valid.

[0072] Step a2: Use the first type of connector to sequentially connect the target scheduling type, the random number on the preset data bits after the decimal point of the random floating point number, and the user authority identifier to generate an array string.

[0073] Step a3, use the second type of connector to sequentially connect the array string, the random number on the remaining data bits after the decimal point of the random floating point number, and the difference in days to obtain the plain text information;

[0074] In one embodiment of the present invention, the user can select and define the first and second connectors by himself, and the specific type or form of the selected connector is not limited here. For example, in a possible implementation, the user can select the backslash "\" as the first connector and the vertical bar "|" as the second connector, so as to effectively distinguish the permission information and identity information related to the user from other types of verification information through the first connector and the second connector.

[0075] It should be understood that the terms "first type" and "second type" in the above text are only used to distinguish between two different types of connectors, and do not indicate any priority or hierarchy between them in terms of function or importance. This distinction is only to provide a clear reference in the description to help understand and implement different aspects of the present invention. In different embodiments, these two types of connectors can be interchanged or replaced by other symbols without departing from the scope of the embodiments of the present invention.

[0076] For target scheduling types, if there are multiple, they can be connected together using the first type of connector. For example, if the user has the permissions of MySQL, Spark, Jar, and Restful, then the backslash "\" can be used to connect them to get mysql\spark\jar\restful. There is no order requirement between multiple target scheduling types.

[0077] In an optional implementation, in order to facilitate the rapid decryption of the target scheduling type in the subsequent verification process, the embodiment of the present invention can also create a data to maintain and manage the target scheduling type. For example, a byte[] array can be created, and the target scheduling type can be inserted into the array. The array can also be used to insert the random number (denoted as random1) at different positions and the user authority identifier (denoted as authId) at the preset data positions before and after the decimal point of the above-mentioned random floating point number.

[0078] The number of random1 can be flexibly defined by the user. For example, if the generated random floating point number has 7 digits after the decimal point, the first 4 digits after the decimal point can be taken as random1, and the remaining 3 digits can be used as the subsequent random2. Therefore, random1 is inserted at the position marked with 1 in the byte[] array, and authId is inserted at the last position of the array. The target scheduling type, random1, and authId are connected by the first-class connector to obtain the array string str.

[0079] In order to enhance the security of the key, based on the array string str generated above, the random number (random2) and the day difference (represented as day) on the remaining data bits after the decimal point of the random floating point number are combined, and str, random2 and day are connected through the second-class connector vertical line “|”, and the final plaintext information is as follows: str|random2|day.

[0080] By using random numbers and dates to generate keys, the unpredictability and timeliness of the keys can be enhanced to prevent the keys from being cracked.

[0081] Step a4: Encrypt the plaintext information, and transcode the encrypted plaintext information to obtain a key.

[0082] In one embodiment of the present invention, the plaintext information generated in step 3 can be encrypted and transcoded to further enhance data security.

[0083] In an optional implementation, the plaintext information may be symmetrically encrypted. For example, in one implementation, the encryption algorithm is a general symmetric algorithm AES algorithm, in which case the encryption key and the random vector may be two different 16-bit strings, the encryption mode is CBC, the padding scheme is PKCS5Padding, and the encrypted plaintext information is then transcoded, such as but not limited to using BASE64 for transcoding, so that a second encryption is performed to form the final ciphertext, i.e., the key in the embodiment of the present invention.

[0084] It can be seen from the above-mentioned key generation process that the embodiment of the present invention adopts a more efficient and secure method compared to the traditional permission management method based on account creation. This method uniformly encrypts the scheduling type authorized by the user and embeds it into the key used for permission verification. In this way, many defects that may be caused by the traditional account creation method can be avoided. Through this encryption key management method, the present invention not only enhances the compatibility of the system, but also greatly facilitates the unified management and maintenance of user permissions. Users no longer need to create accounts in the system, but use keys to implement permission authorization and verification, which simplifies the permission management process and improves the flexibility and response speed of the system. In addition, the encrypted key also provides users with a higher level of data protection, ensuring the security and privacy of permission information.

[0085] In the implementation of the above steps a1 to a4, the embodiments of the present invention can not only enhance the unpredictability and timeliness of the key, but also prevent the key from being cracked, thereby enhancing data security.

[0086] Through the above key generation process, the key decryption process can also be clearly known, and the scheduling type, user authority identifier and key validity period of the user can be quickly read from the obtained key. Therefore, after step S201, the obtained key can be parsed through the following steps:

[0087] Step b1: transcode and decrypt the key to obtain plaintext information;

[0088] Step b2: Use the second type of connector to split the plain text information to obtain the data string, random number and day difference;

[0089] Step b3: Use the first type of connector to split the data string to obtain the user authority identifier and the target scheduling type.

[0090] In one embodiment of the present invention, the key is first transcoded, such as the base64 used for transcoding in the above step a4, then the base64 transcoding is also performed in step b1, and the decryption is performed using the same encryption method as step a4, such as AES / CBC / PKCS5Padding decryption, and the decrypted plaintext information can be obtained. Then the second type of connector is used to split first, and the three parts of information including the string str containing the scheduling type and identity, the random number random2, and the day number day can be obtained. For the string str, the first type of connector can be used to split, and the scheduling type with authority, the random number random1 and the user authority identifier authId will be obtained.

[0091] As can be seen from the above, the first split of the key can obtain the day difference related to the key, and the second split can obtain the target scheduling type and user authority identifier. Among them, the day difference can be used to determine whether the key is within the validity period. Therefore, the embodiment of the present invention also provides an implementation method for verifying whether the key is valid, that is, after step S101, the method can also include:

[0092] Step c1: Obtain the expiration date of the key according to the difference in days parsed from the key and a preset fixed date;

[0093] Step c2: If the current date is less than the expiration date, it is determined that the key is within the validity period; otherwise, it is determined that the key is not within the validity period.

[0094] It is understandable that if the expiration date is less than the current date, it means that the authorization has expired, and if the expiration date is greater than or equal to the current date, it means that the authorization has not expired and the key is valid.

[0095] It should be noted that, from the decryption process provided by the embodiment of the present invention, it can be seen that the first division first obtains the difference in days, and based on this information, it can be determined whether the key is valid. If it is determined that the key is invalid, in order to simplify the embodiment process, the second division can be omitted, and if it is valid, the second division can be repeated. Therefore, in one embodiment of the present invention, the above steps b2 and b3 can be executed in sequence, and then steps c1 to c2 can be executed, or, in another embodiment, after executing step b2, steps c1 to c2 can be executed. If it is determined that the key is valid, step b3 can be continued. If it is invalid, step b3 can be omitted, and the key expiration can be directly fed back.

[0096] Based on the above analysis, the data calculation method based on permission control provided by the embodiment of the present invention can first identify the user's calculation intention and ensure that the system clearly understands the task that the user expects to perform. By verifying the validity of the key, the use of expired keys can be effectively prevented, thereby enhancing the security of the system. Once the key verification is passed, the system will further confirm whether the user has the permission to execute the required scheduling type to ensure that the user can only call the scheduling operation authorized by him. If the user is not authorized accordingly, the system will refuse to execute it, thereby avoiding unauthorized data access. In addition, the system will continue to verify the user's access rights to specific data tables to ensure that the user can only access and operate the data tables for which he has been authorized. If the user lacks access rights to the required data table, the system will provide timely feedback to prevent data leakage or unauthorized access. For users with appropriate permissions, the system will smoothly execute the calculation task. The entire process can manage permissions of multiple scheduling types at the same time, and has strong compatibility. Through the serial verification of keys, scheduling types and data table permissions, not only unauthorized resource access is effectively prevented, but also users are ensured to perform operations according to established permissions, thereby improving the security of the system.

[0097] To understand the above-mentioned permission control process of the embodiment of the present invention as a whole, please refer to Figure 3 , Figure 3Another flowchart of a data computing method based on permission control provided by an embodiment of the present invention. In this diagram, it is assumed that the user permission identifier authId of a certain user is 6cdaa92df59a852dcb54b66d787f21f2, the scheduling types with permissions are mysql, spark and jar, the expiration date of the key is December 31, 2033; the fixed date is January 1, 1970; the key example is: bPpEL6HggjiBaxmuI2oEcbGqVzQiRrUAVKicglizTPiHDrf6i1WQ02FJ2OMdD6EVQqfwVc kpyGURKgtLT1Lvx68aaaFmaVgFHLwieBc8zvg, after the upstream program receives the computing intent Id transmitted by the user, it generates the key shown in the example, and can package the key and the computing intent identifier into Json and send it to the system. The system can proceed as follows:

[0098] Step s1: Receive the computing intention ID and key sent by the upstream program;

[0099] Step s2: Transcode and decrypt the key to obtain the plaintext information: mysql\0.7123\spark\jar\6cdaa92df59a852dcb54b66d787f21f2|543|23375;

[0100] Step s3: Use the first-class connector “\” and the second-class connector “|” to split the plain text information, and obtain the scheduling type array: [mysql, spark, jar]; authId: 6cdaa92df59a852dcb54b66d787f21f2; day difference: 233375;

[0101] Step s4: Determine the end date as December 31, 2033 based on the fixed log date January 1, 1970 and the day difference 233375;

[0102] Step s5: judging whether the key is within the validity period according to the expiration date and the current date;

[0103] If yes, execute step s6; otherwise, execute step s9;

[0104] Step s6: query the xq_type segment corresponding to the calculation intention ID in the x_quary table according to the scheduling type array [mysql, spark, jar] to determine whether the user has the authority to schedule the type corresponding to the calculation intention ID;

[0105] If yes, execute step s7; otherwise, execute step s10;

[0106] Step s7: query the accessible data table corresponding to when authId is 6cdaa92df59a852dcb54b66d787f21f2 in x_user_permission to determine whether the user has the access permission to the data table corresponding to the calculation intention Id;

[0107] If yes, execute step s8; otherwise, execute step s11;

[0108] Step s8: Execute the scheduling program and start the computing task;

[0109] Step s9: Return the key expiration to the upstream program;

[0110] Step s10: returning the scheduling authorization without the scheduling type corresponding to the calculation intention Id to the upstream program;

[0111] Step s11: Return the access rights of the data table that does not correspond to the calculation intention Id to the upstream program.

[0112] Through the above data calculation method based on authority control, the embodiment of the present invention can effectively ensure the security of data and the legitimacy of access. The method can be applied to environments that require high data security and refined authority control, such as finance, medical care and service departments.

[0113] Based on Figure 1 With the same inventive concept, the embodiment of the present invention also provides a data computing system based on authority control. Figure 4 , Figure 4 Functional module diagram of a data computing system based on authority control provided by an embodiment of the present invention. The data computing system based on authority control 40 may include:

[0114] An acquisition module 410 is used to obtain the user's computing intention and a pre-generated key for authority verification;

[0115] The verification module 420 is used to feedback that the key is expired if the key is not within the validity period; otherwise, the acquisition module 410 is used to obtain the user authority identifier parsed from the key and the target scheduling type of the corresponding user;

[0116] The verification module 420 is also used to feedback that there is no scheduling authorization if the target scheduling type is inconsistent with the scheduling type required by the computing intention; otherwise, the determination module 430 is used to determine the accessible data table corresponding to the user authority identifier;

[0117] The verification module 420 is also used to feedback that there is no data table access authorization if the accessible data table is inconsistent with the data table required by the calculation intention; otherwise, the calculation module 440 is used to execute the calculation task.

[0118] It is understandable that the acquisition module 410, the verification module 420, the determination module 430 and the calculation module 440 can be executed in coordination. Figure 1 Each step in the process is performed to achieve the corresponding technical effect.

[0119] In an optional embodiment, the data computing system 40 based on authority control may further include a generation module, which is used to: generate a random floating point number and determine the difference in days between the expiration date of the key and a preset fixed date; use a first type of connector to sequentially connect the target scheduling type, the random number on the preset data bits after the decimal point of the random floating point number, and the user authority identifier to generate an array string; use a second type of connector to sequentially connect the array string, the random number on the remaining data bits after the decimal point of the random floating point number, and the difference in days to obtain plaintext information; encrypt the plaintext information, and transcode the encrypted plaintext information to obtain the key.

[0120] In an optional implementation, the data computing system 40 based on authority control may further include a parsing module, which is used to: transcode and decrypt the key to obtain plaintext information; segment the plaintext information using the second type of connector to obtain a data string, a random number, and a day difference; segment the data string using the first type of connector to obtain a user authority identifier and a target scheduling type.

[0121] In an optional embodiment, the verification module 420 is also used to obtain the expiration date of the key based on the difference in days parsed from the key and a preset fixed date; if the current date is less than the expiration date, it is determined that the key is within the validity period, otherwise it is determined that the key is not within the validity period.

[0122] In an optional embodiment, the data computing system 40 based on permission control may also include a creation module for obtaining an original computing task query table; the original computing task query table has multiple computing intent identifiers and record information corresponding to the computing intent identifiers; in each record information, the scheduling type set and data table set required by the computing intent corresponding to the computing intent identifier are added to obtain a computing task query table; the accessible data tables of each user are determined, and a corresponding relationship between each user's user permission identifier and the accessible data table is established, and a user permission table is constructed based on all corresponding relationships.

[0123] In an optional implementation, the creation module is also used to create blacklist records and whitelist records in the user authority table; if the proportion of the user's corresponding accessible data tables to all data tables in the database is greater than a preset threshold, the user's corresponding inaccessible data tables are filled in the blacklist record, and the whitelist record is empty; otherwise, the user's accessible data tables are filled in the whitelist record, and the blacklist record is empty; if the user's accessible data is all data tables, a preset identifier is filled in the whitelist record, and the blacklist record is empty.

[0124] In an optional embodiment, the determination module 430 is also used to query the scheduling type and data table corresponding to the computing intent identifier from the computing task query table according to the computing intent identifier corresponding to the computing intent; and query the accessible target data table corresponding to the user authority identifier from the user authority table according to the user authority identifier.

[0125] It should be noted that the division of modules in the above embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0126] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for an electronic device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0127] The present application also provides a data computing device based on authority control. Figure 5 , Figure 5 The structural block diagram of the data computing device based on the permission control provided by the embodiment of the present invention, the computer device 500 includes: a memory 501, a processor 502, and a communication interface 503. The memory 501, the processor 502 and the communication interface 503 are electrically connected to each other directly or indirectly to realize the transmission or interaction of data. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.

[0128] Optionally, bus 504 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0129] In the embodiment of the present application, the processor 502 may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor. The software module may be located in the memory 501, and the processor 502 reads the program instructions in the memory 501, and completes the steps of the above method in combination with its hardware.

[0130] In the embodiment of the present application, the memory 501 may be a non-volatile memory, such as a hard disk (HDD) or a solid-state drive (SSD), etc., or a volatile memory (VolatileMemory), such as RAM. The memory may also be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in the embodiment of the present application may also be a circuit or any other device that can implement a storage function, for storing instructions and / or data.

[0131] The memory 501 can be used to store software programs and modules, such as the instructions / modules of the data computing system 40 based on permission control provided in the embodiment of the present invention, which can be stored in the memory 501 in the form of software or firmware (Firmware) or in the operating system (OS) of the fixed computer device 500. The processor 502 executes various functional applications and data processing by executing the software programs and modules stored in the memory 501. The communication interface 503 can be used for signaling or data communication with other node devices.

[0132] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0133] Understandably, Figure 5 The structure shown is for illustration only. The data computing device 50 based on authority control may also include Figure 5 More or fewer components as shown, or with Figure 5 Different configurations are shown. Figure 5 The components shown may be implemented in hardware, software or a combination thereof.

[0134] The data computing device 50 based on authority control may also include network devices and / or user devices. The network devices include, but are not limited to, a single network server, a server group consisting of multiple network servers, or a cloud consisting of a large number of hosts or network servers based on cloud computing.

[0135] Based on the above embodiments, the present application also provides a storage medium, in which a computer program is stored. When the computer program is executed by a computer, the computer executes the data calculation method based on permission control provided in the above embodiments.

[0136] Based on the above embodiments, the embodiments of the present application further provide a computer program, which, when executed on a computer, enables the computer to execute the data calculation method based on permission control provided in the above embodiments.

[0137] Based on the above embodiments, the embodiments of the present application further provide a chip, which is used to read a computer program stored in a memory and to execute the data calculation method based on permission control provided in the above embodiments.

[0138] A computer program product is also provided in an embodiment of the present application, including instructions, which, when executed on a computer, enable the computer to execute the data calculation method based on permission control provided in the above embodiment.

[0139] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by instructions. These instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0140] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0141] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0142] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A data calculation method based on authority control, characterized in that: The method comprises: Obtain the user's computing intent and pre-generated keys for permission verification; If the key is not within the validity period, the key expiration is fed back; otherwise, the user authority identifier parsed from the key and the target scheduling type of the corresponding user are obtained; If the target scheduling type is inconsistent with the scheduling type required by the computing intention, feedback is given that no scheduling authorization is given; otherwise, the accessible data table corresponding to the user authority identifier is determined; If the accessible data table is inconsistent with the data table required by the computing intention, feedback is given that there is no data table access authorization; otherwise, the computing task is executed.

2. The data calculation method based on authority control according to claim 1 is characterized in that: The method for generating a key for authority verification includes: Generate a random floating point number and determine the difference in number of days between the expiration date of the key and a preset fixed date; Use the first type of connector to sequentially connect the target scheduling type, the random number at the preset number of data bits after the decimal point of the random floating point number, and the user authority identifier to generate an array string; Use the second type of connector to sequentially connect the array string, the random number on the remaining data bits after the decimal point of the random floating point number, and the day difference to obtain plain text information; The plaintext information is encrypted, and the encrypted plaintext information is transcoded to obtain the key.

3. The data calculation method based on authority control according to claim 2 is characterized in that: After obtaining the user's computing intention and the pre-generated key for authority verification, the method further includes: Transcoding and decrypting the key to obtain the plaintext information; Using the second type of connector to split the plain text information, obtaining a data string, a random number and a day difference; The data string is segmented using the first type of connector to obtain the user authority identifier and the target scheduling type.

4. The data calculation method based on authority control according to any one of claims 1 to 3, characterized in that: After obtaining the user's computing intention and the pre-generated key for authority verification, the method further includes: Obtaining the expiration date of the key according to the difference in days parsed from the key and a preset fixed date; If the current date is less than the expiration date, it is determined that the key is within the validity period; otherwise, it is determined that the key is not within the validity period.

5. The data calculation method based on authority control according to any one of claims 1 to 3, characterized in that: Before obtaining the user's computing intention and the pre-generated key for authority verification, the method further includes: Obtain an original computing task query table; the original computing task query table has multiple computing intent identifiers and record information corresponding to the computing intent identifiers; In each of the record information, a scheduling type set and a data table set required by the computing intent corresponding to the computing intent identifier are added to obtain a computing task query table; The accessible data table of each user is determined, and a corresponding relationship between the user authority identifier of each user and the accessible data table is established, and a user authority table is constructed based on all the corresponding relationships.

6. The data calculation method based on authority control according to claim 5 is characterized in that: The method further comprises: In the user authority table, create a blacklist record and a whitelist record; If the proportion of the accessible data tables corresponding to the user to all the data tables in the database is greater than a preset threshold, the inaccessible data tables corresponding to the user are filled in the blacklist record, and the whitelist record is empty; otherwise, the accessible data tables of the user are filled in the whitelist record, and the blacklist record is empty; If the user's accessible data is all of the data tables, a preset identifier is filled in the whitelist record, and the blacklist record is left empty.

7. The data calculation method based on authority control according to claim 1 is characterized in that: After obtaining the user authority identifier parsed from the key and the target scheduling type of the corresponding user, the method further includes: According to the computing intent identifier corresponding to the computing intent, query the scheduling type and data table corresponding to the computing intent identifier from a pre-generated computing task query table; According to the user authority identifier, an accessible target data table corresponding to the user authority identifier is queried from a pre-built user authority table.

8. A data computing system based on authority control, characterized in that: include: An acquisition module is used to obtain the user's computing intention and the pre-generated key for permission verification; The verification module is used to feedback that the key is expired if the key is not within the validity period; otherwise, the acquisition module is used to acquire the user authority identifier parsed from the key and the target scheduling type of the corresponding user; The verification module is further configured to feedback that no scheduling authorization is provided if the target scheduling type is inconsistent with the scheduling type required by the computing intention; otherwise, the determination module is configured to determine the accessible data table corresponding to the user authority identifier; The verification module is further used to feedback that there is no data table access authorization if the accessible data table is inconsistent with the data table required by the calculation intention; otherwise, the calculation module is used to execute the calculation task.

9. A data computing device based on authority control, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the data calculation method based on authority control as described in any one of claims 1 to 7.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data calculation method based on authority control as described in any one of claims 1 to 7 is implemented.

Images