Permission processing method and device, equipment and medium

Abstract

The embodiment of the invention provides a permission processing method and device, equipment and a medium. The method specifically comprises the steps that a user request is received; processing the user request to obtain a processing result corresponding to the user request; automatically executing permission processing of a second data resource of the database file system component under the condition that the user request relates to permission processing of the first data resource of the database component; and outputting a processing result. Establishing connection with an authority control server according to the client information; the client side information comprises address information of the authority control server side and an account number and a password of a management user; according to the processing logic of the user request, determining a target interface corresponding to the user request at the authority control server, and determining a call request corresponding to the target interface; and sending a calling request corresponding to the target interface to the authority control server by using the connection. According to the embodiment of the invention, the authority control efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to a permission processing method, device, equipment and medium. Background Art

[0002] In the field of big data technology, distributed system architectures such as Hadoop have been widely used in the processing of big data. Permission control is the process of authorizing users, groups, and computers to access data in a big data environment. Its functions include: controlling the use rights of data resources, allowing authorized users to access corresponding data resources, and denying unauthorized users access to corresponding data resources.

[0003] Ranger is a permission control framework for big data, which can connect to multiple preset components in the distributed system architecture and control the access rights of the corresponding data resources of the preset components. In the permission processing methods of the prior art, permission control frameworks such as Ranger usually provide a console interface, and users with administrator roles (hereinafter referred to as management users) can implement user management and permission control functions through the console interface.

[0004] Take the Add User function in the User Management function as an example. Figure 1 , shows a flow chart of a method for adding a user in the prior art, the method is used to add user A, and the method specifically includes the following steps:

[0005] Step 101, the management user enters the user management interface;

[0006] Step 102: The management user checks whether user A exists in the user management interface. If not, step 103 is executed. If yes, a prompt message indicating that the user already exists is returned.

[0007] Step 103, the management user enters the user adding interface;

[0008] Step 104: The management user fills in the user related information in the user adding interface;

[0009] Step 105: The management user saves the user-related information and completes the addition of user A.

[0010] Take the permission control function as an example, refer to Figure 2 , shows a flow chart of the steps of adding read permission of data resource X to user A in the prior art, the method specifically includes the following steps:

[0011] Step 201: The management user enters the policy viewing interface;

[0012] Step 202: The management user checks in the policy viewing interface whether there is an existing policy corresponding to the read permission of data resource X. If so, execute step 203; otherwise, execute step 204;

[0013] Step 203: The management user enters the policy editing interface corresponding to the existing policy and adds user A to the user list in the policy editing interface;

[0014] Step 204: The management user creates a new policy, which is used to indicate that user A has read permission for data resource X.

[0015] Whether Figure 1 Add user method shown, or Figure 2 In the authority control method shown, the management user needs to perform a large number of operations on multiple interfaces. Therefore, the prior art has the problem of low authority processing efficiency. Summary of the invention

[0016] The embodiment of the present application provides a permission processing method, which can improve the accuracy of permission control.

[0017] Correspondingly, the embodiments of the present application also provide a permission processing device, an electronic device and a machine-readable medium to ensure the implementation and application of the above method.

[0018] In order to solve the above problems, the embodiment of the present application discloses a permission processing method, which is applied to a client of a third-party permission program, and the method includes:

[0019] Receive user requests;

[0020] Processing the user request to obtain a processing result corresponding to the user request; automatically executing permission processing of a second data resource of a database file system component when the user request involves permission processing of a first data resource of a database component; wherein the first data resource and the second data resource correspond to the same data table;

[0021] Outputting the processing result;

[0022] The processing of the user request includes:

[0023] Establish a connection with the authority control server according to the client information; the client information includes: the address information of the authority control server, the account number and password of the management user;

[0024] According to the processing logic of the user request, determine the target interface corresponding to the user request on the authority control server, and determine the call request corresponding to the target interface:

[0025] By utilizing the connection, a call request corresponding to the target interface is sent to the authority control server to obtain a processing result corresponding to the user request.

[0026] The embodiment of the present application also discloses a permission processing device, which is applied to a client of a third-party permission program, and the device includes:

[0027] A request receiving module, used for receiving user requests;

[0028] A request processing module, used to process the user request to obtain a processing result corresponding to the user request; when the user request involves permission processing of a first data resource of a database component, the permission processing of a second data resource of a database file system component is automatically performed; wherein the first data resource and the second data resource correspond to the same data table;

[0029] A result output module, used for outputting the processing result;

[0030] Wherein, the request processing module includes:

[0031] A connection module is used to establish a connection with the authority control server according to the client information; the client information includes: the address information of the authority control server, the account number and password of the management user;

[0032] The port and call request determination module is used to determine the target interface corresponding to the user request on the authority control server according to the processing logic of the user request, and to determine the call request corresponding to the target interface:

[0033] The calling module is used to use the connection to send a calling request corresponding to the target interface to the authority control server to obtain a processing result corresponding to the user request.

[0034] The embodiment of the present application further discloses an electronic device, including: a processor; and a memory, on which executable code is stored. When the executable code is executed, the processor executes the method described in the embodiment of the present application.

[0035] The embodiment of the present application further discloses a machine-readable medium on which executable code is stored. When the executable code is executed, a processor executes the method described in the embodiment of the present application.

[0036] The embodiments of the present application include the following advantages:

[0037] In the technical solution of the embodiment of the present application, the client of the third-party permission program can automatically determine the target interface corresponding to the user request on the permission control server, and the call request corresponding to the target interface, and automatically send the call request to the permission control server to obtain the processing result corresponding to the user request. Due to the application of the method of the embodiment of the present application, the user can obtain the corresponding processing result by submitting the user request; therefore, compared with the prior art of managing users to perform a large number of operations on multiple interfaces, the embodiment of the present application can save the user's operating costs, thereby improving the efficiency of permission processing.

[0038] Furthermore, since in the technical solution of the embodiment of the present application, the client information used by the client to establish a connection with the permission control server specifically includes: the account and password of the management user, this allows ordinary users (users different from the management user) to submit user requests to the client using the account and password of the management user, so the embodiment of the present application can reduce the burden on the management user.

[0039] Furthermore, in the embodiment of the present application, when a user requests permission processing of a first data resource of a database component, permission processing of a second data resource of a database file system component is automatically performed; wherein the first data resource and the second data resource correspond to the same data table. In this way, the embodiment of the present application can not only realize permission synchronization between the database component and the database file system component, but also save the operation cost of the database file system component corresponding to the permission, thereby further improving the efficiency of permission processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of steps of a method for adding a user in the prior art;

[0041] Figure 2 This is a flow chart of steps for adding read permissions for data resource X to user A in the prior art;

[0042] Figure 3 It is a schematic diagram of an application environment of a permission processing method according to an embodiment of the present application;

[0043] Figure 4 This is a schematic diagram of the steps of a permission processing method according to an embodiment of the present application;

[0044] Figure 5 This is a schematic diagram of the steps of a permission processing method according to an embodiment of the present application;

[0045] Figure 6 It is a schematic diagram of a permission processing method according to an embodiment of the present application;

[0046] Figure 7It is a flowchart of the steps of a method for processing a policy adding request according to an embodiment of the present application;

[0047] Figure 8 It is a structural diagram of a permission processing device according to an embodiment of the present application;

[0048] Fig. 9 It is a schematic diagram of the structure of a device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0050] The permission processing method of the embodiment of the present application can be used to control the access rights of data resources of various preset components in the distributed system architecture. Taking the distributed system architecture as Hadoop as an example, the preset components may include: database components, or database file system components, etc. Examples of database components may include: data warehouse components, etc. Examples of database file system components may include: HDFS (Hadoop Distributed File System) components, etc. It can be understood that the embodiment of the present application does not limit the specific preset components.

[0051] The embodiments of the present application can use the permission control framework of big data to control the access rights of data resources of various preset components in the distributed system architecture. The permission control framework of big data may include: Apache Sentry and Ranger, etc. It is understood that the embodiments of the present application are not limited to the specific permission management framework.

[0052] In the prior art permission processing methods, permission control frameworks such as Ranger usually provide a console interface, through which management users can implement functions such as user management and permission control. However, management users need to perform a large number of operations on multiple interfaces, so the prior art has the problem of low permission processing efficiency.

[0053] In view of the technical problem of low efficiency of permission processing in the prior art, an embodiment of the present application provides a permission processing method, which is applied to a client of a third-party permission program and may specifically include: receiving a user request; processing the user request to obtain a processing result corresponding to the user request; when the user request involves permission processing of a first data resource of a database component, automatically executing permission processing of a second data resource of a database file system component; wherein the first data resource and the second data resource correspond to the same data table; and outputting the processing result;

[0054] Among them, the process of processing the above-mentioned user request specifically includes: establishing a connection with the authority control server according to the client information; the above-mentioned client information includes: the address information of the authority control server, the account and password of the management user; according to the processing logic of the user request, determining the target interface corresponding to the above-mentioned user request on the authority control server, and determining the call request corresponding to the above-mentioned target interface: using the above-mentioned connection, sending the call request corresponding to the above-mentioned target interface to the above-mentioned authority control server to obtain the processing result corresponding to the above-mentioned user request.

[0055] An embodiment of the present application provides a permission processing method for a client of a third-party permission program. The client can establish a connection with a permission control server based on client information during the processing of a user request, determine the target interface corresponding to the user request on the permission control server based on the processing logic of the user request, and determine the call request corresponding to the target interface: use the connection to send the call request corresponding to the target interface to the permission control server to obtain the processing result corresponding to the user request.

[0056] In the embodiment of the present application, the client of the third-party permission program can automatically determine the target interface corresponding to the user request on the permission control server, and the call request corresponding to the target interface, and automatically send the call request to the permission control server to obtain the processing result corresponding to the user request. Due to the application of the method of the embodiment of the present application, the user can obtain the corresponding processing result by submitting the user request; therefore, compared with the prior art of managing users to perform a large number of operations on multiple interfaces, the embodiment of the present application can save the user's operating costs, thereby improving the efficiency of permission processing.

[0057] Furthermore, since in the technical solution of the embodiment of the present application, the client information used by the client to establish a connection with the permission control server specifically includes: the account and password of the management user, this allows ordinary users (users different from the management user) to submit user requests to the client using the account and password of the management user, so the embodiment of the present application can reduce the burden on the management user.

[0058] refer to Figure 3 , showing a schematic diagram of the application environment of the permission processing method of an embodiment of the present application, wherein the client 301 of the third-party permission program and the permission control server 302 are located in a wired or wireless network, through which the client 301 and the permission control server 302 perform data interaction.

[0059] In actual applications, the client 301 can receive user requests and process the user requests.

[0060] Among them, during the processing of user requests, the client 301 can establish a connection with the permission control server 302 based on the client information, and determine the target interface corresponding to the above user request on the permission control server according to the processing logic of the user request, and determine the call request corresponding to the above target interface: using the above connection, send the call request corresponding to the above target interface to the above permission control server to obtain the processing result corresponding to the above user request.

[0061] The authority control server 302 can process the call request corresponding to the target interface to obtain the corresponding call result. Accordingly, the client 301 can determine the processing result corresponding to the user request according to the call result.

[0062] Method Example 1

[0063] refer to Figure 4 , shows a schematic flow chart of the steps of a permission processing method according to an embodiment of the present application. The method can be applied to a client of a third-party permission program, and specifically may include the following steps:

[0064] Step 401: receiving a user request;

[0065] Step 402: Process the user request to obtain a processing result corresponding to the user request; if the user request involves permission processing of a first data resource of a database component, automatically perform permission processing of a second data resource of a database file system component; wherein the first data resource and the second data resource correspond to the same data table;

[0066] Step 403: output the above processing results;

[0067] The process of processing the user request in step 402 specifically includes:

[0068] Step 421: Establish a connection with the authority control server according to the client information; the client information includes: address information of the authority control server, account number and password of the management user;

[0069] Step 422: According to the processing logic of the user request, determine the target interface corresponding to the user request on the authority control server, and determine the call request corresponding to the target interface:

[0070] Step 423: Using the connection, send a call request corresponding to the target interface to the permission control server to obtain a processing result corresponding to the user request.

[0071] Figure 4 The method shown can be used to process permission-related user requests. Figure 4At least one step included in the method shown can be executed by a client of a third-party permission program. The third-party permission program can be an application program different from the permission control framework. It can be understood that the embodiments of the present application are not limited to specific third-party permission programs.

[0072] In step 401, the user request may be a real-time request submitted by a client user, or a historical request submitted by a client user within a period of time, wherein the number of the historical requests may be one or more.

[0073] The client user may be a user of a client that uses a third-party permission program. The client user may be an ordinary user (different from the user of the management user), and the client user may submit a user request to the client using the account and password of the management user, without requiring the management user to personally operate the client. In this way, the embodiments of the present application can improve the convenience and efficiency of permission processing. For example, in an application scenario with high timeliness requirements, it may be inconvenient for the management user to operate the client, while an ordinary user may use the account and password of the management user and the method of the embodiments of the present application to implement the processing of user requests.

[0074] Before processing the user request in step 402 , the client may review the user request to obtain a corresponding review result, and send the user request with a review result of passed to step 402 .

[0075] Auditing user requests can be used to audit the security of user requests to avoid processing user requests with security risks (not meeting security conditions). Those skilled in the art can determine security conditions based on actual application requirements. For example, a security condition can be: the data resource corresponding to the user request does not involve sensitive data. The method for determining whether the data resource corresponding to the user request involves sensitive data can be determined by those skilled in the art based on actual application requirements. For example, it can be determined whether the data resource corresponding to the user request involves sensitive data based on the label of the data resource.

[0076] The process of processing the above user request in step 402 specifically includes: step 421 to step 423.

[0077] In step 421, a connection can be established with the authority control server based on the client information. The above-mentioned client information specifically includes: the address information of the authority control server, the account and password of the management user. Among them, the account and password of the management user facilitate the authority control server to verify the identity of the client. The address information of the authority control server can be: the URL (uniform resource locator) address or IP (Internet Protocol) address of the authority control server, etc., which is used to locate the authority control server that needs to be connected.

[0078] In step 422, according to the processing logic of the user request, the target interface corresponding to the user request on the permission control server is determined, and the call request corresponding to the target interface is determined. In a specific implementation, different user requests may correspond to target interfaces, and one user request may correspond to one or more target interfaces.

[0079] In step 423, the connection is used to send a call request corresponding to the target interface to the permission control server to obtain a processing result corresponding to the user request. Accordingly, the client can determine the processing result corresponding to the user request based on the call result returned by the permission control server for the call request.

[0080] The embodiment of the present application can determine the target interface corresponding to the user request on the permission control server according to the processing logic of the user request, and use the above connection to send a call request corresponding to the above target interface to the above permission control server.

[0081] The embodiment of the present application can provide a specific technical solution for utilizing the above connection to send a call request corresponding to the above target interface to the above permission control server.

[0082] Technical solution 1,

[0083] Technical solution 1 is used to process the request to add a user.

[0084] In technical solution 1, the user request specifically includes: a user adding request, the user adding request may include relevant information of the user request, which specifically includes: a first user identifier requested to be added, and the target interface specifically includes: a user query interface;

[0085] The process of using the connection to send a call request corresponding to the target interface to the permission control server specifically includes:

[0086] Step A1: using the connection, sending a first call request corresponding to the user query interface to the authority control server; the first call request is used to query whether the first user identifier exists;

[0087] Step A2: receiving the first call result returned by the permission control server in response to the first call request;

[0088] Step A3: If the first call result is yes, then obtain the first processing result that already exists for the user;

[0089] Step A4: if the result of the first call is not present, the target interface further includes: a user creation interface, using the connection to send a second call request corresponding to the user creation interface to the authority control server; the second call request is used to create the first user identifier;

[0090] Step A5: Determine the second processing result corresponding to the add user request according to the second calling result corresponding to the second calling request.

[0091] In an embodiment of the present application, the processing logic for adding a user request is specifically as follows: query the authority control server whether there is a first user identifier requested to be added; if there is a first user identifier requested to be added, it can directly return: the first processing result that the user already exists; if there is no first user identifier requested to be added, a new first user identifier is created.

[0092] According to the processing logic of adding a user request, the embodiment of the present application can first execute step A1, using the above connection, to send the first call request corresponding to the above user query interface to the above permission control server; then execute step A2 to receive the first call result returned by the above permission control server for the above first call request. Then, different processing can be performed according to different first call results. The first call request can include: information such as the first user identifier.

[0093] For example, if the first call result is present, step A3 may be executed to return to the user: the first processing result that already exists for the user. Specifically, the client may display the first processing result that already exists for the user in a pop-up window manner.

[0094] For another example, if the result of the first call is that the user does not exist, step A4 can be executed. In this case, the target interface can also include: a user creation interface, and the client can use the connection to send a second call request corresponding to the user creation interface to the permission control server; the second call request is used to create the first user ID. The second call request can include: the first user ID and other information.

[0095] Step A5 can determine the second processing result corresponding to the above-mentioned add user request based on the second call result corresponding to the above-mentioned second call request. Specifically, if the second call result is that the user is created successfully, the second processing result of successful user addition can be returned to the user. Alternatively, if the second call result is that the user is created unsuccessfully, the second processing result of failed user addition can be returned to the user. Of course, in the case where the second call result is that the user is created unsuccessfully, the second call request corresponding to the above-mentioned user creation interface can continue to be sent to the above-mentioned permission control server until the second call result of successful user creation is obtained.

[0096] In technical solution 1, the first user identifier requested to be added may be a type of user identifier. The user identifier may be an account of the user on the authority control server, and the user identifier may be used as a basis for granting rights to the user.

[0097] Technical solution 2,

[0098] Technical solution 2 is used to process policy addition requests.

[0099] In technical solution 2, the user request specifically includes: a policy adding request, the policy adding request may include relevant information of the user request, which specifically includes: a second user identifier, first data resource information and operation authority information, and the target interface specifically includes: a policy query interface corresponding to the first data resource information;

[0100] The process of using the connection to send a call request corresponding to the target interface to the permission control server specifically includes:

[0101] Step B1: using the connection, sending a third call request corresponding to the policy query interface to the authority control server; the third call request is used to query whether a policy corresponding to the second user identifier, the first data resource information and the operation authority information exists;

[0102] Step B2: receiving the third call result returned by the permission control server in response to the third call request;

[0103] Step B3: If the third call result is yes, then obtain the third processing result that the policy already exists;

[0104] Step B4: if the third call result is not present, the target interface may further include: a policy creation interface, using the connection to send a fourth call request corresponding to the policy creation interface to the authority control server;

[0105] Step B5: Determine the fourth processing result corresponding to the policy adding request according to the fourth calling result corresponding to the fourth calling request.

[0106] In the embodiment of the present application, a policy adding request is used to grant a certain permission to a certain user. The processing logic of the policy adding request is as follows: first, query the permission control server whether there is a first existing policy corresponding to the second user identifier, the first data resource information and the operation permission information. If the first existing policy already exists, it can directly return: the third processing result that the policy already exists; if the first existing policy does not exist, create a first new policy.

[0107] According to the processing logic of the policy addition request, the embodiment of the present application can first execute step B1, and use the above connection to send the third call request corresponding to the above policy query interface to the above permission control server; then execute step B2 to receive the third call result returned by the above permission control server for the above third call request. Then, different processing can be performed according to different third call results. The third call request may include: the second user identifier, the first data resource information, and the operation permission information. The second user identifier may represent the user requesting authorization. The first data resource may represent the requested data resource. Operation permissions may include: read permission, or write permission, etc.

[0108] For example, if the third call result is existence, step B3 may be executed to return to the user: the third processing result that the policy already exists. Specifically, the client may display the third processing result that the policy already exists in a pop-up window.

[0109] For another example, if the third call result is not present, step B4 can be executed. In this case, the target interface can also include: a policy creation interface, and the client can use the connection to send a fourth call request corresponding to the policy creation interface to the permission control server; the fourth call request is used to create a first new policy corresponding to the second user identifier, the first data resource information, and the operation permission information. The second call request can include: the second user identifier, the first data resource information, the operation permission information, and other information.

[0110] Step B5 can determine the fourth processing result corresponding to the above-mentioned add user request based on the fourth call result corresponding to the above-mentioned fourth call request. Specifically, if the fourth call result is that the first new policy is successfully created, then the fourth processing result of successful authorization can be returned to the user. Alternatively, if the fourth call result is that the first new policy creation fails, then the fourth processing result of failed authorization can be returned to the user. Of course, in the case where the fourth call result is that the first new policy creation fails, the fourth call request corresponding to the above-mentioned policy creation interface can continue to be sent to the above-mentioned permission control server until the fourth call result of successful creation of the first new policy is obtained.

[0111] In technical solution 2, the first data resource information may be: data resources corresponding to any preset component in the distributed system architecture. Examples of preset components may include: database components, or database file system components, etc.

[0112] The inventor of this application discovered the following rules between the database component and the database file system component during research: the data warehouse component itself does not store data, and the data storage of the data warehouse component depends on the HDFS component. The permissions corresponding to the data warehouse component are usually permissions for data resources such as data tables, while the permissions corresponding to the HDFS component are usually permissions for data resources such as storage files of data tables.

[0113] The embodiment of the present application creatively binds the permissions corresponding to the database component with the permissions corresponding to the database file system component according to the rules between the database component and the database file system component. When a user requests permission processing of a first data resource of the database component, permission processing of a second data resource of the database file system component is automatically executed; wherein the first data resource and the second data resource correspond to the same data table.

[0114] Specifically, after the first permission of the first data resource of the database component is granted to the user, the second permission of the second data resource of the database file system component is automatically granted to the user. Similarly, after the first permission of the first data resource of the database component is revoked from the user side, the second permission of the second data resource of the database file system component is automatically revoked from the user side.

[0115] There may be a corresponding relationship between the data table corresponding to the first data resource and the data table file corresponding to the second data resource, and the corresponding relationship specifically means that the two represent the same data table.

[0116] In the embodiment of the present application, the database path, database name and data table name included in the first data resource information can be concatenated to obtain the second data resource information. For example, if the database path is: Hive warehouse path, and the database name is: database.db, then the concatenated path of the second data resource is: Hive warehouse path / database.db / table name.

[0117] Therefore, in the case where the first data resource information corresponds to a database component, the target interface may also include: a policy query interface corresponding to the second data resource information; the second data resource information is used to characterize the data resource corresponding to the first data resource information on the database file system component; the policy query interface and the policy query interface are both used to query the policy corresponding to the second user identifier, but the policy query interface corresponds to the first data resource information, while the policy query interface corresponds to the second data resource information. Since the first data resource information corresponds to the database component, the policy query interface corresponds to the database component. Since the second data resource information corresponds to the database file system component, the policy query interface corresponds to the database file system component.

[0118] The process of using the connection to send the call request corresponding to the target interface to the permission control server may also include:

[0119] Step B6: using the connection, sending a fifth call request corresponding to the policy query interface to the authority control server; the fifth call request is used to query whether a policy corresponding to the second user identifier, the second data resource information and the operation authority information exists;

[0120] Step B7, receiving the fifth call result returned by the permission control server in response to the fifth call request;

[0121] Step B8: If the fifth calling result is yes, then a fifth processing result is obtained that the policy of the second data resource information already exists;

[0122] Step B9: If the fifth call result is not present, the target interface further includes: a policy creation interface, using the connection to send a sixth call request corresponding to the policy creation interface to the authority control server;

[0123] Step B10: Determine the sixth processing result corresponding to the policy adding request according to the sixth calling result corresponding to the sixth calling request.

[0124] Among them, step B6 is used to query whether there is a second existing policy corresponding to the second user identifier, the second data resource information and the operation permission information on the permission control server. If the second existing policy already exists, it can directly return: the fifth processing result that the second existing policy already exists; if the second existing policy does not exist, create a second new policy. One difference between the second new policy and the first new policy is: different data resources, or different preset components corresponding to the data resources.

[0125] Step B7 is used to receive the fifth call result returned by the permission control server in response to the fifth call request.

[0126] Step B8 is used to obtain the fifth processing result that the policy of the second data resource information already exists when the fifth calling result is yes. In this case, the fifth processing result can be prompted to the user.

[0127] Step B9 is used to send a sixth call request corresponding to the policy creation interface to the permission control server by using the connection when the fifth call result is non-existent.

[0128] Step B10 is used to determine the sixth processing result corresponding to the above-mentioned policy adding request according to the sixth call result corresponding to the above-mentioned sixth call request. Specifically, if the sixth call result is that the second new policy is successfully created, then the sixth processing result of the successful creation of the second new policy can be returned to the user. Alternatively, if the sixth call result is that the second new policy fails to be created, then the sixth processing result of the failure to create the second new policy can be returned to the user. Of course, in the case where the sixth call result is that the second new policy fails to be created, the sixth call request corresponding to the above-mentioned policy creation interface can continue to be sent to the above-mentioned permission control server until the sixth call result of the successful creation of the second new policy is obtained.

[0129] In summary, Technical Solution 2 can not only process the policy addition request corresponding to any preset component to grant rights to the user, but also automatically grant the user the second permission of the second data resource of the database file system component after granting the user the first permission of the first data resource of the database component. In this way, the embodiment of the present application can not only realize the permission synchronization between the database component and the database file system component, but also save the operation cost of the corresponding permission of the database file system component, thereby further improving the efficiency of permission processing.

[0130] Technical solution 3,

[0131] Technical solution 3 is used to process the policy deletion request.

[0132] In technical solution 3, the user request specifically includes: a policy deletion request, and the policy deletion request may include relevant information of the user request, which specifically includes: a third user identifier, third data resource information, and operation authority information, and the target interface specifically includes: a policy query interface corresponding to the third data resource information. The third data resource information may be the same as or different from the first data resource information. The third user identifier may be the same as or different from the second user identifier.

[0133] The above-mentioned use of the above-mentioned connection to send a call request corresponding to the above-mentioned target interface to the above-mentioned permission control server may specifically include:

[0134] Step C1, using the connection, sending a seventh call request corresponding to the policy query interface to the authority control server; the seventh call request is used to query whether a policy corresponding to the third user identifier, the third data resource information and the operation authority information exists;

[0135] Step C2, receiving the seventh call result returned by the permission control server in response to the seventh call request;

[0136] Step C3: If the seventh call result is non-existent, a seventh processing result of non-existent policy is obtained;

[0137] Step C4: if the seventh call result is yes, the target interface further includes: a policy deletion interface, using the connection to send an eighth call request corresponding to the policy deletion interface to the authority control server;

[0138] Step C5: Determine the eighth processing result corresponding to the policy adding request according to the eighth calling result corresponding to the eighth calling request.

[0139] In the embodiment of the present application, the policy deletion request is used to delete a certain permission owned by the user. The processing logic of the policy deletion request is specifically as follows: first, query the permission control server whether there is a third existing policy corresponding to the third user identifier, the third data resource information and the operation permission information; if there is no third existing policy, it can directly return: the seventh processing result that the third existing policy does not exist; if there is a third existing policy, the third existing policy can be deleted.

[0140] According to the processing logic of the policy deletion request, the embodiment of the present application may first execute step C1, and use the above connection to send the seventh call request corresponding to the above policy query interface to the above permission control server; then execute step C2 to receive the seventh call result returned by the above permission control server for the above seventh call request. Then, different processing can be performed according to different seventh call results. The seventh call request may include information such as a third user identifier, third data resource information, and operation permission information. The third user identifier may represent the user requesting to delete the policy. The third data resource may represent the data resource corresponding to the policy requested to be deleted. Operation permissions may include: read permission, or write permission, etc.

[0141] For example, if the seventh call result is non-existent, step C3 can be executed to return to the user: the seventh processing result that the third existing policy does not exist. Specifically, the client can display the seventh processing result that the third existing policy does not exist in a pop-up window.

[0142] For another example, if the seventh call result is existence, step C4 can be executed. In this case, the target interface can also include: a policy deletion interface, and the client can use the connection to send an eighth call request corresponding to the policy deletion interface to the permission control server; the eighth call request is used to delete the third existing policy corresponding to the third user identifier, the third data resource information, and the operation permission information. The eighth call request can include: information such as the third user identifier, the third data resource information, and the operation permission information.

[0143] Step C5 can determine the eighth processing result corresponding to the above-mentioned policy deletion request based on the eighth call result corresponding to the above-mentioned eighth call request. Specifically, if the eighth call result is that the policy deletion is successful, then the eighth processing result of successful policy deletion can be returned to the user. Alternatively, if the eighth call result is that the policy deletion fails, then the eighth processing result of failed policy deletion can be returned to the user. Of course, in the case where the eighth call result is that the policy deletion fails, the eighth call request corresponding to the above-mentioned policy deletion interface can continue to be sent to the above-mentioned permission control server until the eighth call result of failed policy deletion is obtained.

[0144] The embodiment of the present application creatively binds the permissions corresponding to the database component with the permissions corresponding to the database file system component according to the rules between the database component and the database file system component. Specifically, after the third permission of the third data resource of the database component is recovered from the user, the fourth permission of the fourth data resource of the database file system component is automatically recovered from the user.

[0145] There may be a corresponding relationship between the data table corresponding to the third data resource and the data table file corresponding to the fourth data resource, and the corresponding relationship specifically means that the two represent the same data table.

[0146] In the embodiment of the present application, the database path, database name and data table name included in the third data resource information can be concatenated to obtain the fourth data resource information. For example, if the database path is: Hive warehouse path, and the database name is: database.db, then the concatenated path of the fourth data resource is: Hive warehouse path / database.db / table name.

[0147] Accordingly, the third data resource information corresponds to the database component; the target interface may further include: a policy query interface corresponding to the fourth data resource information; the fourth data resource information is used to characterize the data resource corresponding to the third data resource information on the database file system component;

[0148] The method of using the connection to send a call request corresponding to the target interface to the permission control server may further include:

[0149] Step C6: using the connection, sending a ninth call request corresponding to the policy query interface to the authority control server; the ninth call request is used to query whether a policy corresponding to the third user identifier, the fourth data resource information and the operation authority information exists;

[0150] Step C7, receiving the ninth call result returned by the permission control server in response to the ninth call request;

[0151] Step C8: If the ninth calling result is not present, a ninth processing result of the policy not present is obtained;

[0152] Step C9: if the ninth call result is yes, the target interface further includes: a policy deletion interface, using the connection to send a tenth call request corresponding to the policy deletion interface to the permission control server;

[0153] Step C10: Determine the tenth processing result corresponding to the policy deletion request according to the tenth calling result corresponding to the tenth calling request.

[0154] The implementation principles corresponding to steps C6 to C10 are similar to those of steps C1 to C5. They all first query the permission control server whether there is a fourth existing policy corresponding to the third user identifier, the fourth data resource information and the operation permission information. If there is no fourth existing policy, it can directly return: the ninth processing result that the fourth existing policy does not exist; if there is a fourth existing policy, the fourth existing policy can be deleted.

[0155] In summary, technical solution 3 can not only process the policy deletion request corresponding to any preset component to reclaim the permission from the user side, but also automatically reclaim the fourth permission of the fourth data resource of the database file system component from the user side after reclaiming the third permission of the third data resource of the database component from the user side. In this way, the embodiment of the present application can not only realize the permission synchronization between the database component and the database file system component, but also save the operation cost of the corresponding permission of the database file system component, thereby further improving the efficiency of permission processing.

[0156] In step 403, the processing result may be outputted in a pop-up window or voice format. It is to be understood that the embodiment of the present application does not limit the specific output format corresponding to the processing result.

[0157] In summary, in the permission processing method of the embodiment of the present application, the client of the third-party permission program can automatically determine the target interface corresponding to the user request on the permission control server, and the call request corresponding to the target interface, and automatically send the call request to the above permission control server to obtain the processing result corresponding to the above user request. Due to the application of the method of the embodiment of the present application, the user can obtain the corresponding processing result by submitting the user request; therefore, compared with the prior art of managing users to perform a large number of operations on multiple interfaces, the embodiment of the present application can save the user's operating costs, thereby improving the efficiency of permission processing.

[0158] Furthermore, since in the technical solution of the embodiment of the present application, the client information used by the client to establish a connection with the permission control server specifically includes: the account and password of the management user, this allows ordinary users (users different from the management user) to submit user requests to the client using the account and password of the management user, so the embodiment of the present application can reduce the burden on the management user.

[0159] Method Example 2

[0160] refer to Figure 5 , shows a schematic flow chart of the steps of a permission processing method according to an embodiment of the present application. The method can be applied to a client of a third-party permission program, and specifically may include the following steps:

[0161] Step 501: Provide a processing interface set corresponding to the user request; the processing interface in the processing interface set is used to call the target interface corresponding to the authority control server according to the processing logic of the user request to realize the processing of the user request;

[0162] Step 502: receiving a user request;

[0163] Step 503: Process the user request to obtain a processing result corresponding to the user request; if the user request involves permission processing of a first data resource of a database component, automatically perform permission processing of a second data resource of a database file system component; wherein the first data resource and the second data resource correspond to the same data table;

[0164] Step 504: output the above processing results;

[0165] The process of processing the user request in step 503 specifically includes:

[0166] Step 531: According to the relevant information of the user request, the target processing interface corresponding to the user request is obtained from the processing interface set; assuming that the user request is a request to add a user, the target processing interface corresponding to the add user request can be obtained from the processing interface set.

[0167] Step 532: Call the target processing interface, which is used to perform the following steps:

[0168] Step 5321: Establish a connection with the authority control server according to the client information; the client information includes: the address information of the authority control server, the account number and password of the management user;

[0169] Step 5322: According to the processing logic of the user request, determine the target interface corresponding to the user request on the authority control server, and determine the call request corresponding to the target interface:

[0170] Step 5323: Utilize the connection to send a call request corresponding to the target interface to the permission control server to obtain a processing result corresponding to the user request.

[0171] The embodiment of the present application may provide a processing interface set corresponding to the user request, and the above processing interface set may include: at least one processing interface corresponding to the user request. The processing interface in the above processing interface set can be used to call the target interface corresponding to the authority control server according to the processing logic of the user request to implement the processing of the user request. Therefore, the embodiment of the present application can call the target processing interface corresponding to the user request to implement the processing of the user request.

[0172] In a specific implementation, the embodiment of the present application can integrate the processing interface in the above processing interface set in SDK (Software Development Kit). SDK can play the role of encapsulating the target interface corresponding to the permission control server.

[0173] Reference Figure 6 , showing a schematic diagram of a permission processing method of an embodiment of the present application, wherein the client of a third-party permission program can call a software development kit, and the software development kit can use the target interface corresponding to the permission control server to operate the policy of the permission control server. The above-mentioned operation on the policy of the permission control server specifically includes: creating a new policy of the permission control server, or deleting the policy of the permission control server, etc. Of course, the software development kit can use the target interface corresponding to the permission control server to operate the user identifier of the permission control server, specifically, it can add users to the permission control server, etc. The client can use local Java methods to call the software development kit.

[0174] In a specific implementation, the above processing interface set may include: a first processing interface corresponding to a user add request, and / or a second processing interface corresponding to a policy add request, and / or a third processing interface corresponding to a policy delete request.

[0175] The first processing interface may be used to process a request to add a user, specifically to perform the following steps:

[0176] Using the connection, sending a first call request corresponding to the user query interface to the permission control server; the first call request is used to query whether the first user identifier exists;

[0177] Receive a first call result returned by the permission control server in response to the first call request;

[0178] If the first call result is yes, then the first processing result of the user already exists is obtained;

[0179] If the result of the first call is not present, the target interface further includes: a user creation interface, using the connection to send a second call request corresponding to the user creation interface to the permission control server; the second call request is used to create the first user identifier;

[0180] According to the second calling result corresponding to the second calling request, the second processing result corresponding to the adding user request is determined.

[0181] The second processing interface may be used to process the policy adding request, specifically to perform the following steps:

[0182] Using the connection, a third call request corresponding to the policy query interface is sent to the permission control server; the third call request is used to query whether a policy corresponding to the second user identifier, the first data resource information and the operation permission information exists;

[0183] Receive a third call result returned by the permission control server in response to the third call request;

[0184] If the third call result is yes, then the third processing result that the policy already exists is obtained;

[0185] If the third call result is not present, the target interface further includes: a policy creation interface, using the connection to send a fourth call request corresponding to the policy creation interface to the permission control server;

[0186] According to the fourth calling result corresponding to the fourth calling request, the fourth processing result corresponding to the policy adding request is determined.

[0187] In the case where the first data resource information corresponds to a database component, the target interface may further include: a policy query interface corresponding to the second data resource information; the second data resource information is used to characterize the data resource corresponding to the first data resource information on the database file system component; the second processing interface may also allow the user to perform the following steps:

[0188] Using the connection, sending a fifth call request corresponding to the policy query interface to the permission control server; the fifth call request is used to query whether the policy corresponding to the second user identifier, the second data resource information and the operation permission information exists;

[0189] Receiving a fifth call result returned by the permission control server in response to the fifth call request;

[0190] If the fifth calling result is yes, then a fifth processing result that the policy of the second data resource information already exists is obtained;

[0191] If the fifth call result is not present, the target interface further includes: a policy creation interface, using the connection to send a sixth call request corresponding to the policy creation interface to the permission control server;

[0192] According to the sixth calling result corresponding to the sixth calling request, the sixth processing result corresponding to the policy adding request is determined.

[0193] The third processing interface is used to process the policy deletion request, specifically to perform the following steps:

[0194] Using the connection, sending a seventh call request corresponding to the policy query interface to the permission control server; the seventh call request is used to query whether a policy corresponding to the third user identifier, the third data resource information and the operation permission information exists;

[0195] Receiving a seventh call result returned by the permission control server in response to the seventh call request;

[0196] If the seventh call result is non-existent, the seventh processing result of non-existent policy is obtained;

[0197] If the seventh call result is yes, the target interface further includes: a policy deletion interface, using the connection to send an eighth call request corresponding to the policy deletion interface to the permission control server;

[0198] According to the eighth calling result corresponding to the eighth calling request, the eighth processing result corresponding to the policy adding request is determined.

[0199] In the case where the third data resource information corresponds to a database component, the target interface may further include: a policy query interface corresponding to the fourth data resource information; the fourth data resource information is used to represent the data resource corresponding to the third data resource information on the database file system component;

[0200] Then the third processing interface can also be used to perform the following steps:

[0201] Using the connection, sending a ninth call request corresponding to the policy query interface to the permission control server; the ninth call request is used to query whether a policy corresponding to the third user identifier, the fourth data resource information and the operation permission information exists;

[0202] Receiving a ninth call result returned by the permission control server in response to the ninth call request;

[0203] If the ninth call result is not present, the ninth processing result of the policy not present is obtained;

[0204] If the ninth call result is yes, the target interface further includes: a policy deletion interface, using the connection to send a tenth call request corresponding to the policy deletion interface to the permission control server;

[0205] According to the tenth calling result corresponding to the tenth calling request, the tenth processing result corresponding to the policy deletion request is determined.

[0206] In an application example of the present application, when receiving a user request, the client can call the processing interface provided by the software development kit. Accordingly, the client can perform the following steps: provide a processing interface corresponding to the client object; construct a client object; construct a user request object; call the target processing interface corresponding to the client object, the parameters of the target processing interface include: information of the user request object, and the information of the user request object may include: relevant information of the user request. After calling the target processing interface corresponding to the client object, the steps corresponding to the target processing interface can be executed.

[0207] Reference Figure 7 , shows a flowchart of a method for processing a policy adding request according to an embodiment of the present application, which may specifically include the following steps:

[0208] Step 701: Receive a policy adding request;

[0209] Step 702: construct a client object; the information of the client object may be the information of the client;

[0210] Step 703: construct a user request object; the information requested by the user may include: relevant information requested by the user;

[0211] Step 704: Call the target processing interface corresponding to the client object so that the target processing interface processes the policy adding request;

[0212] Step 705: output the processing result;

[0213] The target processing interface is specifically used to perform the following steps:

[0214] Step 741: query whether the first existing policy corresponding to the policy adding request in the database component exists according to the policy query interface of the authority control server. If yes, execute step 743; otherwise, execute step 742;

[0215] Step 742: Create a first new policy corresponding to the policy addition request in the database component according to the policy creation interface of the authority control server;

[0216] Step 743: query whether the second existing policy corresponding to the policy adding request in the database file system component exists according to the policy query interface of the authority control server. If yes, execute step 745; otherwise, execute step 744.

[0217] Step 744: Create a second new policy corresponding to the policy addition request in the database file system component according to the policy creation interface of the authority control server;

[0218] Step 745: Determine the processing result corresponding to the policy adding request. The processing result corresponding to the policy adding request may include: the result that the policy corresponding to the database component of the policy adding request already exists or is added successfully, and the result that the policy corresponding to the database component of the policy adding request already exists or is added successfully.

[0219] Figure 7 The method shown, after granting the first permission of the first data resource of the database component to the user, automatically grants the second permission of the second data resource of the database file system component to the user. In this way, the embodiment of the present application can not only realize the permission synchronization between the database component and the database file system component, but also save the operation cost of the database file system component corresponding to the permission, thereby further improving the efficiency of permission processing.

[0220] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0221] Based on the above embodiment, this embodiment further provides a permission processing device, referring to Figure 8 The permission control device can be applied to the client of a third-party permission program, and specifically may include:

[0222] The request receiving module 801 is used to receive a user request;

[0223] The request processing module 802 is used to process the user request to obtain a processing result corresponding to the user request;

[0224] A result output module 803 is used to output the processing result;

[0225] Wherein, the request processing module 802 includes:

[0226] The connection module 821 is used to establish a connection with the authority control server according to the client information; the client information includes: the address information of the authority control server, the account number and password of the management user;

[0227] The port and call request determination module 822 is used to determine the target interface corresponding to the user request on the authority control server according to the processing logic of the user request, and to determine the call request corresponding to the target interface:

[0228] The calling module 823 is used to use the connection to send a calling request corresponding to the target interface to the authority control server to obtain a processing result corresponding to the user request.

[0229] Optionally, the user request specifically includes: a user adding request, the user adding request specifically includes: a first user identifier requested to be added, and the target interface specifically includes: a user query interface;

[0230] The calling module specifically includes:

[0231] A first sending module, used to use the connection to send a first call request corresponding to the user query interface to the authority control server; the first call request is used to query whether the first user identifier exists;

[0232] A first result receiving module, used to receive a first call result returned by the permission control server in response to the first call request;

[0233] A first processing result determination module, configured to obtain a first processing result that already exists for the user if the first calling result is yes;

[0234] A second sending module is used for, if the first call result is non-existent, the target interface further specifically includes: a user creation interface, using the connection to send a second call request corresponding to the user creation interface to the authority control server; the second call request is used to create the first user identifier;

[0235] The second processing result determining module is used to determine the second processing result corresponding to the add user request according to the second calling result corresponding to the second calling request.

[0236] Optionally, the user request specifically includes: a policy adding request, the policy adding request specifically includes: a second user identifier, first data resource information and operation authority information, and the target interface specifically includes: a policy query interface corresponding to the first data resource information;

[0237] The calling module specifically includes:

[0238] A third sending module is used to use the connection to send a third call request corresponding to the policy query interface to the authority control server; the third call request is used to query whether a policy corresponding to the second user identifier, the first data resource information and the operation authority information exists;

[0239] A second result receiving module, used to receive a third call result returned by the authority control server in response to the third call request;

[0240] A third processing result determination module, configured to obtain a third processing result indicating that the policy already exists if the third calling result is yes;

[0241] The fourth sending module is used for sending a fourth calling request corresponding to the policy creation interface to the authority control server by using the connection if the third calling result is not present.

[0242] The fourth processing result determination module is used to determine the fourth processing result corresponding to the policy adding request according to the fourth calling result corresponding to the fourth calling request.

[0243] Optionally, the first data resource information corresponds to a database component; the target interface further specifically includes: a policy query interface corresponding to the second data resource information; the second data resource information is used to characterize the data resource corresponding to the first data resource information on the database file system component;

[0244] The calling module further specifically includes:

[0245] A fifth sending module, used to use the connection to send a fifth call request corresponding to the policy query interface to the authority control server; the fifth call request is used to query whether a policy corresponding to the second user identifier, the second data resource information and the operation authority information exists;

[0246] A third result receiving module, used to receive a fifth call result returned by the permission control server in response to the fifth call request;

[0247] a fifth processing result determination module, configured to obtain a fifth processing result that the policy of the second data resource information already exists if the fifth calling result is existence;

[0248] a sixth sending module, for, if the fifth calling result is not present, the target interface further specifically includes: a policy creation interface, using the connection to send a sixth calling request corresponding to the policy creation interface to the authority control server;

[0249] The sixth processing result determination module is used to determine the sixth processing result corresponding to the policy adding request according to the sixth calling result corresponding to the sixth calling request.

[0250] Optionally, the device further specifically comprises:

[0251] The splicing module is used to splice the database path, database name and data table name included in the first data resource information to obtain the second data resource information.

[0252] Optionally, the user request specifically includes: a policy deletion request, the policy deletion request specifically includes: a third user identifier, third data resource information and operation authority information, and the target interface specifically includes: a policy query interface corresponding to the third data resource information;

[0253] The calling module specifically includes:

[0254] a seventh sending module, configured to use the connection to send a seventh call request corresponding to the policy query interface to the authority control server; the seventh call request is used to query whether a policy corresponding to the third user identifier, the third data resource information, and the operation authority information exists;

[0255] A fourth result receiving module, used to receive a seventh call result returned by the authority control server in response to the seventh call request;

[0256] a seventh processing result determination module, configured to obtain a seventh processing result that the policy does not exist if the seventh call result is non-existence;

[0257] an eighth sending module, for, if the seventh call result is existence, the target interface further specifically includes: a policy deletion interface, using the connection to send an eighth call request corresponding to the policy deletion interface to the authority control server;

[0258] An eighth processing result determination module is used to determine an eighth processing result corresponding to the policy adding request according to an eighth calling result corresponding to the eighth calling request.

[0259] Optionally, the third data resource information corresponds to a database component; the target interface further specifically includes: a policy query interface corresponding to the fourth data resource information; the fourth data resource information is used to characterize the data resource corresponding to the third data resource information on the database file system component;

[0260] The calling module further specifically includes:

[0261] A ninth sending module, used to use the connection to send a ninth call request corresponding to the policy query interface to the authority control server; the ninth call request is used to query whether a policy corresponding to the third user identifier, the fourth data resource information and the operation authority information exists;

[0262] A fifth result receiving module, used to receive a ninth call result returned by the authority control server in response to the ninth call request;

[0263] a ninth processing result determination module, configured to obtain a ninth processing result that the policy does not exist if the ninth calling result is non-existence;

[0264] a tenth sending module, for sending a tenth calling request corresponding to the policy deletion interface to the authority control server by using the connection if the ninth calling result is existence;

[0265] The tenth processing result determining module is used to determine the tenth processing result corresponding to the policy deletion request according to the tenth calling result corresponding to the tenth calling request.

[0266] Optionally, the device further specifically comprises:

[0267] A module is provided for providing a processing interface set corresponding to a user request; the processing interface in the processing interface set is used to call a target interface corresponding to the authority control server according to the processing logic of the user request to realize the processing of the user request;

[0268] The request processing module specifically includes:

[0269] A target processing interface determination module, configured to obtain a target processing interface corresponding to the user request from the processing interface set according to relevant information of the user request;

[0270] The target processing interface calling module is used to call the target processing interface, and the target processing interface is used to perform the following operations:

[0271] Establish a connection with the authority control server according to the client information; the client information specifically includes: the address information of the authority control server, the account number and password of the management user;

[0272] According to the processing logic of the user request, determine the target interface corresponding to the user request on the authority control server, and determine the call request corresponding to the target interface:

[0273] By utilizing the connection, a call request corresponding to the target interface is sent to the authority control server to obtain a processing result corresponding to the user request.

[0274] Optionally, the processing interface set specifically includes: a first processing interface corresponding to a user add request, and / or, a second processing interface corresponding to a policy add request, and / or, a third processing interface corresponding to a policy delete request;

[0275] The first processing interface is used to perform the following operations:

[0276] Using the connection, sending a first call request corresponding to the user query interface to the authority control server; the first call request is used to query whether the first user identifier exists;

[0277] Receive a first call result returned by the permission control server in response to the first call request;

[0278] If the first call result is existing, obtaining the first processing result that the user already has;

[0279] If the first call result is not present, the target interface further specifically includes: a user creation interface, using the connection to send a second call request corresponding to the user creation interface to the authority control server; the second call request is used to create the first user identifier;

[0280] Determine, according to a second calling result corresponding to the second calling request, a second processing result corresponding to the adding user request;

[0281] The second processing interface is used to perform the following operations:

[0282] Using the connection, sending a third call request corresponding to the policy query interface to the authority control server; the third call request is used to query whether a policy corresponding to the second user identifier, the first data resource information and the operation authority information exists;

[0283] Receiving a third call result returned by the permission control server in response to the third call request;

[0284] If the third call result is yes, then a third processing result indicating that the policy already exists is obtained;

[0285] If the third call result is not present, the target interface further specifically includes: a policy creation interface, using the connection to send a fourth call request corresponding to the policy creation interface to the authority control server;

[0286] Determining a fourth processing result corresponding to the policy adding request according to a fourth calling result corresponding to the fourth calling request;

[0287] The third processing interface is used to perform the following operations:

[0288] Using the connection, sending a seventh call request corresponding to the policy query interface to the authority control server; the seventh call request is used to query whether a policy corresponding to the third user identifier, the third data resource information and the operation authority information exists;

[0289] Receiving a seventh call result returned by the permission control server in response to the seventh call request;

[0290] If the seventh call result is non-existent, a seventh processing result of non-existent policy is obtained;

[0291] If the seventh call result is existence, the target interface further specifically includes: a policy deletion interface, using the connection to send an eighth call request corresponding to the policy deletion interface to the authority control server;

[0292] An eighth processing result corresponding to the policy adding request is determined according to an eighth calling result corresponding to the eighth calling request.

[0293] In summary, in the permission processing device of the embodiment of the present application, the client of the third-party permission program can automatically determine the target interface corresponding to the user request on the permission control server, and the call request corresponding to the target interface, and automatically send the call request to the above permission control server to obtain the processing result corresponding to the above user request. Due to the application of the method of the embodiment of the present application, the user can obtain the corresponding processing result by submitting the user request; therefore, compared with the prior art of managing users to perform a large number of operations on multiple interfaces, the embodiment of the present application can save the user's operating costs, and thus can improve the efficiency of permission processing.

[0294] Furthermore, since in the technical solution of the embodiment of the present application, the client information used by the client to establish a connection with the permission control server specifically includes: the account and password of the management user, this allows ordinary users (users different from the management user) to submit user requests to the client using the account and password of the management user, so the embodiment of the present application can reduce the burden on the management user.

[0295] The embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0296] The present application embodiment provides one or more machine-readable media on which instructions are stored, and when executed by one or more processors, an electronic device executes one or more of the methods described in the above embodiments. In the present application embodiment, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0297] The embodiments of the present disclosure may be implemented as a device that uses any appropriate hardware, firmware, software, or any combination thereof to perform a desired configuration, and the device may include: electronic devices such as terminal devices and servers (clusters). Fig. 9 An exemplary apparatus 1100 that can be used to implement various embodiments described in this application is schematically shown.

[0298] For one embodiment, Fig. 9 An exemplary apparatus 1100 is shown having one or more processors 1102, a control module (chip set) 1104 coupled to at least one of the (one or more) processors 1102, a memory 1106 coupled to the control module 1104, a non-volatile memory / storage device 1108 coupled to the control module 1104, one or more input / output devices 1110 coupled to the control module 1104, and a network interface 1112 coupled to the control module 1104.

[0299] The processor 1102 may include one or more single-core or multi-core processors, and the processor 1102 may include any combination of general-purpose processors or special-purpose processors (such as graphics processors, application processors, baseband processors, etc.). In some embodiments, the device 1100 can be used as a terminal device, server (cluster), etc. described in the embodiments of the present application.

[0300] In some embodiments, the device 1100 may include one or more computer-readable media (e.g., memory 1106 or non-volatile memory / storage device 1108) having instructions 1114 and one or more processors 1102 configured to execute the instructions 1114 in combination with the one or more computer-readable media to implement a module to perform the actions described in the present disclosure.

[0301] For one embodiment, the control module 1104 may include any suitable interface controller to provide any suitable interface to at least one of the processor(s) 1102 and / or any suitable device or component in communication with the control module 1104 .

[0302] The control module 1104 may include a memory controller module to provide an interface to the memory 1106. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0303] The memory 1106 may be used, for example, to load and store data and / or instructions 1114 for the device 1100. For one embodiment, the memory 1106 may include any suitable volatile memory, such as a suitable DRAM (Dynamic Random Access Memory). In some embodiments, the memory 1106 may include a double data rate type four synchronous dynamic random access memory.

[0304] For one embodiment, the control module 1104 may include one or more input / output controllers to provide an interface to the non-volatile memory / storage device 1108 and the input / output device(s) 1110 .

[0305] For example, non-volatile memory / storage 1108 may be used to store data and / or instructions 1114. Non-volatile memory / storage 1108 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives, one or more optical disk drives, and / or one or more digital versatile optical disk drives).

[0306] The non-volatile memory / storage device 1108 may include storage resources that are physically part of the device on which the apparatus 1100 is installed, or it may be accessible to the device without being part of the device. For example, the non-volatile memory / storage device 1108 may be accessed via (one or more) input / output devices 1110 over a network.

[0307] The input / output device(s) 1110 may provide an interface for the apparatus 1100 to communicate with any other appropriate device, and the input / output device 1110 may include a communication component, an audio component, a sensor component, etc. The network interface 1112 may provide an interface for the apparatus 1100 to communicate through one or more networks, and the apparatus 1100 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, accessing a wireless network based on a communication standard, such as WiFi (Wireless Fidelity), 2G (2nd Generation Wireless Telephone Technology), 3G (3rd Generation Wireless Telephone Technology), 4G (4th Generation Wireless Telephone Technology), 5G (5th Generation Wireless Telephone Technology), etc., or a combination thereof for wireless communication.

[0308] For one embodiment, at least one of the processor(s) 1102 may be packaged together with the logic of one or more controllers (e.g., a memory controller module) of the control module 1104. For one embodiment, at least one of the processor(s) 1102 may be packaged together with the logic of one or more controllers of the control module 1104 to form a system-in-package. For one embodiment, at least one of the processor(s) 1102 may be integrated on the same die with the logic of one or more controllers of the control module 1104. For one embodiment, at least one of the processor(s) 1102 may be integrated on the same die with the logic of one or more controllers of the control module 1104 to form a system-on-chip.

[0309] In various embodiments, the device 1100 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the device 1100 may have more or fewer components and / or different architectures. For example, in some embodiments, the device 1100 includes one or more cameras, a keyboard, a liquid crystal display screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, a dedicated integrated circuit, and a speaker.

[0310] Among them, the main control chip can be used as a processor or control module in the detection device, sensor data, location information, etc. are stored in a memory or non-volatile memory / storage device, the sensor group can be used as an input / output device, and the communication interface may include a network interface.

[0311] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0312] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0313] The present application embodiment is described with reference to the flowchart and / or block diagram of the method, terminal device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device produce a device for implementing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0314] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0315] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce computer-implemented processing, so that the instructions executed on the computer or other programmable terminal device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0316] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0317] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0318] The above is a detailed introduction to a permission processing method and device, an electronic device and a machine-readable medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for a person skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A permission processing method, characterized in that: Applied to a client of a third-party permission program, the method comprises: Receive user requests; Processing the user request to obtain a processing result corresponding to the user request; automatically executing permission processing of a second data resource of a database file system component when the user request involves permission processing of a first data resource of a database component; wherein the first data resource and the second data resource correspond to the same data table; Outputting the processing result; The processing of the user request includes: Establish a connection with the authority control server according to the client information; the client information includes: the address information of the authority control server, the account number and password of the management user; According to the processing logic of the user request, determine the target interface corresponding to the user request on the authority control server, and determine the call request corresponding to the target interface: By utilizing the connection, a call request corresponding to the target interface is sent to the authority control server to obtain a processing result corresponding to the user request.

2. The method according to claim 1, characterized in that The user request includes: a user adding request, the user adding request includes: a first user identifier requested to be added, and the target interface includes: a user query interface; The using the connection to send a call request corresponding to the target interface to the authority control server includes: Using the connection, sending a first call request corresponding to the user query interface to the authority control server; the first call request is used to query whether the first user identifier exists; Receive a first call result returned by the permission control server in response to the first call request; If the first call result is existing, obtaining the first processing result that the user already has; If the first call result is not present, the target interface further includes: a user creation interface, using the connection to send a second call request corresponding to the user creation interface to the authority control server; the second call request is used to create the first user identifier; A second processing result corresponding to the add user request is determined according to a second calling result corresponding to the second calling request.

3. The method according to claim 1, characterized in that: The user request includes: a policy adding request, the policy adding request includes: a second user identifier, first data resource information and operation authority information, and the target interface includes: a policy query interface corresponding to the first data resource information; The using the connection to send a call request corresponding to the target interface to the authority control server includes: Using the connection, sending a third call request corresponding to the policy query interface to the authority control server; the third call request is used to query whether a policy corresponding to the second user identifier, the first data resource information and the operation authority information exists; Receiving a third call result returned by the permission control server in response to the third call request; If the third call result is yes, then a third processing result indicating that the policy already exists is obtained; If the third call result is not present, the target interface further includes: a policy creation interface, using the connection to send a fourth call request corresponding to the policy creation interface to the authority control server; A fourth processing result corresponding to the policy adding request is determined according to a fourth calling result corresponding to the fourth calling request.

4. The method according to claim 3, characterized in that The first data resource information corresponds to a database component; the target interface further includes: a policy query interface corresponding to the second data resource information; the second data resource information is used to characterize the data resource corresponding to the first data resource information on the database file system component; The using the connection to send a call request corresponding to the target interface to the authority control server also includes: Using the connection, sending a fifth call request corresponding to the policy query interface to the authority control server; the fifth call request is used to query whether a policy corresponding to the second user identifier, the second data resource information and the operation authority information exists; Receiving a fifth call result returned by the permission control server in response to the fifth call request; If the fifth calling result is yes, then obtaining a fifth processing result that the policy of the second data resource information already exists; If the fifth call result is not present, the target interface further comprises: a policy creation interface, using the connection to send a sixth call request corresponding to the policy creation interface to the authority control server; According to the sixth calling result corresponding to the sixth calling request, a sixth processing result corresponding to the policy adding request is determined.

5. The method according to claim 4, characterized in that The method further comprises: The database path, database name and data table name included in the first data resource information are concatenated to obtain the second data resource information.

6. The method according to claim 1, characterized in that The user request includes: a policy deletion request, the policy deletion request includes: a third user identifier, third data resource information and operation authority information, and the target interface includes: a policy query interface corresponding to the third data resource information; The using the connection to send a call request corresponding to the target interface to the authority control server includes: Using the connection, sending a seventh call request corresponding to the policy query interface to the authority control server; the seventh call request is used to query whether a policy corresponding to the third user identifier, the third data resource information and the operation authority information exists; Receiving a seventh call result returned by the permission control server in response to the seventh call request; If the seventh call result is non-existent, a seventh processing result of non-existent policy is obtained; If the seventh call result is existence, the target interface further includes: a policy deletion interface, using the connection to send an eighth call request corresponding to the policy deletion interface to the authority control server; An eighth processing result corresponding to the policy adding request is determined according to an eighth calling result corresponding to the eighth calling request.

7. The method according to claim 6, characterized in that The third data resource information corresponds to the database component; the target interface also includes: a policy query interface corresponding to the fourth data resource information; the fourth data resource information is used to characterize the data resource corresponding to the third data resource information on the database file system component; The using the connection to send a call request corresponding to the target interface to the authority control server also includes: Using the connection, sending a ninth call request corresponding to the policy query interface to the authority control server; the ninth call request is used to query whether a policy corresponding to the third user identifier, the fourth data resource information and the operation authority information exists; Receiving a ninth call result returned by the authority control server in response to the ninth call request; If the ninth calling result is non-existent, a ninth processing result of non-existent policy is obtained; If the ninth call result is existence, the target interface further includes: a policy deletion interface, using the connection to send a tenth call request corresponding to the policy deletion interface to the authority control server; A tenth processing result corresponding to the policy deletion request is determined according to a tenth calling result corresponding to the tenth calling request.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Providing a processing interface set corresponding to the user request; the processing interface in the processing interface set is used to call the target interface corresponding to the authority control server according to the processing logic of the user request to realize the processing of the user request; The processing of the user request includes: According to the relevant information of the user request, obtaining the target processing interface corresponding to the user request from the processing interface set; Call the target processing interface, the target processing interface is used to perform the following steps: Establish a connection with the authority control server according to the client information; the client information includes: the address information of the authority control server, the account number and password of the management user; According to the processing logic of the user request, determine the target interface corresponding to the user request on the authority control server, and determine the call request corresponding to the target interface: By utilizing the connection, a call request corresponding to the target interface is sent to the authority control server to obtain a processing result corresponding to the user request.

9. The method according to claim 8, characterized in that The processing interface set includes: a first processing interface corresponding to a user add request, and / or a second processing interface corresponding to a policy add request, and / or a third processing interface corresponding to a policy delete request; Wherein, the first processing interface is used to perform the following steps: Using the connection, sending a first call request corresponding to the user query interface to the authority control server; the first call request is used to query whether the first user identifier exists; Receive a first call result returned by the permission control server in response to the first call request; If the first call result is existing, obtaining the first processing result that the user already has; If the first call result is not present, the target interface further includes: a user creation interface, using the connection to send a second call request corresponding to the user creation interface to the authority control server; the second call request is used to create the first user identifier; Determine, according to a second calling result corresponding to the second calling request, a second processing result corresponding to the adding user request; The second processing interface is used to perform the following steps: Using the connection, sending a third call request corresponding to the policy query interface to the authority control server; the third call request is used to query whether a policy corresponding to the second user identifier, the first data resource information and the operation authority information exists; Receiving a third call result returned by the permission control server in response to the third call request; If the third call result is yes, then a third processing result indicating that the policy already exists is obtained; If the third call result is not present, the target interface further includes: a policy creation interface, using the connection to send a fourth call request corresponding to the policy creation interface to the authority control server; Determining a fourth processing result corresponding to the policy adding request according to a fourth calling result corresponding to the fourth calling request; The third processing interface is used to perform the following steps: Using the connection, sending a seventh call request corresponding to the policy query interface to the authority control server; the seventh call request is used to query whether a policy corresponding to the third user identifier, the third data resource information and the operation authority information exists; Receiving a seventh call result returned by the permission control server in response to the seventh call request; If the seventh call result is non-existent, a seventh processing result of non-existent policy is obtained; If the seventh call result is existence, the target interface further includes: a policy deletion interface, using the connection to send an eighth call request corresponding to the policy deletion interface to the authority control server; An eighth processing result corresponding to the policy adding request is determined according to an eighth calling result corresponding to the eighth calling request.

10. A permission processing device, characterized in that: Applied to a client of a third-party authority program, the device comprises: A request receiving module, used for receiving user requests; A request processing module, used to process the user request to obtain a processing result corresponding to the user request; when the user request involves permission processing of a first data resource of a database component, the permission processing of a second data resource of a database file system component is automatically performed; wherein the first data resource and the second data resource correspond to the same data table; A result output module, used for outputting the processing result; Wherein, the request processing module includes: A connection module is used to establish a connection with the authority control server according to the client information; the client information includes: the address information of the authority control server, the account number and password of the management user; The port and call request determination module is used to determine the target interface corresponding to the user request on the authority control server according to the processing logic of the user request, and to determine the call request corresponding to the target interface: The calling module is used to use the connection to send a calling request corresponding to the target interface to the authority control server to obtain a processing result corresponding to the user request.

11. An electronic device, characterized in that: include: processor; and A memory having executable codes stored thereon, which, when executed, causes the processor to execute the method according to any one of claims 1 to 9.

12. A machine-readable medium having executable codes stored thereon, which, when executed, causes a processor to execute the method according to any one of claims 1 to 9.

Images