Inter-tenant data authorization management method based on Internet platform
By determining associated tenants on the Internet platform and optimizing authorization management, the problem of differences in data authorization management difficulty among tenants is solved, and the security and efficiency of data sharing are improved, and the data volume and permission differences between different tenants are adapted to.
Patent Information
- Application Number
- CN202411338674.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-25
- Publication Date
- 2024-12-27
AI Technical Summary
In the data authorization management between tenants, due to the differences in the difficulty of authorization data management between the target tenants and different tenants, it is impossible to improve the data sharing processing efficiency on the basis of ensuring data security.
By determining associated tenants with data authorization relationships with the target tenant based on the Internet platform, we optimize the determination and authorization management of tenants, evaluate the risk of data leakage based on user permission data of shared files, and adjust the processing cycle based on access processing data and authorization management data, and realize the Improved security and efficiency of data sharing.
It effectively reduces the risk of data leakage and the difficulty of authorization management, improves the security and processing efficiency of data sharing, and adapts to the differences in data volume and permissions between different tenants.
Smart Images
Figure CN119210848A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of data analysis, and in particular, relates to a data authorization management method between tenants based on an Internet platform. Background Art
[0002] For large group companies, group companies often include multiple levels such as subsidiaries and grandson companies. Therefore, how to achieve data authorization management between different subsidiaries within the group company on the basis of ensuring data security so as to realize data sharing and processing has become a technical problem that needs to be solved urgently.
[0003] Specifically, in the invention patent application CN202210089090.0 "Cross-tenant data sharing method, device and electronic device", after the tenant of the target tenant creates a data model and manages data entry, the data to be shared is authorized to the authorized tenant selected by the tenant, which greatly simplifies the workload of data sharing and reduces maintenance costs. However, it is not difficult to find the following technical problems through analysis: When performing data authorization management between tenants, since there is a difference in the management data volume of the authorization data between the target tenant and different tenants, if the data authorization management policies between tenants cannot be differentiated according to the difference in data volume, it is impossible to improve the processing efficiency of data sharing while ensuring data security.
[0004] In response to the above technical problems, the present invention provides a data authorization management method between tenants based on an Internet platform. Summary of the invention
[0005] To achieve the purpose of the present invention, the present invention adopts the following technical solutions: In order to solve the above technical problems, the present invention provides a data authorization management method between tenants based on an Internet platform, which specifically includes: S1 determines the associated tenants that have a data authorization relationship with the target tenant based on the Internet platform, and when it is determined that the authorization management difficulty of the target tenant does not meet the requirements by using the authorization management data of the shared files between different associated tenants, proceeds to the next step; S2: determining access processing data of different associated tenants when performing authorized access to the shared file of the target tenant, and determining a target optimized tenant among the associated tenants based on the access processing data; S3 determines whether the data leakage risk of the optimization process meets the requirements through the user permission data of the shared file in the target optimization tenant. If so, the shared management file is transmitted to the target optimization tenant in real time, and the access authorization management is performed through the target optimization tenant. If not, proceed to the next step. S4 determines the processing cycle of the authorization management of the associated tenant based on the authorization management data of the shared file with the target tenant and the access processing data, and uses the processing cycle to process the access request based on the filtering results of the access request of the user of the associated tenant and the data authorization relationship table.
[0006] The beneficial effects of the present invention are: 1. Determine whether the data leakage risk of the optimized processing meets the requirements through the user permission data of the shared files in the target optimized tenant, thereby determining the data leakage risk of the shared files after optimization processing from the perspective of the user permissions of the shared files, avoiding the emergence of technical problems caused by excessive data leakage risk after optimization processing, and improving the data security of shared files on the basis of reducing the difficulty of authorization management.
[0007] 2. Determine the processing cycle of authorization management of associated tenants based on the authorization management data of shared files with the target tenant and the access processing data. This takes into account the differences in potential access demands caused by the differences in the number of shared files and users with permissions, as well as the differences in historical access demands caused by the differences in access processing data. This enables accurate evaluation of processing cycles from multiple angles, which not only reduces the difficulty of authorization management, but also improves the processing efficiency of authorization management for associated tenants with greater access demands.
[0008] A further technical solution is that the associated tenants are other tenants with whom the target tenant has authorization management for sharing files.
[0009] A further technical solution is that the authorization management data includes the number of shared files and the data volume of different shared files.
[0010] A further technical solution is that, when the authorization management difficulty of the target tenant meets the requirement, the processing cycle of the authorization management of the associated tenant is directly determined, and the access requests of users of different associated tenants are processed using the processing cycle.
[0011] A further technical solution is to process the access request, specifically including: The access object and user identity of the access request of the user of the associated tenant are determined based on the filtering result of the access request of the user of the associated tenant, and when it is determined that the access rights of the access request meet the requirements based on the correspondence between the data authorization relationship table and the access object and the user identity, the access request of the associated tenant is processed based on the access object.
[0012] Other features and advantages will be described in the following description, and partly become apparent from the description, or understood by practicing the invention. The purpose and other advantages of the invention are realized and obtained by the structures particularly pointed out in the description and the drawings.
[0013] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0014] The above and other features and advantages of the present invention will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings.
[0015] Figure 1 It is a flow chart of a method for data authorization management between tenants based on an Internet platform; Figure 2 is a flow chart of a method for determining a target optimization tenant among associated tenants; Figure 3 The invention is a flow chart of a method for determining a processing period of authorization management associated with tenants. DETAILED DESCRIPTION
[0016] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.
[0017] To solve the above problems, according to one aspect of the present invention, Figure 1 According to one aspect of the present invention, a method for data authorization management between tenants based on an Internet platform is provided, which specifically includes: S1 determines the associated tenants that have a data authorization relationship with the target tenant based on the Internet platform, and when it is determined that the authorization management difficulty of the target tenant does not meet the requirements by using the authorization management data of the shared files between different associated tenants, proceeds to the next step; Furthermore, the associated tenants are other tenants with whom the target tenant has authorization management for sharing files.
[0018] Specifically, the authorization management data includes the number of shared files and the data volume of different shared files.
[0019] It is understandable that determining the authorization management difficulty of the target tenant does not meet the requirements specifically includes: Determine the number of shared files of the target tenant by using the authorization management data of shared files between different associated tenants, and determine the management difficulty coefficient of the target tenant by using the number of shared files and the number of associated tenants; The difficulty coefficient of file authorization management of different shared files is determined by using the data volume of different shared files and the number of associated tenants; The comprehensive difficulty coefficient of authorization management of the target tenant is determined according to the difficulty coefficients of file authorization management of different shared files and the management difficulty coefficient of the target tenant, and the comprehensive difficulty coefficient of authorization management of the target tenant is used to determine whether the authorization management difficulty of the target tenant meets the requirements.
[0020] Further, when the comprehensive difficulty coefficient of the authorization management of the target tenant is not within a preset range, it is determined that the difficulty of the authorization management of the target tenant does not meet the requirement.
[0021] It should also be noted that when the authorization management difficulty of the target tenant meets the requirement, the processing cycle of the authorization management of the associated tenant is directly determined, and the access requests of users of different associated tenants are processed using the processing cycle.
[0022] Optionally, determining that the authorization management difficulty of the target tenant does not meet the requirement specifically includes steps S11-S13, specifically: S11 determines the number of shared files of the target tenant through authorization management data of shared files between different associated tenants; S12 determines the difficulty coefficient of file authorization management of different shared files by using the data volume of different shared files and the number of associated tenants; S13 determines the management difficulty coefficient of the target tenant by using the number of shared files and the number of associated tenants, determines the comprehensive difficulty coefficient of authorization management of the target tenant according to the difficulty coefficients of file authorization management of different shared files and the management difficulty coefficient of the target tenant, and determines whether the difficulty of authorization management of the target tenant meets the requirements by using the comprehensive difficulty coefficient of authorization management of the target tenant.
[0023] S2: determining access processing data of different associated tenants when performing authorized access to the shared file of the target tenant, and determining a target optimized tenant among the associated tenants based on the access processing data; Furthermore, the access processing data includes access processing frequency and access processing delay.
[0024] Specifically, Figure 2 As shown, the method for determining the target optimized tenant among the associated tenants is: Determine the access processing frequency of the associated tenant on different dates based on the access processing data of the associated tenant, and determine the access demand coefficient of the associated tenant by the access frequency on different dates; Determining the access processing delay of the associated tenant on different dates through the access processing data of the associated tenant, and determining the access processing delay coefficient of the associated tenant using the access processing delay; The optimization demand coefficient of the associated tenant is determined according to the access processing delay coefficient and the access demand coefficient, and a target optimized tenant among the associated tenants is determined by using the optimization demand coefficient.
[0025] Further, when the optimization demand coefficient of the associated tenant is greater than a preset demand coefficient threshold, the associated tenant is determined to be a target optimization tenant.
[0026] It should be further explained that the method for determining the target optimized tenant among the associated tenants includes steps S21-S23, specifically: S21: determining the access processing frequency of the associated tenant on different dates based on the access processing data of the associated tenant, and determining the access processing delay of the associated tenant on different dates through the access processing data of the associated tenant; Optionally, the above step S21 includes steps S211-S212, which are specifically: S211 determines the access processing frequency of the associated tenant on different dates based on the access processing data of the associated tenant, and determines whether there is a date with an access processing frequency greater than a preset access frequency. If yes, proceed to step S22; if no, proceed to the next step; S212 determines the access processing delay of the associated tenant on different dates through the access processing data of the associated tenant, and judges whether there is a date on which the access processing delay does not meet the requirements. If so, proceeds to step S22; if not, determines that the associated tenant does not belong to the target optimization tenant.
[0027] S22 determines the optimization processing requirements of authorization management on different dates based on the access frequencies and access processing delays on different dates; Optionally, the above step S22 includes steps S221-S223, specifically: S221 determines whether the number of dates when the access processing frequency is greater than the preset access frequency is greater than the preset number of dates. If so, it is determined that the associated tenant belongs to the target optimization tenant. If not, proceed to the next step. S222 determines whether the number of dates on which the access processing delay does not meet the requirement is greater than the preset number of dates. If so, it is determined that the associated tenant belongs to the target optimization tenant. If not, proceed to the next step. S223 determines the optimization processing requirements of authorization management on different dates based on the access frequency and access processing delay on different dates, and judges whether the number of dates whose optimization processing requirements are greater than the preset requirement threshold is greater than the preset number of dates. If so, it is determined that the associated tenant belongs to the target optimization tenant. If not, enter step S23.
[0028] S23 determines the access demand coefficient of the associated tenant by the access frequency on different dates, determines the access processing delay coefficient of the associated tenant by using the access processing delay, determines the optimized demand coefficient of the associated tenant according to the access processing delay coefficient and the access demand coefficient, and determines the target optimized tenant among the associated tenants by using the optimized demand coefficient.
[0029] Furthermore, when the associated tenant does not belong to the target optimized tenant, the processing cycle of the authorization management of the associated tenant is directly determined, and the access requests of users of different associated tenants are processed using the processing cycle.
[0030] S3 determines whether the data leakage risk of the optimization process meets the requirements through the user permission data of the shared file in the target optimization tenant. If so, the shared management file is transmitted to the target optimization tenant in real time, and the access authorization management is performed through the target optimization tenant. If not, proceed to the next step. It is understandable that determining whether the data leakage risk of the optimized processing meets the requirements includes: The shared files between the target optimization tenant and the target tenant are used as matching shared files, the number of users with permissions to the different matching shared files is determined according to the user permission data of the different matching shared files, and the leakage risks of the different matching shared files are determined in combination with the total number of users of the target optimization tenant; Determine different weight coefficients of leakage risks of matching shared files according to different data volumes of matching shared files, and determine the leakage risk coefficient of the target optimized tenant based on the leakage risk of the matching shared files and the weight coefficient of the leakage risk; Whether the data leakage risk of the optimization processing of the target optimization tenant meets the requirement is determined through the leakage risk coefficient of the target optimization tenant.
[0031] Further, when the leakage risk coefficient of the target optimized tenant is not within the preset risk range, it is determined that the data leakage risk of the optimized processing of the target optimized tenant does not meet the requirements.
[0032] It should also be noted that determining whether the data leakage risk of the optimized processing meets the requirements specifically includes steps S31-S32, specifically: S31: taking the shared files between the target optimization tenant and the target tenant as matching shared files, and determining the leakage risks of different matching shared files by using the ratio of the number of users with permissions to different matching shared files to the total number of users of the target optimization tenant; S32 determines the weight coefficients of the leakage risks of different matching shared files with different data volumes of matching shared files, determines the leakage risk coefficient of the target optimized tenant based on the leakage risk of the matching shared files and the weight coefficient of the leakage risk, and determines whether the data leakage risk of the optimized processing of the target optimized tenant meets the requirements through the leakage risk coefficient of the target optimized tenant.
[0033] Specifically, Figure 3 As shown, the method for determining the processing cycle of the authorization management of the associated tenant is: Determine the number of shared files between the target tenant and the target tenant based on the authorization management data of the shared files between the target tenant and the target tenant, and determine the potential access demand value of the associated tenant in combination with the number of users with permissions for different shared files; Determine the access frequency of the associated tenant to the target tenant based on the access processing data between the associated tenant and the target tenant, and determine the access processing requirement value of the associated tenant in combination with the access processing delay of the associated tenant to the target tenant; The comprehensive potential demand value of the associated tenant is determined by the access processing demand value and the access potential demand value of the associated tenant, and the processing cycle of the authorization management of the associated user is determined according to the comprehensive potential demand value.
[0034] Further, determining the processing cycle of the authorization management of the associated user according to the comprehensive potential demand value specifically includes: A preset processing period corresponding to the comprehensive potential demand value is determined based on the comprehensive potential demand value, and a processing period for authorization management of the associated user is determined according to the preset processing period.
[0035] It is understandable that processing an access request specifically includes: The access object and user identity of the access request of the user of the associated tenant are determined based on the filtering result of the access request of the user of the associated tenant, and when it is determined that the access rights of the access request meet the requirements based on the correspondence between the data authorization relationship table and the access object and the user identity, the access request of the associated tenant is processed based on the access object.
[0036] It is understandable that: Optionally, the above step S31 includes steps S311-S314, which are specifically: S311: taking the shared files between the target optimization tenant and the target tenant as matching shared files, and judging whether the number of the matching shared files is greater than the preset number of files; if so, proceeding to step S314; if not, proceeding to the next step; S312 determines the number of users with permissions to different matching shared files according to the user permission data of different matching shared files, takes the ratio of the total number of users with permissions to the target optimized tenant to the total number of users of the target optimized tenant as the permission user number ratio, and determines whether the permission user number ratio is greater than the preset number ratio. If so, it is determined that the data leakage risk of the optimization processing of the target optimized tenant meets the requirements. If not, proceed to the next step; S313 determines the leakage risk of different matching shared files by using the ratio of the number of users with permissions to the target optimized tenant to the total number of users, and determines whether there are matching shared files whose leakage risk does not meet the requirements. If so, proceed to the next step; if not, determine that the data leakage risk of the optimized processing of the target optimized tenant meets the requirements; S314 determines whether the number of matching shared files whose leakage risk does not meet the requirement meets the requirement. If so, proceed to step S32. If not, it is determined that the data leakage risk of the optimized processing of the target optimized tenant does not meet the requirement.
[0037] S35 determines the weight coefficients of the leakage risks of different matching shared files with different data volumes of matching shared files, determines the leakage risk coefficient of the target optimized tenant based on the leakage risk of the matching shared files and the weight coefficient of the leakage risk, and determines whether the data leakage risk of the optimized processing of the target optimized tenant meets the requirements through the leakage risk coefficient of the target optimized tenant.
[0038] It is understandable that: When a user belongs to company A, which is a subsidiary of company B, the user can also see some attendance system published by company B.
[0039] First, the user requests the Dubbo interface for querying the attendance system (the interface has been annotated with the EnableAutoPermissionList annotation on the method when it was defined). The request is not sent directly, but first passes through the custom UserInfoConsumerFilter filter, which parses the token information in the incoming Http request into a specific user object, determines the user ID and the ID of the company to which it belongs, and puts them into the request parameters of the Dubbo request.
[0040] After that, it passes through our custom DataAuthConsumerFilter filter. In this filter, we first determine whether it is marked with the EnableAutoPermissionList annotation to decide whether subsequent processes are required. If so, we use the user object converted in the previous step, use the current user ID, company ID and the dataType attribute marked by the EnableAutoPermissionList annotation to call the unified data authorization service.
[0041] In the data authorization service, there are multiple data authorization relationship tables. The data authorization service searches for the corresponding processor in the data authorization processor table according to the dataType attribute. For example, the cross-tenant query processor queries the enterprise upper and lower data authorization relationship tables again inside the processor to obtain all enterprise IDs visible to the user. The obtained enterprise ID list is put into the request body of the Dubbo call. After completing these, the Dubbo request is actually released and requested to the specific business service. In the business service, you can directly retrieve the enterprise ID list for the in operation query.
[0042] The above is for cross-enterprise query only. If you need to query across applications, there is an appFlags attribute in the EnableAutoPermissionList annotation. If this attribute is not the default value and the corresponding application can be found in the application identification table, the processor corresponding to the application will be called to further process the obtained enterprise ID list and convert it into the corresponding application ID list. The business service can directly use the obtained application ID list to filter data using the in operation.
[0043] Optionally, the above step S11 includes steps S111-S113, which are specifically: S111 determines the number of shared files of the target tenant through the authorization management data of shared files between different associated tenants, and judges whether the number of shared files of the target tenant is greater than the preset number of files. If so, proceed to the next step; if not, proceed to step S12; S112 determines whether the number of associated tenants of the target tenant is greater than the preset number of associated tenants. If so, it is determined that the authorization management difficulty of the target tenant does not meet the requirement. If not, proceed to the next step. S113 determines the total data amount of the target tenant's shared files based on the data amount of the different shared files, and determines the basic management difficulty coefficient in combination with the number of associated tenants of the target tenant, and judges whether the basic management difficulty coefficient meets the requirements. If so, proceeds to step S12; if not, it determines that the authorization management difficulty of the target tenant does not meet the requirements.
[0044] Optionally, the above step S12 includes the following steps: S12 uses the data volume of different shared files and the number of associated tenants to determine the difficulty coefficient of file authorization management of different shared files, and judges whether the number of shared files whose difficulty coefficient of file authorization management does not meet the requirements is greater than the preset number of files. If so, it is determined that the authorization management difficulty of the target tenant does not meet the requirements. If not, enter step S13.
[0045] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.
[0046] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0047] The above description is only one or more embodiments of this specification and is not intended to limit this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification shall be included in the scope of the claims of this specification.
Claims
1. A data authorization management method between tenants based on an Internet platform, characterized in that: Specifically include: Determine the associated tenants that have a data authorization relationship with the target tenant based on the Internet platform, and when it is determined that the authorization management difficulty of the target tenant does not meet the requirement by using the authorization management data of the shared files between different associated tenants, proceed to the next step; Determining access processing data of different associated tenants when performing authorized access to the shared file of the target tenant, and determining a target optimized tenant among the associated tenants based on the access processing data; Determine whether the data leakage risk of the optimization process meets the requirements through the user authority data of the shared file in the target optimization tenant. If so, transmit the shared management file to the target optimization tenant in real time, and perform access authorization management through the target optimization tenant. If not, proceed to the next step. Based on the authorization management data of the shared files with the target tenant and the access processing data, the processing cycle of the authorization management of the associated tenant is determined, and the access request is processed based on the filtering results of the access request of the user of the associated tenant and the data authorization relationship table using the processing cycle.
2. The method for data authorization management between tenants based on the Internet platform according to claim 1, characterized in that: The associated tenants are other tenants with whom the target tenant has authorization management for sharing files.
3. The method for data authorization management between tenants based on the Internet platform according to claim 1, characterized in that: The authorization management data includes the number of shared files and the data volume of different shared files.
4. The method for data authorization management between tenants based on the Internet platform according to claim 1, characterized in that: It is determined that the authorization management difficulty of the target tenant does not meet the requirements, specifically including: Determine the number of shared files of the target tenant by using the authorization management data of shared files between different associated tenants, and determine the management difficulty coefficient of the target tenant by using the number of shared files and the number of associated tenants; The difficulty coefficient of file authorization management of different shared files is determined by using the data volume of different shared files and the number of associated tenants; The comprehensive difficulty coefficient of authorization management of the target tenant is determined according to the difficulty coefficients of file authorization management of different shared files and the management difficulty coefficient of the target tenant, and the comprehensive difficulty coefficient of authorization management of the target tenant is used to determine whether the authorization management difficulty of the target tenant meets the requirements.
5. The method for data authorization management between tenants based on the Internet platform according to claim 1, characterized in that: When the authorization management difficulty of the target tenant meets the requirement, the processing cycle of the authorization management of the associated tenant is directly determined, and the access requests of users of different associated tenants are processed using the processing cycle.
6. The method for data authorization management between tenants based on the Internet platform according to claim 1, characterized in that: The access processing data includes access processing frequency and access processing delay.
7. The method for data authorization management between tenants based on the Internet platform according to claim 1, characterized in that: The method for determining the target optimized tenant among the associated tenants is: Determine the access processing frequency of the associated tenant on different dates based on the access processing data of the associated tenant, and determine the access demand coefficient of the associated tenant by the access frequency on different dates; Determining the access processing delay of the associated tenant on different dates through the access processing data of the associated tenant, and determining the access processing delay coefficient of the associated tenant using the access processing delay; The optimization demand coefficient of the associated tenant is determined according to the access processing delay coefficient and the access demand coefficient, and a target optimized tenant among the associated tenants is determined by using the optimization demand coefficient.
8. The method for data authorization management between tenants based on the Internet platform according to claim 7, characterized in that: When the optimization demand coefficient of the associated tenant is greater than a preset demand coefficient threshold, the associated tenant is determined to be a target optimization tenant.
9. The method for data authorization management between tenants based on the Internet platform according to claim 1, characterized in that: When the associated tenant does not belong to the target optimization tenant, the processing cycle of the authorization management of the associated tenant is directly determined, and the access requests of users of different associated tenants are processed using the processing cycle.
10. The method for data authorization management between tenants based on the Internet platform according to claim 1, characterized in that: Processing access requests, including: The access object and user identity of the access request of the user of the associated tenant are determined based on the filtering result of the access request of the user of the associated tenant, and when it is determined that the access rights of the access request meet the requirements based on the correspondence between the data authorization relationship table and the access object and the user identity, the access request of the associated tenant is processed based on the access object.