Data warehouse safety management system and method and electronic equipment

Abstract

The invention provides a data warehouse safety management system and method and electronic device.The data warehouse safety management system is preset in target machine equipment, the target machine equipment is not connected with an external network, and the system comprises a first permission verification module, a second permission verification module and a third permission verification module; multiple verification is performed on a user name, a first user password, a second user password and a random verification identifier through three authority verification modules, so that multiple verification can be performed on a service user when the service user needs to utilize data stored in a data warehouse to perform data analysis until the three authority verification modules all pass verification, and the user experience is improved. And opening the access authority of the data applied to be accessed to the service user. According to the invention, part of business users can be prevented from illegally using other user names and the first user password to obtain data from the data warehouse, the risk of data leakage in the data warehouse is reduced, and the security of the data in the data warehouse can be maintained.

Description

Technical Field

[0001] The present application relates to the field of database technology, and in particular to a data warehouse security management system, method and electronic equipment. Background Art

[0002] With the advent of the big data era, the efficient use of data is driving the development of science and technology, finance, manufacturing and other fields. Among them, data analysis and machine learning in the efficient use of data are crucial to the financial field. Data analysis and machine learning can help financial institutions or enterprises better understand customer needs, optimize business processes, risk management and decision-making, thereby improving the competitiveness and profitability of institutions or enterprises. Usually, data analysis is to obtain target data from the back-end data warehouse, and then perform data calculations on the obtained target data based on user needs, and then output the corresponding analysis results.

[0003] However, when existing data warehouses are used for data analysis, data leakage often occurs, which is extremely dangerous for application scenarios such as finance or banking that require a high level of data security. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a data warehouse security management system, method and electronic device to improve data security in existing data analysis application scenarios and fully ensure the security of data in the data warehouse.

[0005] In a first aspect, an embodiment of the present application provides a data warehouse security management system, wherein the data warehouse security management system is pre-installed in a target machine device, wherein the target machine device is not connected to an external network, and the system includes:

[0006] A first permission verification module is used to obtain and verify first login information input by a business user, wherein the first login information includes: a user name and a first user password;

[0007] A second permission verification module is used to obtain and verify the second login information input by the business user after the first login information is verified, wherein the second login information includes: a second user password and a random verification identifier, wherein the random verification identifier is a random verification code generated based on the target link;

[0008] The third permission verification module is used to verify the user group to which the business user belongs after the second login information is verified, and if the verification is passed, open the access rights of the data applied for by the business user to the business user.

[0009] In combination with the first aspect, in a second possible embodiment, the target machine device is disconnected from the external network in the following manner:

[0010] Disconnect the network port connection with the external network, turn on the network firewall, and open a preset port range, wherein the preset port range is used to connect the second permission verification module with the third permission verification module to achieve directional IP communication between the second permission verification module and the third permission verification module.

[0011] In combination with the second possible embodiment of the first aspect, in a third possible embodiment, the second permission verification module is further used to:

[0012] Sending a target link application message to a preset verification platform, so that after receiving the target link application message, the preset verification platform pushes the random verification identifier to the target contact information corresponding to the business user based on the locally pre-stored business user contact information list, and returns the random verification identifier to the second permission verification module;

[0013] Receive the random verification identifier input by the business user and the random verification identifier returned by the preset verification platform, and compare them. If they are consistent, the random verification identifier in the second login information is verified successfully; if they are inconsistent, the random verification identifier in the second login information is verified unsuccessfully.

[0014] In combination with the first aspect, in a fourth possible embodiment, the second permission verification module is a code module obtained by adding logic code for verifying the second user password and the random verification identifier in the JupyterHub source code.

[0015] In combination with the first aspect, in a fifth possible embodiment, the third permission verification module is a Spark cluster permission verification module, which is specifically used to:

[0016] Obtaining the personal identity of the business user, and obtaining the user group to which the business user belongs through a preset interface service;

[0017] Creating a Spark connection with the user group to which the business user belongs, verifying the user group to which the business user belongs, and if the verification passes, opening the business user with access rights to the data that the business user applies to access, includes:

[0018] The user group to which the business user belongs is verified, and if the verification passes, the Spark connection permission corresponding to the user group to which the business user belongs is opened to the business user.

[0019] In combination with the first aspect, in a sixth possible embodiment, the system further includes: a desktop cloud virtual machine, wherein the desktop cloud virtual machine is used to obtain the behavior data of the business user and perform security monitoring on the data uploaded or downloaded by the business user.

[0020] In a second aspect, the present application provides a data warehouse security management method, the method is applied to a data warehouse security management system, the data warehouse security management system is pre-installed in a target machine device, wherein the target machine device is not connected to an external network, the method comprising:

[0021] Obtaining first login information input by a business user and verifying it, wherein the first login information includes: a user name and a first user password;

[0022] After the first login information is verified, the second login information input by the business user is obtained and verified, wherein the second login information includes: a second user password and a random verification identifier, wherein the random verification identifier is a random verification code generated based on the target link;

[0023] After the second login information is verified, the user group to which the business user belongs is verified. If the verification is successful, the access rights of the data that the business user has applied to access are opened to the business user.

[0024] In combination with the second aspect, in a second possible embodiment, the method further includes:

[0025] Sending a target link application message to a preset verification platform, so that after receiving the target link application message, the preset verification platform pushes the random verification identifier to the target contact information corresponding to the business user based on the locally pre-stored business user contact information list, and returns the random verification identifier;

[0026] Receive the random verification identifier input by the business user and the random verification identifier returned by the preset verification platform, and compare them. If they are consistent, the random verification identifier in the second login information is verified successfully; if they are inconsistent, the random verification identifier in the second login information is verified unsuccessfully.

[0027] In combination with the second aspect, in a third possible embodiment, the method further includes:

[0028] Obtaining the personal identity of the business user, and obtaining the user group to which the business user belongs through a preset interface service;

[0029] Creating a Spark connection with the user group to which the business user belongs, verifying the user group to which the business user belongs, and if the verification passes, opening the business user with access rights to the data that the business user applies to access, includes:

[0030] The user group to which the business user belongs is verified, and if the verification passes, the Spark connection permission corresponding to the user group to which the business user belongs is opened to the business user.

[0031] In a third aspect, an embodiment of the present application provides an electronic device, wherein the electronic device includes:

[0032] Processor; and

[0033] Memory for storing programs,

[0034] The program includes instructions, which, when executed by the processor, enable the processor to execute the data warehouse security management method described in the first aspect.

[0035] In a fourth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the data warehouse security management method described in the first aspect.

[0036] Beneficial effects of this application:

[0037] The present application provides a data warehouse security management system, method and electronic device, wherein the data warehouse security management system is pre-installed in a target machine device, the target machine device is not connected to an external network, the system includes a first permission verification module, a second permission verification module and a third permission verification module, and multiple verifications are performed on the user name, the first user password, the second user password and the random verification identifier through the three permission verification modules respectively. When the business user needs to use the data stored in the data warehouse to perform data analysis tasks, the business user can be multiple-verified until the three permission verification modules are verified and passed, and the access rights to the data requested for access can be opened to the business user. In this way, it can be avoided that some business users use other people's user names and first user passwords to obtain data from the data warehouse, reduce the risk of data leakage in the data warehouse, and help maintain the security of the data in the data warehouse. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Further details, features and advantages of the present application are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0039] Figure 1 A schematic diagram of a logical architecture of a data warehouse security management system provided by an embodiment of the present application is shown;

[0040] Figure 2 A schematic diagram of a process of a data warehouse security management method provided by an embodiment of the present application is shown;

[0041] Figure 3 A schematic diagram of an application scenario architecture of a data warehouse security management system provided by an embodiment of the present application is shown;

[0042] Figure 4 A schematic diagram of a logical architecture of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0043] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0044] It should be understood that the various steps described in the method implementation of the present application can be performed in different orders and / or performed in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.

[0045] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc. mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0046] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0047] In this application, a data warehouse is a general term for a space that stores data. The data warehouse is the cornerstone of data analysis. The data warehouse stores all the data required for the operation of an enterprise or organization. Among them, data analysis refers to a data calculation task that calculates the corresponding analysis results according to specific needs based on the data stored in the data warehouse. For example, in the financial field, it is necessary to analyze a user's potential borrowing needs, and it is necessary to use the user's historical borrowing records and cash flow situation for analysis. At this time, a data analysis task for user borrowing probability analysis can be generated, and then the user's historical borrowing situation and cash flow situation can be obtained from the data warehouse, and the user's potential borrowing probability can be calculated with the help of a specific data calculation model.

[0048] Since the data involved in financial and banking applications are usually directly linked to currency, the security protection requirements for data in data warehouses are extremely high. However, in the existing data warehouse application process, there are still permission verification loopholes that make the data in the data warehouse leak. For example, there are business users who use the account and password of other business users to log in to the data warehouse to obtain data, resulting in data leakage of business users.

[0049] In view of this, the present application provides a data warehouse security management system, method and electronic device to improve the security factor of data in the data warehouse, thereby ensuring the data security when the data warehouse is used for data analysis. Among them, in the first aspect, the present application provides a data warehouse security management system, wherein the data warehouse security management system is a software system, which is pre-installed in the target machine device. Exemplarily, the data warehouse security management system is similar to a data warehouse management platform, and business users can pre-install the data warehouse management platform into the target machine device by installing the executable file. Among them, business users are different from users who provide external services in the ordinary sense. The business users are personnel from various business departments within an organization, institution or enterprise. In an embodiment of the present application, the data warehouse management platform is a management platform used within an organization, institution or enterprise, and is not open to the public. In this way, each business user logs in and accesses the data warehouse management system to obtain the required data.

[0050] In the embodiment of the present application, the target machine device refers to one or more machine devices designated within an organization, institution or enterprise. For example, each business department has a target machine device, and the personnel of the business department can obtain the required data through the business department's own target machine device.

[0051] In the embodiment of the present application, the target machine device is not connected to the external network means that it is not connected to the external network through the external network port, that is, the target machine device cannot directly communicate with the device of the external network. In the embodiment of the present application, the external network refers to the external network connection of an organization, institution or enterprise. It can be understood that in the embodiment of the present application, the network is divided into two isolated network parts: an internal network and an external network, wherein devices outside the organization or enterprise cannot directly access the internal network.

[0052] In some embodiments, Figure 1 As shown, the data warehouse security management system 10 may include the following modules:

[0053] A first permission verification module 11, a second permission verification module 12, and a third permission verification module 13.

[0054] The first permission verification module 11 is used to obtain and verify first login information input by a business user, wherein the first login information includes: a user name and a first user password.

[0055] The second permission verification module 12 is used to obtain and verify the second login information input by the business user after the first login information is verified. The second login information includes: a second user password and a random verification identifier, wherein the random verification identifier is a random verification code generated based on the target link.

[0056] The third permission verification module 13 is used to verify the user group to which the business user belongs after the second login information is verified. If the verification is successful, the business user is given access rights to the data that the business user has applied to access.

[0057] Based on this, in some embodiments, the target machine device is disconnected from the external network in the following manner:

[0058] Disconnect the network port connection with the external network, turn on the network firewall, and open a preset port range, wherein the preset port range is used to connect the second permission verification module with the third permission verification module to achieve directional IP communication between the second permission verification module and the third permission verification module.

[0059] Disconnecting the network port connection with the external network may be done by directly disconnecting the physical connection between the network port and the external network, without inserting any network cable connected to the external network into the target machine device. As another implementation, the physical connection may not be disconnected, but the communication network segment connected to the external network may be shielded by setting a communication network segment, thereby disconnecting the network port connection with the external network at the virtual level.

[0060] The network firewall is a functional module that filters and blocks unauthorized access and data transmission according to preset network security policies. In an embodiment of the present application, some known unsafe communication addresses and ports can be pre-installed in the network firewall. When the network firewall is turned on, the data or access requests sent by the pre-set unsafe communication addresses and ports can be automatically blocked.

[0061] To open a preset port range, you can set a port range whitelist in the network firewall and set the port numbers that are allowed to be accessed in the port range whitelist. After the network firewall is turned on, the access rights to the preset port range will be automatically opened, thereby allowing data access to the devices corresponding to each port in the port range whitelist.

[0062] In the embodiment of the present application, the first permission verification module, the second permission verification module and the third permission verification module are all program modules that are encapsulated independently of each other, and are called by each other through preset communication port numbers. In the embodiment of the present application, the preset port interval is used to connect the second permission verification module and the third permission verification module, so as to realize directional IP communication between the second permission verification module and the third permission verification module based on the directional IP address and each port number in the preset port interval.

[0063] As an implementation mode, the first permission verification module, the second permission verification module and the third permission verification module are respectively degree modules developed based on different verification technologies. As a preferred implementation mode, the second permission verification module is a program module implemented based on Jupyter source code, wherein Jupyter source code refers to program code written in Python programming language and JavaSpcript programming language. Specifically, the second permission verification module is a code module obtained by adding the logic code for verifying the second user password and the random verification identifier in the JupyterHub source code. It can be understood that the second permission verification module may refer to a code module obtained by adding a dual authentication method of "user password + token" to the JupyterHub source code, and the token is a random verification identification code generation plug-in, and running the plug-in can generate a random verification identifier.

[0064] In an embodiment of the present application, the third permission verification module is a Spark cluster permission verification module, or a permission verification module of other data clusters, wherein the Spark cluster is a data cluster implemented based on Spark technology, and the essence of Spark technology is a memory-based distributed computing framework. In an embodiment of the present application, the connection between the second permission verification module and the third permission verification module for data verification can be regarded as a verification scheme for data verification using Jupyter to connect to the Spark cluster. Based on this, in an embodiment of the present application, the third permission verification module provides a series of data interfaces (such as API data interfaces), and the second permission verification module and the third permission verification module communicate with each other through the API data interface provided by the third permission verification module.

[0065] In an embodiment of the present application, the data warehouse security management system also includes a user interaction interface, in which business users can enter various types of information required for permission verification. As an implementation method, the user interaction interface is an interaction interface of an independent software platform, and the user interaction interface can be opened by opening the software platform. As another implementation method, the user interaction interface is only a web page interface, which can be opened by clicking an HTTP link.

[0066] In an embodiment of the present application, there is a mutual calling relationship between the first permission verification module, the second permission verification module and the third permission verification module in the data warehouse security management system and the user interaction interface. When the user clicks to enter the first login information in the user interaction interface, the first permission verification module will be automatically called, and the corresponding first login information will be passed to the first permission verification module, so that the first permission verification module performs the first permission verification based on the passed in first login information.

[0067] The first login information may specifically be a simple user name and user password. In the embodiment of the present application, different business users have different user names. The user password of each business user may be a fixed password set by the business user himself, or a random password regularly generated by the data warehouse security management system for each business user. The first permission verification module may use the user name entered by the user as an index basis to obtain the real and accurate user password of the business user from the password book stored in the back end, and then perform a consistency check between the real and accurate user password read and the user password entered by the user. If they are consistent, the first permission verification module passes the verification. If they are inconsistent, a verification failure prompt message is output to prompt the business user that the user password or user name is inaccurate.

[0068] In an embodiment of the present application, after the first permission verification module passes the verification, the second permission verification module will be automatically called, and the verification interface corresponding to the second permission verification module will be automatically loaded and jumped on the user interaction interface, so that the business user can enter the second login information in the verification interface. The second permission verification module as described above is a code module obtained by adding the second user password and the random verification identifier verification method to the JupyterHub source code. Based on this, the second permission verification is used to send a target link application message to the preset verification platform, so that after receiving the target link application message, the preset verification platform pushes the random verification identifier to the target contact information corresponding to the business user based on the locally pre-stored business user contact information list, and returns the random verification identifier to the second permission verification module;

[0069] Receive the random verification identifier input by the business user and the random verification identifier returned by the preset verification platform, and compare them. If they are consistent, the random verification identifier in the second login information is verified successfully; if they are inconsistent, the random verification identifier in the second login information is verified unsuccessfully.

[0070] In the embodiment of the present application, the preset verification platform can be a verification function platform preset within an organization, institution or enterprise. As an example, the preset verification platform is a function platform for generating a 6-digit random verification code pre-developed within the enterprise. Among them, the preset verification platform opens a specific network communication port to the data warehouse security management system, and the second authority verification module can send a target link application message to the verification function platform through the specific network communication port. The target link application message can be an HTTP link request. When the business user clicks on the random verification mark verification in the user interface of the data warehouse security management system, the HTTP link request will be automatically generated, and then the request will be sent through the specific network communication port to apply for a random verification mark from the verification function platform.

[0071] After receiving the application message, the preset verification platform will randomly generate a random verification identifier, such as a 6-digit random verification code, and then send the random verification code back to the second permission verification module and the corresponding target contact information of the business user. As an implementation method, the preset verification platform can set the validity period of the generated random verification code. After the validity period expires, the currently generated random verification code will become invalid, and the business user needs to reapply for the random verification identifier a second time.

[0072] Among them, the second permission verification module will pre-store the contact information reserved by the business user locally and generate a contact list of the business user, such as pre-storing the mobile phone number of each business user, and then push the 6-digit random verification code to the corresponding target contact information in the business user contact list via SMS.

[0073] In some embodiments, the third permission verification module is a Spark cluster permission verification module, which is specifically used to:

[0074] Obtaining the personal identity of the business user, and obtaining the user group to which the business user belongs through a preset interface service;

[0075] Creating a Spark connection with the user group to which the business user belongs, verifying the user group to which the business user belongs, and if the verification passes, opening the business user with access rights to the data that the business user applies to access, includes:

[0076] The user group to which the business user belongs is verified, and if the verification passes, the Spark connection permission corresponding to the user group to which the business user belongs is opened to the business user.

[0077] The third permission verification module is a permission verification module of the Spark cluster, and its core is to perform another permission verification on the data access of the Spark cluster. The third permission verification module is a program module obtained by optimizing and improving the permission verification module of the existing Spark cluster. As an implementation method, the third permission verification module can be obtained by modifying the source code of the permission verification module of the existing Spark cluster. Exemplarily, the task startup script in the bin directory of the Spark cluster can be modified to add the following execution logic:

[0078] 1) Obtain the personal identity of the accessed service user, specifically by setting up an interface service to obtain the personal identity of the service user and the corresponding user group identity. At this time, this interface service is a preset interface service, which can be used to obtain the user group information to which the service user belongs and verify the user group to which the service user belongs.

[0079] 2) Specify a specific Spark driver port number, where the driver port number is a port number within a preset port number range, and is used to drive the corresponding machine device in the Spark cluster to respond to the data request of the business user. As another possible implementation, the data transmitted by the driver port number can be obtained to perform security supervision on the data request of the business user.

[0080] 3) Create a Spark connection with the user group to which the business user belongs, and verify the user group to which the business user belongs. As an example, the user group information recorded in the preset interface service and the user group information of the business user received by the preset interface service can be verified to determine whether it is a user group that is allowed to access. If so, the business user is given access to the data to which the business user applies for access. In other words, if the user group to which the business user belongs passes the verification, the Spark connection permission corresponding to the user group to which the business user belongs is given to the business user. If not, the Spark cluster is refused to continue to be used, specifically, the Spark connection permission corresponding to the user group to which the business user belongs is not given to the business user.

[0081] Specifically, the data warehouse can use Hive (a data warehouse data management tool) for data management, which is to map structured data files into data tables, each data table is bound to only one user group, and the data is stored in HDFS (Hadoop Distributed File System), which is stored in the form of folders that distinguish user groups. When a business user needs to access the data table, the user group to which he belongs needs to pass verification before he can access the data table of the business department to which the business user belongs, otherwise he cannot access it. As an implementation method, during the creation of a Spark connection, user group information can be obtained, and then the permissions of the data tables in the data warehouse can be controlled based on the user group information.

[0082] In the embodiment of the present application, the backend data warehouse can be classified and managed through Spark cluster technology. Specifically, different business departments have different data warehouse spaces, and each business department cannot obtain data from other business departments across spaces. In the embodiment of the present application, business users of different business departments are divided into different user groups, and then the user groups to which the business users belong are verified, which can prevent business users from obtaining data from other business departments across business departments, thereby causing data leakage, and further ensure the data security in the data warehouse.

[0083] In the embodiment of the present application, the Spark cluster can also be replaced by other similar clusters, such as the Presto cluster. In addition, the division of user groups in the embodiment of the present application is based on business departments, and can also be divided into different granularities in combination with its own usage scenarios, thereby achieving security management of different granularities.

[0084] In some embodiments, the system further includes: a desktop cloud virtual machine, which is used to obtain the behavior data of the business user and perform security monitoring on the data uploaded or downloaded by the business user. The desktop cloud virtual machine is a virtual machine pre-installed in the target machine device, which can monitor the data uploaded or downloaded by the business user, thereby avoiding malicious traffic attacks on the back-end data warehouse.

[0085] In a second aspect, the present application provides a data warehouse security management method, which is applied to any electronic device with a data warehouse security management function, including but not limited to a personal mobile terminal, a computer or a server, etc. As an implementation method, the data warehouse security management method is applied to the data warehouse security management system provided in the first aspect of the present application.

[0086] In some embodiments, the present application Figure 2 As shown, the method comprises the following steps:

[0087] S21. Obtain and verify first login information input by a business user, wherein the first login information includes: a user name and a first user password;

[0088] S22, after the first login information is verified, obtaining and verifying the second login information input by the business user, wherein the second login information includes: a second user password and a random verification identifier, wherein the random verification identifier is a random verification code generated based on the target link;

[0089] S23: After the second login information is verified, the user group to which the business user belongs is verified. If the verification is successful, the access rights of the data that the business user has applied to access are opened to the business user.

[0090] Wherein step S21 is implemented by the above-mentioned first permission verification module, step S22 is implemented by the above-mentioned second permission verification module, and step S23 is implemented by the above-mentioned third permission verification module. The specific implementation process can refer to the relevant introduction of the first aspect, which will not be repeated here.

[0091] As a possible application scenario, the data warehouse security management system provided by the embodiment of the present application can be as follows: Figure 3 Specifically shown include:

[0092] Desktop cloud system, model platform module, Jupyter dual security authentication module, Spark cluster permission authentication module, among which the Spark cluster permission authentication module is connected to the backend data warehouse to control the access to data sent to the data warehouse. Among them:

[0093] The model platform module corresponds to the above-mentioned first permission verification module, which is used as the entrance for business users to perform data analysis operations. Authorization is required before logging into the model platform, specifically through the user name and user password in the first login information for login verification.

[0094] The Jupyter dual security authentication module corresponds to the second permission verification module mentioned above. It is used to log in to Jupyter, mainly using password + token dual authentication.

[0095] The Spark cluster authorization module corresponds to the third authorization verification module mentioned above. It is used for authorization supervision and security control, where authorization supervision is based on the business group to which the business user belongs, and security control is based on the IP port number bound between Jupyter and the Spark cluster for directional IP communication.

[0096] When business users finally access the data warehouse, they can verify their identities through the user groups they belong to. Those who fail the verification cannot read the data. In this way, multiple security reinforcement authentication can be implemented in scenarios with high security requirements to avoid data leakage caused by the theft of business user identities. In addition, user behavior can be globally monitored through the desktop cloud system to prevent business users from touching the security red line and ensure that data will not be leaked through the network.

[0097] Among them, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with the relevant laws and regulations and do not violate public order and good morals.

[0098] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0099] In a third aspect, the exemplary embodiments of the present application further provide an electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication. The memory stores a computer program that can be executed by the at least one processor, and the computer program is used to enable the electronic device to perform a method according to an embodiment of the present application when executed by the at least one processor.

[0100] The exemplary embodiment of the present application further provides a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to perform a method according to an embodiment of the present application.

[0101] The exemplary embodiments of the present application further provide a computer program product, including a computer program, wherein when the computer program is executed by a processor of a computer, it is used to enable the computer to execute the method according to the embodiment of the present application.

[0102] refer to Figure 4 , the structural block diagram of the electronic device 400 that can be used as the server or client of the present application will now be described, which is an example of the hardware device that can be applied to various aspects of the present application. The electronic device is intended to represent various forms of digital electronic computer equipment, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples, and are not intended to limit the implementation of the present application described and / or required herein.

[0103] like Figure 4 As shown, the electronic device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the electronic device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0104] A plurality of components in the electronic device 400 are connected to the I / O interface 405, including: an input unit 406, an output unit 407, a storage unit 408, and a communication unit 409. The input unit 406 may be any type of device capable of inputting information to the electronic device 400, and the input unit 406 may receive input digital or character information, and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 407 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 408 may include, but is not limited to, a disk, an optical disk. The communication unit 409 allows the electronic device 400 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0105] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above. For example, in some embodiments, the aforementioned data warehouse security management method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 400 via the ROM 402 and / or the communication unit 409. In some embodiments, the computing unit 401 may be configured to perform the aforementioned data warehouse security management method by any other appropriate means (e.g., by means of firmware).

[0106] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0107] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0108] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0109] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0110] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0111] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.

Claims

1. A data warehouse security management system, characterized in that: The data warehouse security management system is pre-installed in a target machine device, wherein the target machine device is not connected to an external network, and the system includes: A first permission verification module is used to obtain and verify first login information input by a business user, wherein the first login information includes: a user name and a first user password; A second permission verification module is used to obtain and verify the second login information input by the business user after the first login information is verified, wherein the second login information includes: a second user password and a random verification identifier, wherein the random verification identifier is a random verification code generated based on the target link; The third permission verification module is used to verify the user group to which the business user belongs after the second login information is verified. If the verification is passed, the access permission of the data applied for by the business user is opened to the business user.

2. The system according to claim 1, characterized in that The target machine device is disconnected from the external network in the following manner: Disconnect the network port connection with the external network, turn on the network firewall, and open a preset port range, wherein the preset port range is used to connect the second permission verification module with the third permission verification module to achieve directional IP communication between the second permission verification module and the third permission verification module.

3. The system according to claim 2, characterized in that The second permission verification module is further used for: Sending a target link application message to a preset verification platform, so that after receiving the target link application message, the preset verification platform pushes the random verification identifier to the target contact information corresponding to the business user based on the locally pre-stored business user contact information list, and returns the random verification identifier to the second permission verification module; Receive the random verification identifier input by the business user and the random verification identifier returned by the preset verification platform, and compare them. If they are consistent, the random verification identifier in the second login information is verified successfully; if they are inconsistent, the random verification identifier in the second login information is verified unsuccessfully.

4. The system according to claim 1, characterized in that The second permission verification module is a code module obtained by adding logic code for verifying the second user password and the random verification identifier in the JupyterHub source code.

5. The system according to claim 1, characterized in that The third permission verification module is a Spark cluster permission verification module, which is specifically used for: Obtaining the personal identity of the business user, and obtaining the user group to which the business user belongs through a preset interface service; Creating a Spark connection with the user group to which the business user belongs, verifying the user group to which the business user belongs, and if the verification passes, opening the business user with access rights to the data that the business user applies to access, includes: The user group to which the business user belongs is verified, and if the verification passes, the Spark connection permission corresponding to the user group to which the business user belongs is opened to the business user.

6. The system according to claim 1, characterized in that The system also includes: a desktop cloud virtual machine, which is used to obtain the behavior data of the business user and perform security monitoring on the data uploaded or downloaded by the business user.

7. A data warehouse security management method, characterized in that: The method is applied to a data warehouse security management system, the data warehouse security management system is pre-installed in a target machine device, wherein the target machine device is not connected to an external network, and the method includes: Obtaining first login information input by a business user and verifying it, wherein the first login information includes: a user name and a first user password; After the first login information is verified, the second login information input by the business user is obtained and verified, wherein the second login information includes: a second user password and a random verification identifier, wherein the random verification identifier is a random verification code generated based on the target link; After the second login information is verified, the user group to which the business user belongs is verified. If the verification is successful, the access rights to the data that the business user has applied to access are opened to the business user.

8. The method according to claim 7, characterized in that The method further comprises: Sending a target link application message to a preset verification platform, so that after receiving the target link application message, the preset verification platform pushes the random verification identifier to the target contact information corresponding to the business user based on the locally pre-stored business user contact information list, and returns the random verification identifier; Receive the random verification identifier input by the service user and the random verification identifier returned by the preset verification platform, and compare them. If they are consistent, the random verification identifier in the second login information passes the verification; if they are inconsistent, the random verification identifier in the second login information fails the verification; Obtaining the personal identity of the business user, and obtaining the user group to which the business user belongs through a preset interface service; Creating a Spark connection with the user group to which the business user belongs, verifying the user group to which the business user belongs, and if the verification passes, opening the business user with access rights to the data that the business user applies to access, includes: The user group to which the business user belongs is verified, and if the verification passes, the Spark connection permission corresponding to the user group to which the business user belongs is opened to the business user.

9. An electronic device, characterized in that: The electronic device comprises: Processor; and Memory for storing programs, The program comprises instructions, which, when executed by the processor, cause the processor to perform the method according to any one of claims 7 to 8.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to make a computer execute the method according to any one of claims 7-8.

Images