A business authority management system and method based on big data

Abstract

The present invention relates to the field of business authority management, and specifically to a business authority management system and method based on big data, comprising: an authority proxy module, a request driving module, a row and column management module, a risk regulation module and a credit guarantee module, wherein the authority proxy module is used to provide database service capabilities to external agents, the request driving module is used to parse SQL instructions and determine statement types, the row and column management module is used to verify the row and column permissions of users and build user portraits, the risk regulation module is used to perform partial access locks on high-risk business content, and the credit guarantee module is used to verify row and column data in a high-security database as user credit compensation. The present invention can uniformly manage identity authority information, ensure authority consistency, reduce the risk of data leakage, improve database management efficiency, and at the same time improve data security, thereby achieving overall protection of a database cluster.

Description

Technical Field

[0001] The present invention relates to the field of business authority management, and in particular to a business authority management system and method based on big data. Background Art

[0002] A relational database is a database system that uses a relational model to store and manage data. In a relational database, data is organized into one or more tables. Each table consists of rows and columns. Associations are established through association keys to achieve associations between data. User-level or table-level permission control is required for relational databases to ensure the security of data information.

[0003] With the continuous growth of data volume and the increasing requirements of enterprises for data security, traditional database permission control methods have been unable to meet the needs of refined permission management, especially the difficulty in balancing data security and user convenience. Although some permission management methods can achieve row and column permission control, there is still a risk of attackers stealing user identity information to disguise access.

[0004] In addition, there are often multiple databases with different confidentiality levels in an enterprise. Due to cost reasons, some high-security confidentiality facilities can only be equipped with high-level databases, which makes it impossible to take into account the overall security of the data system, which may lead to uneven data protection. Summary of the invention

[0005] The purpose of the present invention is to provide a business authority management system and method based on big data to solve the problems raised in the above background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: A business authority management system based on big data, comprising: an authority proxy module, a request driving module, a row and column management module, a risk control module and a credit guarantee module;

[0007] The authority proxy module is composed of an authority proxy program set in the database, providing database service capabilities to external agents, configuring the pre-proxy database entry information in the program, and establishing an authority chain table, storing user identity information, authority information and access records in the authority chain table, and building communication channels between databases through communication ports between authority proxy programs;

[0008] The request driver module is used to add the operation request to the JDBC driver package corresponding to the SQL request when the user initiates a business operation action on any database. The database permission agent receives the driver package, determines the user's row permission and column permission according to the user identity token, parses the SQL instruction, and performs syntax analysis on the SQL statement contained in the instruction to determine the statement type;

[0009] The row and column management module is used to verify the row and column permissions of the user according to the predefined permission rules, deny access to content within the unauthorized scope, and perform user profiling on the historical operation records of the database by the user, build an operation simulation model, use the operation simulation model to perform random operation simulation, output the simulation deviation between the simulation result and the user's actual operation result, and judge the user's operation purpose;

[0010] The risk control module is used to initialize the user permission value according to the level of the user's row and column usage permission within the access scope, monitor SQL instructions in real time, obtain the risk value of each operation according to the simulation deviation, row and column permission usage sequence and instruction risk, and perform partial access lock and syntax operation lock on the row and column according to the ratio of risk value to permission value;

[0011] The credit guarantee module is used to reduce the permission value of one unit in the total permission value when the user issues a business operation request for the locked content. When the accumulated risk value is greater than the remaining permission value, the user access is denied and the user is required to provide row and column data of any accessible position in a database with a higher confidentiality level. After the user enters data into the agent program, the accuracy of the data is verified through the communication channel between databases. When the verification is consistent, the total permission value is increased according to the confidentiality level of the database where the verification data comes from and the required permission of the verification data.

[0012] Further, the permission proxy module includes: a cross-library communication unit and a permission chain list unit;

[0013] The cross-database communication unit is used to realize the construction of a cross-database channel through the communication protocol of the authority agent program, and can transmit logical signals through the channel;

[0014] The permission chain table unit is used to store user identity information, permission information and access records in a chain table, wherein the permission information includes: row permission, column permission and table permission.

[0015] Further, the request driving module includes: a business operation unit, an identity extraction unit and an instruction parsing unit;

[0016] The business operation unit is used to act as a proxy for the database JDBC driver package. When the application initiates an SQL request, the driver package intercepts the SQL statement and corrects the initiated SQL statement.

[0017] The identity extraction unit is used to parse the user identity token from the driver package and query the user authority corresponding to the identity token;

[0018] The instruction parsing unit is used to perform syntax analysis on the SQL statement in the instruction and output the statement type, which includes: query, delete, add and modify instructions.

[0019] Further, the row and column management module includes: a permission query unit and an operation modeling unit;

[0020] The permission query unit is used to verify the row permission and column permission of the user and restrict the instruction operation beyond the user's permission;

[0021] The operation modeling unit is used to profile the user operation and output the deviation between the user's current instruction and the profile model.

[0022] Further, the risk control module includes: a risk accumulation unit and a behavior restriction unit;

[0023] The risk accumulation unit is used to monitor SQL instructions and calculate the risk value of each SQL operation executed by the user;

[0024] The behavior restriction unit is used to restrict the user's partial operations on the database when the risk value exceeds a certain proportion of the authority value.

[0025] Further, the credit guarantee module includes: a credit pool unit, an information value unit and an auxiliary authority unit;

[0026] The credit pool unit is used to establish the user's initial authority points according to the user's authority and to provide real-time feedback on the usage status of the authority points;

[0027] The information value unit is used to require the user to provide accessible data in the high-level database and determine the value of the data when the authority points are insufficient;

[0028] The auxiliary authority unit is used to increase the authority points according to the value of the data provided by the user, and to release the user database lock restriction as the points change.

[0029] A business authority management method based on big data includes the following steps:

[0030] Step S1. Set up a rights proxy program in the database to provide database service capabilities to external agents, build a cross-database communication channel through the program's communication port, and preset the entry information stored in the form of a linked list in the rights proxy program;

[0031] Step S2. The user initiates a business operation on the database and adds the operation request to the JDBC driver package corresponding to the SQL request. The authority agent receives the driver package, parses the user identity token and SQL statement, performs syntax analysis on the SQL statement, and outputs the statement type.

[0032] Step S3. Verify the user's row and column permissions, filter out unauthorized statement operations, generate a user profile based on the user's historical operation records, input the command to be executed into the user profile for operation simulation, and record the difference between the simulation probability of the command to be executed and the average probability as the simulation deviation;

[0033] Step S4. Create a user initial authority points file based on the user identity token. Each time a business operation is performed, the simulation deviation, statement type risk and row and column authority parameters are weighted and accumulated to obtain the operation risk. The operation risk is deducted from the authority points. The row and column data are accessed and locked according to the ratio of the remaining points to the current operation risk.

[0034] Step S5. When the authority points are insufficient, the user is required to provide any accessible data in the high-security database, verify the data accuracy through the cross-library channel, and obtain the data value from the confidentiality level of the provided data. The authority points are increased according to the value of the provided data, and the data locking restrictions are lifted as the points change.

[0035] Further, step S1 includes:

[0036] Step S11. Set up a permission proxy program. All access requests to the database are received by the permission proxy program. The database manager is allowed to customize the row and column permission rules of the data table in the permission proxy program according to business needs. The permission rules support multiple condition combinations, including: user identity, data field value and time range;

[0037] Step S12. A communication port is reserved in the hardware device where the authority agent is located, and a communication protocol is uniformly set. Information between databases can be communicated across databases through the communication port. The communication channel is set to request-response transmission to eliminate data pollution caused by cross-database channels;

[0038] Step S13: Setting a permission chain table in the permission agent program to store the storage information, wherein the permission chain table includes user identity information, permission information and access records.

[0039] Further, step S2 includes:

[0040] Step S21. When a user initiates a business operation, an operation request is sent to the authority agent, and the operation request is converted into a database operation statement and added to the JDBC driver package corresponding to the SQL request;

[0041] Step S22. In the process of the application initiating an SQL request, intercept the JDBC driver package, parse the user identity token and SQL statement, correct the SQL statement initiated in the instruction, perform syntax analysis, and output the statement type corresponding to the SQL statement, which includes: query, delete, add and modify instructions.

[0042] Further, step S3 includes:

[0043] Step S31. Analyze the data tables, data rows and data columns involved in the SQL statement, retrieve the table permissions and row and column permissions corresponding to the user identity in the permission chain table, and deny the access request if there is table access within the unauthorized range. If all operation tables are authorized, determine the row and column permissions, filter out the row and column operations without permission, and reconstruct the SQL request;

[0044] Step S32. Construct a user portrait model by any method in step S32-1 or S32-2;

[0045] Step S32-1. Input the historical operation records into the machine learning framework, including TensorFlow, PyTorch and scikit-learn framework, simulate the association pattern between each prior operation and the a posteriori operation, build a model with the operated statement as input and the next operation statement as output, and generate a user portrait model;

[0046] Step S32-2. Based on the user's historical operation records, the probability of the user in the posterior operation is calculated according to the following formula:

[0047] ;

[0048] Where PA is the central function of the user portrait model, c is the previous input, i is the subsequent input, Ra and Rc represent the execution probabilities of the previous input and the subsequent input in the user's historical operation records, respectively, P(i) represents the probability that the subsequent input of the current input is i, P(c) represents the probability that the previous input of the current input is c, n represents the total number of historical operations, and m represents the sequence number of historical operations;

[0049] Substitute the user's previous input c into the central function to obtain the probability of each subsequent input appearing;

[0050] Step S33. Take the executed command in the current operation as the preceding command and the next command to be executed as the succeeding command, obtain the probability p1 of the succeeding command appearing from the user portrait model, calculate the simulation deviation d, where d=p1-1 / n, and record the obtained simulation deviation.

[0051] Further, step S4 includes:

[0052] Step S41. Preset the initial authority points of each user in the authority agent program, and create an initial points file before the user performs an operation. Each time the user performs a business operation, the operation risk is calculated according to the following formula:

[0053] ;

[0054] Where Q is the user's operational risk, k is the confidentiality coefficient of the data table, d is the simulation deviation, y is the deviation adjustment coefficient, u is the number of statements to be executed by the user, j is the number of statements to be executed, Aj and Bj represent the highest row permission and the highest column permission of the j-th statement execution position, respectively, and aj and bj represent the row permission and column permission of the user in the j-th statement execution position, respectively;

[0055] Step S42. Deduct the user's operational risk from the initial authority points, and calculate the ratio of the remaining authority points to the operational risk. When the ratio is lower than the first threshold, close the modification authority of the statement execution location; when it is lower than the second threshold, close the addition and deletion authority of the statement execution location; when it is lower than the third threshold, close the query authority of the statement execution location. The thresholds are preset by the program.

[0056] Further, step S5 includes:

[0057] Step S51. When the remaining authority points are insufficient, the user is required to provide any data in the high-security database, and the provided data can be accessed within the scope of the user's authority;

[0058] After the user obtains the data from the high-security database, he / she enters the database, table, row, column and data content where the data is located, and verifies the accuracy through the cross-database channel. After the verification is passed, the process goes to step S52;

[0059] Step S52. Obtain the value of the provided data from the confidentiality level of the database where the provided data is located and the preset level correspondence table, increase the user's authority points, and the increase is equal to the value of the provided data, and go to step S42 to continue executing the SQL statement.

[0060] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0061] 1. The present invention can establish a communication channel between databases, establish a permission chain list in the permission agent of the database, establish a mapping relationship with user identity as the primary key, uniformly manage user identity and permission information, avoid maintaining different user permission information in multiple databases, perform permission authorization and revocation operations more quickly, and reduce management complexity.

[0062] 2. The present invention can add user operation requests into the corresponding driver package, determine the user's row and column permissions according to the user identity token, monitor SQL instructions, determine the user's operation risks, and effectively prevent data leakage and misoperation through refined row and column permission control. At the same time, it realizes fine-grained control of data rows and columns, ensures the consistency and accuracy of permissions, reduces the risk of data leakage and permission loopholes, and improves database management efficiency.

[0063] 3. The present invention can require users to provide data information at any accessible location in a high-level database from a low-level database, increase the user's baseline authority according to the confidentiality level and authority level of the provided data information, and achieve the association of the highest authority authentication. Security measures can be formulated in a targeted manner to achieve overall protection of the database cluster. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0065] Figure 1 It is a structural diagram of a business authority management system based on big data of the present invention;

[0066] Figure 2 It is a schematic diagram of the steps of a business authority management method based on big data of the present invention. DETAILED DESCRIPTION

[0067] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0068] See also Figure 1 ,The present invention provides a technical solution: a business authority management system based on big data, including: an authority proxy module, a request driving module, a row and column management module, a risk control module and a credit guarantee module;

[0069] The authority proxy module is composed of an authority proxy program set in the database, providing database service capabilities to external agents, configuring the pre-proxy database entry information in the program, and establishing an authority chain table, storing user identity information, authority information and access records in the authority chain table, and building communication channels between databases through communication ports between authority proxy programs;

[0070] The permission proxy module includes: a cross-library communication unit and a permission chain list unit;

[0071] The cross-database communication unit is used to realize the construction of a cross-database channel through the communication protocol of the authority agent program, and can transmit logical signals through the channel;

[0072] The permission chain table unit is used to store user identity information, permission information and access records in a chain table, wherein the permission information includes: row permission, column permission and table permission.

[0073] The request driver module is used to add the operation request to the JDBC driver package corresponding to the SQL request when the user initiates a business operation action on any database. The database permission agent receives the driver package, determines the user's row permission and column permission according to the user identity token, parses the SQL instruction, and performs syntax analysis on the SQL statement contained in the instruction to determine the statement type;

[0074] The request driving module includes: a business operation unit, an identity extraction unit and an instruction parsing unit;

[0075] The business operation unit is used to act as a proxy for the database JDBC driver package. When the application initiates an SQL request, the driver package intercepts the SQL statement and corrects the initiated SQL statement.

[0076] The identity extraction unit is used to parse the user identity token from the driver package and query the user authority corresponding to the identity token;

[0077] The instruction parsing unit is used to perform syntax analysis on the SQL statement in the instruction and output the statement type, which includes: query, delete, add and modify instructions.

[0078] The row and column management module is used to verify the row and column permissions of the user according to the predefined permission rules, deny access to content within the unauthorized scope, and perform user profiling on the historical operation records of the database by the user, build an operation simulation model, use the operation simulation model to perform random operation simulation, output the simulation deviation between the simulation result and the user's actual operation result, and judge the user's operation purpose;

[0079] The row and column management module includes: a permission query unit and an operation modeling unit;

[0080] The permission query unit is used to verify the row permission and column permission of the user and restrict the instruction operation beyond the user's permission;

[0081] The operation modeling unit is used to profile the user operation and output the deviation between the user's current instruction and the profile model.

[0082] The risk control module is used to initialize the user permission value according to the level of the user's row and column usage permission within the access scope, monitor SQL instructions in real time, obtain the risk value of each operation according to the simulation deviation, row and column permission usage sequence and instruction risk, and perform partial access lock and syntax operation lock on the row and column according to the ratio of risk value to permission value;

[0083] The risk control module includes: a risk accumulation unit and a behavior restriction unit;

[0084] The risk accumulation unit is used to monitor SQL instructions and calculate the risk value of each SQL operation executed by the user;

[0085] The behavior restriction unit is used to restrict the user's partial operations on the database when the risk value exceeds a certain proportion of the authority value.

[0086] The credit guarantee module is used to reduce the permission value of one unit in the total permission value when the user issues a business operation request for the locked content. When the accumulated risk value is greater than the remaining permission value, the user access is denied and the user is required to provide row and column data of any accessible position in a database with a higher confidentiality level. After the user enters data into the agent program, the accuracy of the data is verified through the communication channel between databases. When the verification is consistent, the total permission value is increased according to the confidentiality level of the database where the verification data comes from and the required permission of the verification data.

[0087] The credit guarantee module includes: a credit pool unit, an information value unit and an auxiliary authority unit;

[0088] The credit pool unit is used to establish the user's initial authority points according to the user's authority and to provide real-time feedback on the usage status of the authority points;

[0089] The information value unit is used to require the user to provide accessible data in the high-level database and determine the value of the data when the authority points are insufficient;

[0090] The auxiliary authority unit is used to increase the authority points according to the value of the data provided by the user, and to release the user database lock restriction as the points change.

[0091] like Figure 2 As shown, a business authority management method based on big data includes the following steps:

[0092] Step S1. Set up a rights proxy program in the database to provide database service capabilities to external agents, build a cross-database communication channel through the program's communication port, and preset the entry information stored in the form of a linked list in the rights proxy program;

[0093] Step S1 includes:

[0094] Step S11. Set up a permission proxy program. All access requests to the database are received by the permission proxy program. The database manager is allowed to customize the row and column permission rules of the data table in the permission proxy program according to business needs. The permission rules support multiple condition combinations, including: user identity, data field value and time range;

[0095] Step S12. A communication port is reserved in the hardware device where the authority agent is located, and a communication protocol is uniformly set. Information between databases can be communicated across databases through the communication port. The communication channel is set to request-response transmission to eliminate data pollution caused by cross-database channels;

[0096] Step S13: Setting a permission chain table in the permission agent program to store the storage information, wherein the permission chain table includes user identity information, permission information and access records.

[0097] Step S2. The user initiates a business operation on the database and adds the operation request to the JDBC driver package corresponding to the SQL request. The authority agent receives the driver package, parses the user identity token and SQL statement, performs syntax analysis on the SQL statement, and outputs the statement type.

[0098] Step S2 includes:

[0099] Step S21. When a user initiates a business operation, an operation request is sent to the authority agent, and the operation request is converted into a database operation statement and added to the JDBC driver package corresponding to the SQL request;

[0100] Step S22. In the process of the application initiating an SQL request, intercept the JDBC driver package, parse the user identity token and SQL statement, correct the SQL statement initiated in the instruction, perform syntax analysis, and output the statement type corresponding to the SQL statement, which includes: query, delete, add and modify instructions.

[0101] Step S3. Verify the user's row and column permissions, filter out unauthorized statement operations, generate a user profile based on the user's historical operation records, input the command to be executed into the user profile for operation simulation, and record the difference between the simulation probability of the command to be executed and the average probability as the simulation deviation;

[0102] Step S3 includes:

[0103] Step S31. Analyze the data tables, data rows and data columns involved in the SQL statement, retrieve the table permissions and row and column permissions corresponding to the user identity in the permission chain table, and deny the access request if there is table access within the unauthorized range. If all operation tables are authorized, determine the row and column permissions, filter out the row and column operations without permission, and reconstruct the SQL request;

[0104] Step S32. Construct a user portrait model by any method in step S32-1 or S32-2;

[0105] Step S32-1. Input the historical operation records into the machine learning framework, including TensorFlow, PyTorch and scikit-learn framework, simulate the association pattern between each prior operation and the a posteriori operation, build a model with the operated statement as input and the next operation statement as output, and generate a user portrait model;

[0106] Step S32-2. Based on the user's historical operation records, the probability of the user in the posterior operation is calculated according to the following formula:

[0107] ;

[0108] Where PA is the central function of the user portrait model, c is the previous input, i is the subsequent input, Ra and Rc represent the execution probabilities of the previous input and the subsequent input in the user's historical operation records, respectively, P(i) represents the probability that the subsequent input of the current input is i, P(c) represents the probability that the previous input of the current input is c, n represents the total number of historical operations, and m represents the sequence number of historical operations;

[0109] Substitute the user's previous input c into the central function to obtain the probability of each subsequent input appearing;

[0110] Step S33. Take the executed command in the current operation as the preceding command and the next command to be executed as the succeeding command, obtain the probability p1 of the succeeding command appearing from the user portrait model, calculate the simulation deviation d, where d=p1-1 / n, and record the obtained simulation deviation.

[0111] Step S4. Create a user initial authority points file based on the user identity token. Each time a business operation is performed, the simulation deviation, statement type risk and row and column authority parameters are weighted and accumulated to obtain the operation risk. The operation risk is deducted from the authority points. The row and column data are accessed and locked according to the ratio of the remaining points to the current operation risk.

[0112] Step S4 includes:

[0113] Step S41. Preset the initial authority points of each user in the authority agent program, and create an initial points file before the user performs an operation. Each time the user performs a business operation, the operation risk is calculated according to the following formula:

[0114] ;

[0115] Where Q is the user's operational risk, k is the confidentiality coefficient of the data table, d is the simulation deviation, y is the deviation adjustment coefficient, u is the number of statements to be executed by the user, j is the number of statements to be executed, Aj and Bj represent the highest row permission and the highest column permission of the j-th statement execution position, respectively, and aj and bj represent the row permission and column permission of the user in the j-th statement execution position, respectively;

[0116] Step S42. Deduct the user's operational risk from the initial authority points, and calculate the ratio of the remaining authority points to the operational risk. When the ratio is lower than the first threshold, close the modification authority of the statement execution location; when it is lower than the second threshold, close the addition and deletion authority of the statement execution location; when it is lower than the third threshold, close the query authority of the statement execution location. The thresholds are preset by the program.

[0117] Step S5. When the authority points are insufficient, the user is required to provide any accessible data in the high-security database, verify the data accuracy through the cross-library channel, and obtain the data value from the confidentiality level of the provided data. The authority points are increased according to the value of the provided data, and the data locking restrictions are lifted as the points change.

[0118] Step S5 includes:

[0119] Step S51. When the remaining authority points are insufficient, the user is required to provide any data in the high-security database, and the provided data can be accessed within the scope of the user's authority;

[0120] After the user obtains the data from the high-security database, he / she enters the database, table, row, column and data content where the data is located, and verifies the accuracy through the cross-database channel. After the verification is passed, the process goes to step S52;

[0121] Step S52. Obtain the value of the provided data from the confidentiality level of the database where the provided data is located and the preset level correspondence table, increase the user's authority points, and the increase is equal to the value of the provided data, and go to step S42 to continue executing the SQL statement.

[0122] Embodiment: A user issues a business instruction to a database, including: operation 1, executing a modification of 1 row and 3 columns in a first data class, operation 2, executing a deletion of 2 rows and 4 columns in a second data class, and operation 3, executing a query of 4 rows and 1 column in the second data class. The user's permissions are parsed to find that the user has no permissions in the first data class, and the user's operation 1 is rejected. The user has row and column operation permissions of 0.5 and 0.2 at the corresponding positions of operations 2 and 3, and the initial permission score is 5. After the user completes operation 2, the risk coefficient of operation 2, 3, is deducted from the permission score. If the ratio of the remaining permission score to the risk coefficient of operation 3 is less than 1, operation 3 is locked, and the user is required to obtain data through identity authentication of a high-security database to prove his or her permissions.

[0123] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0124] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A business authority management method based on big data, characterized in that: The method comprises the following steps: Step S1. Set up a rights proxy program in the database to provide database service capabilities to external agents, build a cross-database communication channel through the program's communication port, and preset the entry information stored in the form of a linked list in the rights proxy program; Step S2. The user initiates a business operation on the database and adds the operation request to the JDBC driver package corresponding to the SQL request. The authority agent receives the driver package, parses the user identity token and SQL statement, performs syntax analysis on the SQL statement, and outputs the statement type. Step S3. Verify the user's row and column permissions, filter out unauthorized statement operations, generate a user profile based on the user's historical operation records, input the command to be executed into the user profile for operation simulation, and record the difference between the simulation probability of the command to be executed and the average probability as the simulation deviation; Step S4. Create a user initial authority points file based on the user identity token. Each time a business operation is performed, the simulation deviation, statement type risk and row and column authority parameters are weighted and accumulated to obtain the operation risk. The operation risk is deducted from the authority points. The row and column data are accessed and locked according to the ratio of the remaining points to the current operation risk. Step S5. When the authority points are insufficient, the user is required to provide any accessible data in the high-security database, verify the data accuracy through the cross-library channel, and obtain the data value from the confidentiality level of the provided data. The authority points are increased according to the value of the provided data, and the data locking restrictions are lifted as the points change.

2. According to the big data-based business authority management method of claim 1, it is characterized by: Step S1 includes: Step S11. Set up a permission proxy program. All access requests to the database are received by the permission proxy program. The database manager is allowed to customize the row and column permission rules of the data table in the permission proxy program according to business needs. The permission rules support multiple condition combinations, including: user identity, data field value and time range; Step S12. A communication port is reserved in the hardware device where the authority agent is located, and a communication protocol is uniformly set. Information between databases can be communicated across databases through the communication port. The communication channel is set to request-response transmission to eliminate data pollution caused by cross-database channels; Step S13: Setting a permission chain table in the permission agent program to store the storage information, wherein the permission chain table includes user identity information, permission information and access records.

3. According to a big data-based business rights management method according to claim 2, it is characterized by: Step S2 includes: Step S21. When a user initiates a business operation, an operation request is sent to the authority agent, and the operation request is converted into a database operation statement and added to the JDBC driver package corresponding to the SQL request; Step S22. In the process of the application initiating an SQL request, intercept the JDBC driver package, parse the user identity token and SQL statement, correct the SQL statement initiated in the instruction, perform syntax analysis, and output the statement type corresponding to the SQL statement, which includes: query, delete, add and modify instructions.

4. According to claim 3, a business authority management method based on big data is characterized in that: Step S3 includes: Step S31. Analyze the data tables, data rows and data columns involved in the SQL statement, retrieve the table permissions and row and column permissions corresponding to the user identity in the permission chain table, and deny the access request if there is table access within the unauthorized range. If all operation tables are authorized, determine the row and column permissions, filter out the row and column operations without permission, and reconstruct the SQL request; Step S32. Construct a user portrait model by any method in step S32-1 or S32-2; Step S32-1. Input the historical operation records into the machine learning framework, including TensorFlow, PyTorch and scikit-learn framework, simulate the association pattern between each prior operation and the a posteriori operation, build a model with the operated statement as input and the next operation statement as output, and generate a user portrait model; Step S32-2. Based on the user's historical operation records, the probability of the user in the posterior operation is calculated according to the following formula: ； Where PA is the central function of the user portrait model, c is the previous input, i is the subsequent input, Ra and Rc represent the execution probabilities of the previous input and the subsequent input in the user's historical operation records, respectively, P(i) represents the probability that the subsequent input of the current input is i, P(c) represents the probability that the previous input of the current input is c, n represents the total number of historical operations, and m represents the sequence number of historical operations; Substitute the user's previous input c into the central function to obtain the probability of each subsequent input appearing; Step S33. Take the executed command in the current operation as the preceding command and the next command to be executed as the succeeding command, obtain the probability p1 of the succeeding command appearing from the user portrait model, calculate the simulation deviation d, where d=p1-1 / n, and record the obtained simulation deviation.

5. According to the big data-based business authority management method of claim 4, it is characterized by: Step S4 includes: Step S41. Preset the initial authority points of each user in the authority agent program, and create an initial points file before the user performs an operation. Each time the user performs a business operation, the operation risk is calculated according to the following formula: ； Where Q is the user's operational risk, k is the confidentiality coefficient of the data table, d is the simulation deviation, y is the deviation adjustment coefficient, u is the number of statements to be executed by the user, j is the number of statements to be executed, Aj and Bj represent the highest row permission and the highest column permission of the j-th statement execution position, respectively, and aj and bj represent the row permission and column permission of the user in the j-th statement execution position, respectively; Step S42. Deduct the user's operational risk from the initial authority points, and calculate the ratio of the remaining authority points to the operational risk. When the ratio is lower than the first threshold, the modification authority of the statement execution position is closed. When it is lower than the second threshold, the addition and deletion authority of the statement execution position is closed. When it is lower than the third threshold, the query authority of the statement execution position is closed. The thresholds are preset by the program. Step S5 includes: Step S51. When the remaining authority points are insufficient, the user is required to provide any data in the high-security database, and the provided data can be accessed within the scope of the user's authority; After the user obtains the data from the high-security database, he / she enters the database, table, row, column and data content where the data is located, and verifies the accuracy through the cross-database channel. After the verification is passed, the process goes to step S52; Step S52. Obtain the value of the provided data from the confidentiality level of the database where the provided data is located and the preset level correspondence table, increase the user's authority points, and the increase is equal to the value of the provided data, and go to step S42 to continue executing the SQL statement.

6. A business authority management system based on big data, characterized in that: The system includes the following modules: authority proxy module, request drive module, row and column management module, risk control module and credit guarantee module; The authority proxy module is composed of an authority proxy program set in the database, providing database service capabilities to external agents, configuring the pre-proxy database entry information in the program, and establishing an authority chain table, storing user identity information, authority information and access records in the authority chain table, and building communication channels between databases through communication ports between authority proxy programs; The request driver module is used to add the operation request to the JDBC driver package corresponding to the SQL request when the user initiates a business operation action on any database. The database permission agent receives the driver package, determines the user's row permission and column permission according to the user identity token, parses the SQL instruction, and performs syntax analysis on the SQL statement contained in the instruction to determine the statement type; The row and column management module is used to verify the row and column permissions of the user according to the predefined permission rules, deny access to content within the unauthorized scope, and perform user profiling on the historical operation records of the database by the user, build an operation simulation model, use the operation simulation model to perform random operation simulation, output the simulation deviation between the simulation result and the user's actual operation result, and judge the user's operation purpose; The risk control module is used to initialize the user permission value according to the level of the user's row and column usage permission within the access scope, monitor SQL instructions in real time, obtain the risk value of each operation according to the simulation deviation, row and column permission usage sequence and instruction risk, and perform partial access lock and syntax operation lock on the row and column according to the ratio of risk value to permission value; The credit guarantee module is used to reduce the permission value of one unit in the total permission value when the user issues a business operation request for the locked content. When the accumulated risk value is greater than the remaining permission value, the user access is denied and the user is required to provide row and column data of any accessible position in a database with a higher confidentiality level. After the user enters data into the agent program, the accuracy of the data is verified through the communication channel between databases. When the verification is consistent, the total permission value is increased according to the confidentiality level of the database where the verification data comes from and the required permission of the verification data.

7. A business authority management system based on big data according to claim 6, characterized in that: The permission proxy module includes: a cross-library communication unit and a permission chain list unit; The cross-database communication unit is used to realize the construction of a cross-database channel through the communication protocol of the authority agent program, and can transmit logical signals through the channel; The permission chain table unit is used to store user identity information, permission information and access records in a chain table, wherein the permission information includes: row permission, column permission and table permission.

8. The business authority management system based on big data according to claim 7 is characterized by: The request driving module includes: a business operation unit, an identity extraction unit and an instruction parsing unit; The business operation unit is used to act as a proxy for the database JDBC driver package. When the application initiates an SQL request, the driver package intercepts the SQL statement and corrects the initiated SQL statement. The identity extraction unit is used to parse the user identity token from the driver package and query the user authority corresponding to the identity token; The instruction parsing unit is used to perform syntax analysis on the SQL statement in the instruction and output the statement type, which includes: query, delete, add and modify instructions.

9. A business authority management system based on big data according to claim 8, characterized in that: The row and column management module includes: a permission query unit and an operation modeling unit; The permission query unit is used to verify the row permission and column permission of the user and restrict the instruction operation beyond the user's permission; The operation modeling unit is used to profile the user operation and output the deviation between the user's current instruction and the profile model; The risk control module includes: a risk accumulation unit and a behavior restriction unit; The risk accumulation unit is used to monitor SQL instructions and calculate the risk value of each SQL operation executed by the user; The behavior restriction unit is used to restrict the user's partial operations on the database when the risk value exceeds a certain proportion of the authority value.

10. The business authority management system based on big data according to claim 9 is characterized in that: The credit guarantee module includes: a credit pool unit, an information value unit and an auxiliary authority unit; The credit pool unit is used to establish the user's initial authority points according to the user's authority and to provide real-time feedback on the usage status of the authority points; The information value unit is used to require the user to provide accessible data in the high-level database and determine the value of the data when the authority points are insufficient; The auxiliary authority unit is used to increase the authority points according to the value of the data provided by the user, and to release the user database lock restriction as the points change.

Images