File access method and device, equipment, storage medium and program product
By pre-setting and using user ID-related file name rules and rules on the server side, large-scale file data access bottlenecks and data leakage problems in the database are solved, and data file access and data confidentiality corresponding to user rights are achieved.
Patent Information
- Application Number
- CN202411288564.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-13
- Publication Date
- 2024-12-27
AI Technical Summary
When accessing a large amount of file data stored in the database, the relational database cannot effectively record the data storage location of user permissions due to access bottleneck problems, resulting in the inability to accurately return the file data corresponding to user permissions, and there are problems with data leakage and access bottlenecks.
By presetting the file name rules, rule execution policies, field rules and line rules corresponding to the user ID on the server side, obtaining target field rules and target line rules based on user permissions, processing original data files to obtain authorized data files, and reducing invalid data transmission And improve data confidentiality.
It realizes refined control of data access based on user rights, reduces invalid data transmission, improves data confidentiality and access efficiency, and avoids data leakage.
Smart Images
Figure CN119203228A_ABST
Abstract
Description
Technical Field
[0001] The present application belongs to the technical field of data permission control, and in particular, relates to a method, device, equipment, storage medium and program product for file access. Background Art
[0002] When accessing file data stored in a database, due to different user permissions, the database needs to return the file data corresponding to the user's permissions to the user. However, when the amount of file data stored in the database is large, the relational database table will have an access bottleneck, making it infeasible to obtain file data through the relational database.
[0003] If only the storage location of relevant data in the data file is recorded in the relational database, when the number of data files is huge and the data itself is highly complex, it is impossible to effectively record the storage location of the data that the user has permission to store in the file, resulting in the inability to return the file data with corresponding permissions to the user. Summary of the invention
[0004] The present invention provides a method, device, equipment, storage medium and program product for file access. The server can obtain file data corresponding to user data permissions based on rule execution strategy, field rules and row rules, thereby improving data confidentiality and reducing invalid data transmission.
[0005] In a first aspect, an embodiment of the present application provides a method for accessing a file, comprising:
[0006] Obtaining a file access request sent by a terminal, wherein the file access request includes a user identifier;
[0007] Searching locally for a first file name rule corresponding to the user identifier according to the user identifier, wherein the first file name rule includes a target rule execution strategy;
[0008] The target field rule and the target row rule are acquired according to the target rule execution strategy; the target field rule and the target row rule are preset based on the authority corresponding to the user identifier.
[0009] The original data file is processed according to the target field rule and the target row rule to obtain the authorized data file.
[0010] In a possible implementation, the file access request includes a file name; and searching locally for a first file name rule corresponding to the user identifier according to the user identifier includes:
[0011] The file name rule is searched in a preset intermediate table according to the user identifier to obtain a first file name rule, wherein the preset intermediate table records the correspondence between the user identifier and the file name rule.
[0012] In a possible implementation, searching for a file name rule in a preset intermediate table according to the user identifier to obtain a first name rule includes:
[0013] Searching the preset intermediate table for a file name rule according to the user identifier to obtain at least one second file name rule;
[0014] The file name is matched with a file name rule in the at least one second file name rule to obtain the first file name rule.
[0015] In a possible implementation, after searching the intermediate table for a file name rule according to the user identifier, the method further includes:
[0016] When no file name rule is found, a first abnormal response message is returned to the terminal.
[0017] In a possible implementation, the file name rule includes a rule level; the matching of the file name with a file name rule in the at least one second file name rule to obtain the first file name rule includes:
[0018] Matching the file name with a file name rule in the at least one file name rule to obtain at least one third file name rule;
[0019] Determining, according to the rule levels in the third file name rules, a third file name rule with the highest rule level among the at least one third file name rule;
[0020] The third file name rule with the highest rule level is used as the first file name rule.
[0021] In a possible implementation, acquiring a target field rule and a target row rule according to the target rule execution strategy includes:
[0022] The target field rule and the target row rule are obtained in a preset association relationship according to the target rule execution strategy, and the preset association relationship is used to represent the correspondence between the file name rule, the field rule, and the row rule.
[0023] In a possible implementation manner, after matching the file name with a file name rule in the at least one file name rule, the method further includes:
[0024] When the file name does not match any file name rule, a second abnormal response message is returned to the terminal.
[0025] In a second aspect, an embodiment of the present application provides a device for accessing a file, including:
[0026] An acquisition module, used for acquiring a file access request sent by a terminal, wherein the file access request includes a user identifier;
[0027] A search module, configured to search locally for a first file name rule corresponding to the user identifier according to the user identifier, wherein the first file name rule includes a target rule execution strategy;
[0028] The acquisition module is further used to acquire the target field rule and the target row rule according to the target rule execution strategy; the target field rule and the target row rule are preset based on the authority corresponding to the user identifier.
[0029] The acquisition module is further used to process the original data file according to the target field rule and the target row rule to acquire the authorized data file.
[0030] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising: a processor and a memory storing computer program instructions;
[0031] When the processor executes the computer program instructions, the method for file access as described in any one of the first aspects is implemented.
[0032] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the file access method as described in any one of the first aspects is implemented.
[0033] In a fifth aspect, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the file access method as described in any one of the first aspects.
[0034] The file access method, apparatus, device, storage medium and program product of the embodiments of the present application can, upon receiving a file access request sent by a terminal, search the corresponding first file name rule locally according to the user identifier carried in the file access request, wherein the first file name rule includes a target rule execution policy, and then obtain the corresponding target field rule and target row rule according to the target rule execution policy. Finally, the original data file is processed according to the target field rule and the target row rule to obtain the authorized data file. Among them, the target field rule and the target row rule are pre-set based on the authority corresponding to the user identifier, that is, the data file corresponding to the user authority can be obtained according to the target field rule and the target row rule. In this way, the file name rule, rule execution policy, field rule and target row rule corresponding to the user identifier are pre-stored locally, and the server can obtain the data file corresponding to the user data authority based on the rule execution policy, field rule and row rule, thereby improving data confidentiality and reducing the amount of invalid data transmission. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.
[0036] Figure 1 It is a flowchart of a method for file access provided in the prior art;
[0037] Figure 2 It is a flowchart of another method for providing file access in the prior art;
[0038] Figure 3 It is a flowchart of a method for accessing a file provided in an embodiment of the present application;
[0039] Figure 4 It is a flowchart of a method for obtaining target row rules and target field rules provided in an embodiment of the present application;
[0040] Figure 5 is an exemplary schematic diagram of a data file processing method provided in an embodiment of the present application;
[0041] Figure 6 is an exemplary schematic diagram of a method for obtaining a target row rule and a target field rule provided in an embodiment of the present application;
[0042] Figure 7 It is a structural diagram of a file access system provided by an embodiment of the present application;
[0043] Figure 8is an exemplary schematic diagram of a file access method provided in an embodiment of the present application;
[0044] Fig. 9 This is a schematic diagram of a file access device provided in an embodiment of the present application.
[0045] Fig.10 It is a structural schematic diagram of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION
[0046] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.
[0047] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.
[0048] As the amount of file data stored in the file server increases, since different users have different permissions, the file server returns different file data to different users based on their permissions. Figure 1 As shown, the file server verifies the legitimacy of the token in the file download request, and if the token is legitimate, it further determines whether the user has the access rights to the current file based on the user information. Specifically, the method includes:
[0049] S101. The client sends a file download request to a file service module.
[0050] The file download request includes a token and file information requested for access, and the file information may be a file name.
[0051] S102: The file service module sends a token validity verification request to the authentication service module.
[0052] For example, the validity check may be to determine whether the token is expired, and if the validity check fails, the file service module returns a token illegal response to the client. If the validity check passes, S103 is executed.
[0053] S103: The authentication service module returns user information to the file service module.
[0054] The user information includes a user ID.
[0055] S104: The file service module sends file information and user information to the authority service module.
[0056] S105: The authority service module determines whether the user has the authority to download the requested file based on the user information and the file information.
[0057] S106: When there is no permission, the permission service module returns a response indicating that there is no permission to download to the file service module.
[0058] S107: When there is no permission, the file service module returns a response indicating that there is no permission to download to the client.
[0059] S108. When permission is granted, the permission service module returns a download permission response to the file service module.
[0060] S109: The file service module requests the file from the file storage module.
[0061] S110. The file storage module returns the file to the file service module.
[0062] S110: The file service module returns the file to the client.
[0063] The files returned by the file storage module include all data files corresponding to the file names.
[0064] For example, the file download request initiated by user A is used to download the 0-domain data corresponding to region A. The file returned by the file storage module includes the 0-domain data corresponding to all regions. Specifically, the file name can be 0-domain data, and the 0-domain data includes asset management data and performance data.
[0065] In this way, after the file service module receives the file download request, it verifies the legitimacy of the token through the authentication service module. If the verification is successful, it determines the user's authority through the authority service module, and returns the file to the client according to the user's authority. The purpose of controlling user authority is achieved.
[0066] However, in Figure 1 In the method shown in the embodiment, only the access rights to the data file are controlled. In a specific scenario, if the current user has the permission to access the data file, since the data file may store sensitive data, the current user can access the sensitive data, resulting in data leakage. Figure 2 The method shown in the figure controls the user's access rights by processing the data file. Figure 2 As shown, the method includes:
[0067] S201. Receive a read instruction for file data, and obtain metadata corresponding to the file data, where the metadata is used to mark a storage location and access policy of sensitive data in the data file.
[0068] S202: Search for an access policy corresponding to the user according to the obtained metadata, where the access policy is generated according to the user's access rights to the sensitive data.
[0069] S203: Control the user's access to the data file according to the access policy.
[0070] In this way, by presetting the storage location of sensitive data, the storage location of each sensitive data can be generated, and then by executing the preset access policy, the acquisition of sensitive data can be avoided, thereby realizing the user's access control to sensitive data. However, when the amount of file data is large and the data itself is highly complex, access bottlenecks will occur, and the storage location of sensitive data in the file cannot be effectively set.
[0071] In order to solve the problems existing in the prior art, the embodiments of the present application provide a method, apparatus, device, storage medium and program product for file access. The method uses a server, such as Figure 3 As shown, the method of accessing the file specifically includes:
[0072] S301: Obtain a file access request sent by a terminal.
[0073] The file access request includes a user identifier.
[0074] S302: Search locally for a first file name rule corresponding to the user identifier according to the user identifier.
[0075] The first file name rule includes a target rule execution strategy. The target rule execution strategy refers to a processing strategy when the original data file is processed, which is preset based on experience. The rule execution strategy is preset based on different application scenarios and application requirements.
[0076] The server locally stores a preset correspondence between the user identifier and the file name rule. By searching the file name rule corresponding to the user identifier, the rule execution policy included in the file name rule is obtained, and the obtained rule execution policy is used as the target rule execution policy.
[0077] S303: Obtain target field rules and target row rules according to the target rule execution strategy.
[0078] The field rule refers to the processing rule for the fields included in the original data file, and the row rule refers to the processing rule for the row data of the original data file.
[0079] The target field rules and target row rules are preset based on the permissions of the user corresponding to the user ID. According to the permissions of different users, the preset row rules and field rules can be used to selectively obtain the original data file, thereby realizing the control of the permissions of different users.
[0080] The target rule execution strategy is used to determine the execution order of the rules. According to the permissions of different users, the selective acquisition of original data files can be achieved through preset rules and rule execution strategies, so as to provide different file data for different users, thereby realizing the permission control of users.
[0081] S304: Process the original data file according to the target field rule and the target row rule to obtain the authorized data file.
[0082] The original data file is a data file stored in the file server.
[0083] By adopting the above method, when a file access request sent by a terminal is received, the corresponding first file name rule can be searched locally according to the user identifier carried in the file access request, wherein the first file name rule includes a target rule execution policy, and then the corresponding target field rule and target row rule are obtained according to the target rule execution policy. Finally, the original data file is processed according to the target field rule and the target row rule to obtain the data file. Among them, the target field rule and the target row rule are pre-set based on the authority corresponding to the user identifier, that is, the data file corresponding to the user authority can be obtained according to the target field rule and the target row rule. In this way, the file name rule, rule execution policy, field rule and target row rule corresponding to the user identifier are pre-stored locally, and the server can obtain the data file corresponding to the user data authority based on the rule execution policy, field rule and row rule, thereby improving data confidentiality and reducing the amount of invalid data transmission.
[0084] It should be noted that, with respect to the above S302, searching the first file name rule corresponding to the user identifier locally according to the user identifier can be specifically implemented as follows:
[0085] The file name rule is searched in a preset intermediate table according to the user identifier to obtain a first file name rule.
[0086] The preset intermediate table records the correspondence between the user identifier and the identifier of the file name rule.
[0087] The user ID can be a user identity (ID) or a role ID, where the user ID is used to identify different individual users and the role ID is used to identify different roles. For example, the role ID corresponding to user A is 1; the role ID corresponding to user B is 2; the role ID corresponding to user C is 3; if users A, B and C belong to the same role in the company, then the role ID corresponding to users A, B and C is 4.
[0088] In addition, when no file name rule is found, the server returns a first abnormal response message to the terminal.
[0089] By adopting the method provided in the embodiment of the present application, after obtaining the file access request, the corresponding first file name rule can be searched in the preset intermediate mark according to the user identifier in the file access request. Among them, the target rule execution policy corresponding to the user identifier can be determined by the first file name rule. In this way, by presetting the corresponding relationship between the user identifier and the file name rule, the search efficiency and accuracy of the target rule execution policy can be improved.
[0090] In the above process of searching for file name rules through the preset intermediate table, multiple file name rules corresponding to the user identifier can be found through the user identifier. Based on this, on the basis of the multiple file name rules found, the multiple file name rules are further screened using the file name included in the above file access request to obtain the first file name rule. Specifically, searching for the file name rule in the preset intermediate table according to the user identifier in the above step 1 can be implemented as follows:
[0091] The file name rule is searched in the preset intermediate table according to the user identifier to obtain at least one second file name rule; the file name is matched with the file name rule in the at least one second file name rule to obtain the first file name rule.
[0092] The file name rule can be a regular expression or a custom rule. For example, the file name rule can be ^(beijing2024).*(\.csv)$, which is used to match comma-separated values (CSV) files whose names start with beijing2024 and end with .csv.
[0093] In addition, when the file name does not match any file name rule, the server returns a second abnormal response message to the terminal.
[0094] By using the method provided in the embodiment of the present application, on the basis of finding at least one second file name rule using the user identifier, each second file name rule is used to match the file name in the above file access request, thereby obtaining the first file name rule. In this way, on the basis of finding at least one second file name rule using the user identifier, the found file name rule is further screened using the file name, thereby improving the accuracy of the screened first file name rule.
[0095] When the file name is used for matching, at least one file name rule can be matched. Furthermore, the rule level in the file name rule can be used to filter the matched at least one file name rule to obtain the first file name rule. Specifically, the file name and the file name rule in at least one second file name rule are matched to obtain the first file name rule, which can be implemented as follows:
[0096] Step A: Match the file name with at least one file name rule to obtain at least one third file name rule.
[0097] It can be understood that a file name can match multiple file name rules, and therefore, at least one third file name rule can be matched.
[0098] Step B: determining a third file name rule with the highest rule level in at least one third file name rule according to the rule levels in the third file name rules.
[0099] The rule level is determined in advance based on the actual needs of the user. The higher the rule level, the higher the priority of the rule execution policy in the file name rule.
[0100] Step C: taking the third file name rule with the highest rule level as the first file name rule.
[0101] Using the method provided in the embodiment of the present application, after matching the file name with at least one file name rule to obtain at least one third file name rule, the third file name rule with the highest rule level is determined as the first file name rule by the rule level in the third file name rule. The rule level is determined in advance based on the actual needs of the user. The higher the rule level, the higher the priority of the rule execution policy in the file name rule. On this basis, the first file name rule determined by the rule level is more in line with the actual business needs of the user.
[0102] On the basis of the server obtaining the first file name rule, the first file name rule is further used to obtain the target field rule and the target row rule. Specifically, Figure 4 As shown, the above S303, obtaining the target field rule and the target row rule according to the target rule execution strategy, can be implemented as follows:
[0103] S3031. Obtain target field rules and target row rules in a preset association relationship according to the target rule execution strategy.
[0104] The preset association relationship is used to represent the correspondence between the file name rule, the field rule, and the row rule. The row rule and the field rule are preset based on experience.
[0105] Specifically, the row rule and field rule also include an associated file name rule id. The server obtains the row rule and field rule that have a preset association relationship with the first file name rule by searching for the associated file name rule id in the file row rule and the file field rule.
[0106] In another implementation, a row rule and a field rule having a preset association relationship with the first file name rule are obtained, and then a target field rule and a target row rule are obtained from the row rule and the field rule according to a target rule execution strategy.
[0107] After the row rules and field rules are obtained, the server determines the corresponding target row rules and target field rules, as well as the execution order of the target row rules and target field rules, from the extracted row rules and field rules according to the target rule execution strategy.
[0108] Specifically, after the server receives the file access request sent by the terminal, the server uses the user identifier in the file access request to obtain the target row rule and the target field rule process, such as Figure 5 As shown, the method includes:
[0109] S501. Obtain all file name rules of the current user through the user identifier.
[0110] The server obtains the user identification in the file access request sent by the terminal, and uses a preset intermediate table to search for a file name rule corresponding to the user identification.
[0111] S502: Whether at least one file name rule is obtained.
[0112] If yes, execute S503, if no, end the process.
[0113] S503: Whether the current file name rule is matched.
[0114] If one file name rule is matched, S505 is executed; if multiple file name rules are matched, S504 is executed.
[0115] S504: adopt the file name rule with the highest rule level.
[0116] S505: Obtain a rule execution strategy according to the unique file name rule.
[0117] S506: Obtain target row rules and target field rules according to the rule execution strategy.
[0118] The method for the server to obtain the target row rule and the target field rule is described in the above embodiment and will not be described again here.
[0119] S507: Whether the rule set is empty.
[0120] If yes, the process ends; if no, S508 is executed.
[0121] The rule set includes target row rules and target field rules corresponding to the rule execution strategy included in the file name rule. If the rule set is empty, it means that the user authority corresponding to the user ID is large, and the user can access the original data file.
[0122] S508: Process the original data file according to the target row rule and the target field rule and the execution order of the rule execution strategy.
[0123] Specifically, the method in which the server processes the original data file is as follows:
[0124] The row rules and field rules obtained by the server based on the preset association relationship are shown in Table 1:
[0125] Table 1
[0126]
[0127]
[0128] The ALLOW type means that when the rule is matched, the value that matches the rule is permitted, and the BLOCK type means that when the rule is matched, the value that matches the rule is prohibited.
[0129] Specifically, the row rules and field rules obtained by the server may be represented by numbers, and the target rule execution strategy includes the numbers of the rules required when the server processes the original data file.
[0130] For example, if the target rule execution strategy is expressed as a1b1c3d3, the server will execute the highest-level ALLOW type row rule and the highest-level BLOCK type row rule for each row of data in the original data file in turn, but will not execute any field rule processing for each field value of each row of data in the original data file.
[0131] For another example, the target rule execution policy is represented as a1b1c3d3, then the server executes all ALLOW type row rules and BLOCK type row rules for each row of data in the original data file in turn, and then executes BLOCK type field rules with a level higher than the highest level of BLOCK type row rules.
[0132] In this way, the row rules and field rules for processing the original data file are determined according to the target rule execution strategy, and the original data file can be processed according to the target row rules and target field rules, thereby realizing permission control over the user's file data, avoiding data leakage, and improving the security of data storage.
[0133] In one example, after the server obtains the target row rule and the target field rule, it processes the original data file. The original data file stored in the file server is shown in Table 2:
[0134] Table 2
[0135] id upfName custcode type date 1000 001UPF 100000000 PM 20240210 2000 002UPF 123450000 PM 20240311 3000 003UPF 567890000 AM 20240401 4000 UPF999 PM 20240401
[0136] The data file stored in the file server includes fields including id, user plane function name (UserPlane Function Name, upfName), customer code (custcode), type (type) and date (date).
[0137] If the target rule execution policy is a2b2c3d1, and it matches 2 ALLOW type row rules, 1 BLOCK type row rule, 1 ALLOW type field rule, and 2 BLOCK type field rules as shown in Table 3. As shown in Table 3:
[0138] Table 3
[0139]
[0140] After processing the original data file shown in Table 2 according to the above row rules and field rules, a data file as shown in Table 4 is obtained, as shown in Table 4:
[0141] Table 4
[0142] id upfName custcode type date 4000 UPF999 PM 20240401
[0143] It can be seen that by adopting the file access method provided in the embodiment of the present application, the server can control the user to only obtain the data with id 4000.
[0144] By adopting the method provided in the embodiment of the present application, on the basis of obtaining the first file name rule, the target row rule and the target field rule can be obtained based on the association relationship of the first file name rule. Among them, the target field rule and the target row rule are determined based on actual user needs. The subsequent server processes the original data file based on the target field rule and the target row rule to obtain the authorized data file, and can obtain the file data for the user's authority, thereby avoiding data leakage.
[0145] Specifically, Figure 6 As shown, Figure 6 The method for obtaining target row rules and target field rules by the server provided in the embodiment of the present application is as follows:
[0146] The server obtains the user identifier carried in the file access request, wherein the user identifier may be a user identity identifier (Identity, ID) or a role identifier. This application takes the user identifier as a user ID as an example.
[0147] After the server obtains the user ID, it searches the file name rule table for the file name rule corresponding to the user ID and searches the user or role table for the role corresponding to the user ID according to the many-to-many relationship intermediate table. The method for the server to obtain the first file name rule by using the file name rule and rule level screening is described in the above embodiment and will not be repeated here.
[0148] After obtaining the file name rule, the server further obtains the target row rule and the target field rule according to the preset association relationship among the file name rule, the row rule and the field rule. Figure 6 A file row rule table and a file field rule table are exemplarily shown, wherein the file row rule table includes a plurality of row rules, and the file field rule table includes a plurality of field rules.
[0149] Specifically, the file name rule includes the fields: id, name_regex, level, and strategy.
[0150] Among them, id represents the primary key of the file name rule, which is used to uniquely identify a file name rule, and its data type is bigint;
[0151] name_regex is used to record file name rules. It can be a regular expression or a custom rule. The data type is varchar(1000);
[0152] level is used to indicate the rule level. The value is an integer. The larger the value, the higher the level. The data type is int.
[0153] strategy is used to indicate the strategy for executing row rules and field rules. The data type is varchar(50).
[0154] Line rules contain the fields: id, line_regex, level, type, and file_name_regex_id.
[0155] Among them, id represents the primary key of the row rule, which is used to uniquely identify a row rule and has a data type of bigint;
[0156] line_regex is used to record line rules, which can be regular expressions or custom rules. The data type is varchar(200);
[0157] level is used to indicate the rule level. The value is an integer. The larger the value, the higher the level. The data type is int.
[0158] type is used to indicate whether the value matching the row rule is allowed. If it is prohibited, it is indicated by BLOCK, and if it is allowed, it is indicated by ALLOW. The data type is enum;
[0159] file_name_regex_id represents the primary key of the name rule, which is used to represent the association with the file name rule. The data type is bigint.
[0160] Field rules include the fields: id, column_name, column_regex, level, type, and file_name_regex_id.
[0161] Among them, id represents the primary key of the field rule, which is used to uniquely identify a field rule and has a data type of bigint;
[0162] Column_name indicates the field name, which is used to record the field name of the data file. For example, the field date indicates the date of the data file. The data type is varchar(200).
[0163] column_regex is used to record field rules, which can be regular expressions or custom rules. The data type is varchar(200);
[0164] level is used to indicate the rule level. The value is an integer. The larger the value, the higher the level. The data type is int.
[0165] type is used to indicate whether the value matching the field rule is allowed. If it is prohibited, it is indicated by BLOCK, and if it is allowed, it is indicated by ALLOW. The data type is enum;
[0166] file_name_regex_id represents the primary key of the file name rule, which is used to represent the association with the file name rule. The data type is bigint.
[0167] exist Figure 6 The server obtains the row rules and field rules based on the combination of Figure 7 The present invention provides a system for accessing files, wherein: Figure 7 A system structure diagram of a method for accessing files provided by an embodiment of the present application using an embodiment of the present application is provided. Figure 7 As shown, the system includes a client, an interface access control module, a file data interface module, a user data interface module, a file data authority control module and a file storage module.
[0168] The interface access control module is used to manage the access rights of different users or services to specific interfaces, for example, restricting authorized clients or services from calling interfaces to download files.
[0169] The file data interface module is used to provide an application programming interface (API) of the Hypertext Transfer Protocol (http) for uploading and downloading files.
[0170] The user data interface module is used to manage the addition, acquisition, and update of user-related data, such as user account information and role information.
[0171] The file data permission control module is used to manage the data in the data file, ensuring that each user can only obtain the data in a specific data file.
[0172] The file storage module is used to store data files, which can usually be transferred through the File Transfer Protocol (FTP) or the Secure File Transfer Protocol (SFTP); or MinIO object storage (Min IO) or Fast Distributed File System (Fast DFS) file storage and access services can be used to provide file data to the outside world.
[0173] It should be noted that each of the above modules can be deployed in a server respectively. From the perspective of microservice architecture design, each of the above modules can be used as a microservice, so that each module can be deployed in the same server. Specifically, the interface access control module can be managed by the gateway server in the microservice architecture, and the file data permission control module can be integrated into the file service module as a submodule of the file service module, or it can be deployed as an independent file data permission control service.
[0174] Specific, combined Figure 8 introduce Figure 7 The interaction process between the modules in the system shown in Figure 8 As shown, the method includes:
[0175] S801. The client requests the gateway service module to download a CSV file, and the request carries a token.
[0176] The request is the above-mentioned file access request, and the request also includes the file name.
[0177] S802: The gateway service module verifies the legitimacy of the token.
[0178] S803: If the token is legal, the gateway service module obtains the user information represented by the token from the user service module.
[0179] Among them, the corresponding relationship between the token and the user information is stored in the user service module.
[0180] S804: The user service module returns user information to the gateway service module.
[0181] The user information includes the user identification in the above embodiment and the interface access rights corresponding to the user identification.
[0182] S805. The gateway service module determines whether the interface access permissions have file download interface access permissions.
[0183] Wherein, the gateway service module determines based on the above interface access rights that if the user corresponding to the user identifier has the file download interface authority, it encapsulates the user identifier in the above file access request and forwards the file access request to the file service module.
[0184] S806: When the user has the file download interface authority, the gateway service module forwards the file download request to the file service module.
[0185] S807: The file service module sends a file download request to the file data authority control module.
[0186] After receiving the file download request sent by the gateway service module, the file service module determines the type of the request instruction and forwards the file download request to the file data authority control module if the type of the request instruction sent by the gateway service module is a file download request type.
[0187] S808. The file data permission control module accesses the file name rules through the preset intermediate table.
[0188] The file data permission control module searches the file name rule table for the file name rule corresponding to the user identifier through the preset intermediate table, wherein the file name rule table includes multiple file name rules. The specific method is referred to the relevant description in the above embodiment and will not be repeated here.
[0189] S809: The file data permission control module returns a no-access response to the file service module.
[0190] If the file data permission control module fails to find the file name rule corresponding to the user identifier in the file download request, a no-access response is returned to the file service module. Specifically, the no-access response is the first abnormal response message in the above embodiment.
[0191] S810. The file service module returns a no-access response to the gateway service module.
[0192] S811. The gateway service module returns an unauthorized access response to the client.
[0193] S812. The file data permission control module obtains a set of rules for processing the original CSV file data.
[0194] The rule set includes target row rules and target field rules.
[0195] Specifically, the method for the file data permission control module to obtain the target row rule and the target field rule is referred to the relevant description in the above embodiment, which will not be repeated here.
[0196] S813. The file data permission control module requests the original CSV file from the file storage module.
[0197] S814. The file storage module returns the original CSV file to the file data authority control module.
[0198] The original CSV file is the original data file corresponding to the file name carried in the file access request.
[0199] S815. The file data permission control module processes the original CSV file according to the rule execution strategy and rule set.
[0200] The method for the file data permission control module to process the original data file according to the target row rule and the target field rule is described in the above embodiment and will not be described again.
[0201] S816. The file data permission control module returns the processed CSV file to the file service module.
[0202] S817. The file service module returns the processed CSV file to the gateway service module.
[0203] S818. The gateway service module returns the processed CSV file to the client.
[0204] According to the method provided by the embodiment of the present application, after the file name rule, row rule and field rule are preset, the file name rule corresponding to the user identifier and the row rule and field rule associated with the file name rule are searched using the preset intermediate table, and then the target row rule and target field rule are obtained using the rule execution strategy in the file name rule. Since the target row rule and the target field rule are preset based on actual business needs and user permissions, the data file obtained after the original data file is processed using the target row rule and the target field rule meets the access rights and actual business needs of different users. In addition, before the server uses the file access request to find the corresponding target row rule and target field rule, the user can set the row rule, field rule and rule execution strategy according to the format of the data file, without configuring the storage location of the data file for each data file, thereby reducing the workload. In addition, by setting the corresponding rule execution strategy through the rule level of the name rule, row rule and field rule, a richer policy control method is provided, so that policy control of different users can be achieved, thereby ensuring the security of business data.
[0205] Based on the same concept, the present application embodiment provides a device for accessing a file, such as Fig. 9 As shown, the device comprises:
[0206] An acquisition module 901 is used to acquire a file access request sent by a terminal, wherein the file access request includes a user identifier;
[0207] A search module 902, configured to search locally for a first file name rule corresponding to the user identifier according to the user identifier, wherein the first file name rule includes a target rule execution strategy;
[0208] The acquisition module 901 is further used to acquire the target field rule and the target row rule according to the target rule execution strategy; the target field rule and the target row rule are preset based on the authority corresponding to the user identifier.
[0209] The acquisition module 901 is further used to acquire the data file according to the target field rule and the target row rule.
[0210] In a possible implementation, the search module 902 is specifically configured to:
[0211] Searching for a file name rule in a preset intermediate table according to the user identifier to obtain a first file name rule, wherein the preset intermediate table records a correspondence between the user identifier and the file name rule;
[0212] Obtain the target rule execution policy in the first file name rule.
[0213] In a possible implementation, the file access request includes a file name; the search module 902 is specifically configured to:
[0214] Searching the preset intermediate table for a file name rule according to the user identifier to obtain at least one second file name rule;
[0215] The file name is matched with a file name rule in the at least one second file name rule to obtain the first file name rule.
[0216] In a possible implementation, the search module 902 is specifically configured to:
[0217] After searching the intermediate table for the file name rule according to the user identifier, if no file name rule is found, a first abnormal response message is returned to the terminal.
[0218] In a possible implementation, the file name rule includes a rule level; the search module 902 is specifically configured to:
[0219] Matching the file name with a file name rule in the at least one file name rule to obtain at least one third file name rule;
[0220] Determining, according to the rule levels in the third file name rules, a third file name rule with the highest rule level among the at least one third file name rule;
[0221] The third file name rule with the highest rule level is used as the first file name rule.
[0222] In a possible implementation, the acquisition module 901 is specifically configured to:
[0223] The target field rule and the target row rule are obtained in a preset association relationship according to the target rule execution strategy, and the preset association relationship is used to represent the correspondence between the file name rule, the field rule, and the row rule.
[0224] In a possible implementation, the search module 902 is specifically configured to:
[0225] After matching the file name with the file name rule in at least one file name rule, if the file name does not match any file name rule, a second abnormal response message is returned to the terminal.
[0226] It should be noted that the device for file access is a device corresponding to the above-mentioned method for file access, and all implementation methods in the above-mentioned method embodiment are applicable to the embodiment of the device and can achieve the same technical effect.
[0227] Fig.10 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.
[0228] The electronic device may include a processor 1001 and a memory 1002 storing computer program instructions.
[0229] Specifically, the processor 1001 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.
[0230] The memory 1002 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 1002 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 1002 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 1002 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 1002 is a non-volatile solid-state memory.
[0231] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.
[0232] The processor 1001 implements any one of the file access methods in the above embodiments by reading and executing computer program instructions stored in the memory 1002 .
[0233] In one example, the electronic device may further include a communication interface 1003 and a bus 1004. Fig.10 As shown, the processor 1001, the memory 1002, and the communication interface 1003 are connected via a bus 1004 and communicate with each other.
[0234] The communication interface 1003 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.
[0235] Bus 1004 includes hardware, software or both, and the parts of electronic equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 1004 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.
[0236] In addition, in combination with the file access method in the above embodiment, the present application embodiment can provide a computer storage medium to implement. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any file access method in the above embodiment is implemented.
[0237] In combination with the file access method in the above embodiments, an embodiment of the present application may provide a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes any file access method in the above embodiments.
[0238] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.
[0239] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.
[0240] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.
[0241] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.
[0242] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.
Claims
1. A method for accessing a file, characterized in that: include: Obtaining a file access request sent by a terminal, wherein the file access request includes a user identifier; Searching locally for a first file name rule corresponding to the user identifier according to the user identifier, wherein the first file name rule includes a target rule execution strategy; Acquire a target field rule and a target row rule according to the target rule execution strategy; the target field rule and the target row rule are pre-set based on the authority corresponding to the user identifier; The original data file is processed according to the target field rule and the target row rule to obtain the authorized data file.
2. The method according to claim 1, characterized in that The step of searching locally for a first file name rule corresponding to the user identifier according to the user identifier includes: The file name rule is searched in a preset intermediate table according to the user identifier to obtain a first file name rule, wherein the preset intermediate table records the correspondence between the user identifier and the file name rule.
3. The method according to claim 2, characterized in that The file access request includes a file name; the step of searching a preset intermediate table for a file name rule according to the user identifier to obtain a first file name rule includes: Searching the preset intermediate table for a file name rule according to the user identifier to obtain at least one second file name rule; The file name is matched with a file name rule in the at least one second file name rule to obtain the first file name rule.
4. The method according to claim 2, characterized in that: After searching the preset intermediate table for the file name rule according to the user identifier, the method further includes: When no file name rule is found, a first abnormal response message is returned to the terminal.
5. The method according to claim 3, characterized in that: The file name rule includes a rule level; the matching of the file name with the file name rule in the at least one second file name rule to obtain the first file name rule includes: Matching the file name with a file name rule in the at least one file name rule to obtain at least one third file name rule; Determining, according to the rule levels in the third file name rules, a third file name rule with the highest rule level among the at least one third file name rule; The third file name rule with the highest rule level is used as the first file name rule.
6. The method according to claim 1, characterized in that The acquiring of the target field rule and the target row rule according to the target rule execution strategy includes: The target field rule and the target row rule are obtained in a preset association relationship according to the target rule execution strategy, and the preset association relationship is used to represent the correspondence between the file name rule, the field rule, and the row rule.
7. The method according to claim 5, characterized in that After matching the file name with a file name rule in the at least one file name rule, the method further includes: When the file name does not match any file name rule, a second abnormal response message is returned to the terminal.
8. A file access device, characterized in that: include: An acquisition module, used for acquiring a file access request sent by a terminal, wherein the file access request includes a user identifier; A search module, configured to search locally for a first file name rule corresponding to the user identifier according to the user identifier, wherein the first file name rule includes a target rule execution strategy; The acquisition module is further used to acquire a target field rule and a target row rule according to the target rule execution strategy; the target field rule and the target row rule are pre-set based on the authority corresponding to the user identifier; The acquisition module is further used to process the original data file according to the target field rule and the target row rule to acquire the authorized data file.
9. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the file access method according to any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the file access method according to any one of claims 1 to 7 is implemented.
11. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the file access method as described in any one of claims 1 to 7.