Database data table security access method and device and related equipment

Abstract

The invention relates to the technical field of databases, and discloses a secure access method and device for a data table of a database, electronic equipment and a storage medium. The method comprises the following steps: creating a security tag corresponding to a target database, and creating a data tag security policy and a user tag security policy by using the security tag; acquiring a user table and a data table, configuring a user tag security policy to the user table, and configuring a data tag security policy to the data table; creating a security label column in the data table; creating a corresponding row-level security policy for the data table according to the security label column; when a data request of an access user is received, obtaining a first security tag of the access user, and obtaining a second security tag of a data row in a security tag column in a data table corresponding to the data request; whether the first security tag is matched with the second security tag is checked, if yes, the data operation corresponding to the data request is executed, security access of the database data table is simplified, and the risk that a security access mechanism of the data table fails is solved.

Description

Technical Field

[0001] The present application relates to the field of database technology, and in particular to a method, device, electronic device and storage medium for securely accessing a data table of a database. Background Art

[0002] In the traditional database technology field, data security access is basically a row-level access control strategy, which is implemented by adding WHERE conditions to the query statement and checking whether the range of data values ​​is reasonable before writing data. At the same time, the existing row-level access control cannot detect whether the user has modified the label column, and judge whether it is a legal modification based on whether there is a privilege setting to modify the label. However, when the user deletes a row-level access control policy, the existing technology cannot perform corresponding blocking. Summary of the invention

[0003] The main technical problem solved by the implementation methods of the present application is that the data table security access strategy of the traditional database is complex and there is a risk of failure of the security access mechanism.

[0004] To solve the above technical problems, the first technical solution adopted by the implementation method of the present application is: to provide a method for secure access to a data table of a database, comprising: creating a security label corresponding to a target database by presetting the security officer account authority, and using the security label to create a corresponding data label security policy and a user label security policy according to security requirements; obtaining a user table and a data table of the target database, configuring the user label security policy to the user table, and configuring the data label security policy to the data table; applying the data label security policy on the data table, and creating a corresponding security label column in the data table; creating a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function; when a data request from an access user is received, obtaining a first security label corresponding to the access user from the user table, and obtaining a second security label corresponding to the data row in the data table corresponding to the data request in the security label column; checking whether the first security label matches the second security label according to the label check function, and if they match, executing the data operation corresponding to the data request.

[0005] Optionally, the step of creating a corresponding row-level security policy for the data table according to the security label column, wherein after the step of the row-level security policy including a label check function, it also includes: creating a data security trigger corresponding to the data table according to the data label security policy; after the step of receiving a data request from an accessing user, it also includes: if the data operation corresponding to the data request is a row-level update operation, comparing the data of the security label column in the new tuple and the old tuple in the data security trigger to see if there is a change; if there is a change, checking whether the data in the security label column in the new tuple and the old tuple are in a containment or contained relationship; if they are in a containment or contained relationship, verifying whether the accessing user has specific permissions to the data row in the data table corresponding to the data request; if there is no specific permission, terminating the data request and throwing a corresponding data request security exception information.

[0006] Optionally, the step of applying the data tag security policy on the data table and creating a corresponding security tag column in the data table includes: creating a corresponding security tag column in the data table according to a preset data column name, wherein the data type of the security tag column is an integer type; parsing the data tag security policy to obtain a corresponding security tag, and converting the corresponding security tag to a security tag value; and writing the security tag value to the security tag column.

[0007] Optionally, after the step of applying the data label security policy on the data table and creating a corresponding security label column in the data table, the method further includes: updating a data dictionary corresponding to the target database according to the security label column of the data table; verifying whether the updated information in the data dictionary is consistent with the structural information of the target database; if consistent, updating the current version corresponding to the data dictionary, and storing the current version and current system time.

[0008] Optionally, after the step of receiving a data request from an access user, the step further includes: intercepting the data request by injecting an interface through a preset custom command processor; checking whether the data request is to delete the data tag security policy or the data security trigger; if it is to delete, terminating the data request and throwing a corresponding data request security exception message.

[0009] Optionally, after the step of using the security label to create corresponding data label security policies and user label security policies according to security requirements, the step also includes: receiving policy management operations of the security officer account on the data label security policy and the user label security policy; if the policy management operation is to disable the policy, then when a data request from an access user is received, the matching check of the first security label and the second security label is not performed, and the data operation corresponding to the data request is directly executed; if the policy management operation is to delete the policy, then the data label security policy, the user label security policy, and the security label column in the data table are deleted.

[0010] Optionally, after the step of using the security tag to create a corresponding data tag security policy and a user tag security policy according to security requirements, it also includes: receiving a tag management operation of the security tag by the security officer account; if the tag management operation is to delete the target security tag, checking whether the target security tag is referenced by the data tag security policy and / or the user tag security policy; if the target security tag is referenced, terminating the tag management operation.

[0011] To solve the above technical problems, the second technical solution adopted by the implementation method of the present application is: to provide a data table security access device for a database, including: a security policy creation module, which is used to create a security label corresponding to the target database through the preset security officer account authority, and use the security label to create a corresponding data label security policy and user label security policy according to security requirements; a security policy configuration module, which is used to obtain the user table and data table of the target database, configure the user label security policy to the user table, and configure the data label security policy to the data table; a security label column module, which is used to apply the data label security policy on the data table and create a corresponding security label column in the data table; a row-level security policy module, which is used to create a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function; a security label acquisition module, which is used to obtain a first security label corresponding to the access user from the user table when receiving a data request from an access user, and obtain a second security label corresponding to the data row in the data table corresponding to the data request in the security label column; a security label check module, which is used to check whether the first security label matches the second security label according to the label check function, and if they match, execute the data operation corresponding to the data request.

[0012] To solve the above technical problems, the third technical solution adopted in the implementation mode of the present application is: to provide an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the database data table security access method as described above.

[0013] In order to solve the above technical problems, the fourth technical solution adopted in the implementation mode of the present application is: providing a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are executed by an electronic device, the electronic device implements the method for securely accessing a data table of a database as described above.

[0014] Different from the related art, the present application creates a security label corresponding to the target database, and uses the security label to create a corresponding data label security policy and a user label security policy; obtains the user table and the data table, configures the user label security policy to the user table, and configures the data label security policy to the data table; applies the data label security policy to the data table, and creates a security label column in the data table; creates a corresponding row-level security policy for the data table according to the security label column; when a data request from an access user is received, obtains the first security label corresponding to the access user, and obtains the second security label in the security label column for the data row in the data table corresponding to the data request; checks whether the first security label matches the second security label, and if so, executes the data operation corresponding to the data request, thereby achieving secure access to the database data table in a simpler way and solving the risk of failure of the security access mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] One or more embodiments are exemplarily described by corresponding drawings, which do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and the figures in the drawings do not constitute proportional limitations unless otherwise stated.

[0016] Figure 1 It is a schematic diagram of the operating environment of the method for securely accessing a database table provided in an embodiment of the present application.

[0017] Figure 2 It is a schematic diagram of the execution flow of the method for securely accessing a database table provided in an embodiment of the present application.

[0018] Figure 3 It is a schematic diagram of the execution flow of performing tag management operations in the database data table security access method provided in the embodiment of the present application.

[0019] Figure 4 It is a schematic diagram of the execution flow of writing a security tag value in the database data table security access method provided in an embodiment of the present application.

[0020] Figure 5 It is a schematic diagram of the execution flow of updating the data dictionary in the method for securely accessing a database table provided in an embodiment of the present application.

[0021] Figure 6 It is a schematic diagram of the execution flow of executing policy management operations in the database data table security access method provided in the embodiment of the present application.

[0022] Figure 7 It is a schematic diagram of the execution flow of executing a data request in the method for securely accessing a data table of a database provided in an embodiment of the present application.

[0023] Figure 8 It is a system structure diagram of a database data table security access device provided in an embodiment of the present application.

[0024] Fig. 9 It is a schematic diagram of the hardware structure of an electronic device for executing a method for securely accessing a database table provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0026] It should be noted that, if there is no conflict, the various features in the embodiments of the present application can be combined with each other, all within the scope of protection of the present application. In addition, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in a different order than the module division in the device schematic diagram or the order in the flow chart.

[0027] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The term "and / or" used in this specification includes any and all combinations of one or more of the related listed items.

[0028] To facilitate understanding of this embodiment, firstly, a method for securely accessing a database table disclosed in an embodiment of the present application is described in detail. Figure 1 , Figure 1Schematic diagram of the operating environment of the database data table security access method provided in the embodiment of the present application, such as Figure 1 As shown, the execution subject of the database data table security access method provided in the embodiment of the present application is generally an electronic device with certain computing capabilities, such as a computer device. In some possible implementations, the database data table security access method can be implemented by a processor calling a computer-readable instruction stored in a memory. Figure 1 The computer device in the term can be a server. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. It can be understood that Figure 1 The number of computer devices in the figure is only for reference and can be expanded to any number according to actual needs.

[0029] Please continue reading Figure 2 , Figure 2 : is a schematic diagram of the execution flow of the method for securely accessing a database table provided in an embodiment of the present application, such as Figure 2 As shown, the process includes the following steps S1 to S6.

[0030] S1. Create security labels corresponding to the target database by presetting the security officer account permissions, and use the security labels to create corresponding data label security policies and user label security policies according to security requirements.

[0031] Among them, in addition to the preset security officer account that can perform the relevant operations in the above S1 step on the target database, it can also be the super administrator account of the database. The super administrator account is mainly responsible for the overall management and configuration of the database system, while the security officer account focuses on the security management and monitoring of the database. The super administrator has a wider range of permissions, while the security officer account usually has more professional security management permissions. The security label corresponding to the created database user can also be called a user label or a user security label, and the security label corresponding to the data in the created data table can also be called a data label or a data security label.

[0032] A security label is a string containing the sensitivity level, domain, and organization information. The syntax of a security label is: "level:domain:group". By associating corresponding security labels with database users and database data, more fine-grained access control can be achieved than role-based access control.

[0033] The tag security policy is a security mechanism that associates tags, rules, users, and data tables. In the tag security policy, tags with the same meaning are organized into a policy. When granting tags to users, the policy must be specified. When you need to protect the data in a data table, you also need to specify an applicable policy. When a user accesses data in a data table, the system checks the user's tags in the tag security policy one by one according to the tag security policy on the data table to confirm the user's read and write permissions for the data in the data table.

[0034] As an example, the security label corresponding to a user is mainly used to identify the user's authority when modifying existing data and to control the security labels that can be used when adding new data. When a user reads (SELECT), modifies (UPDATE), or deletes (DELETE) tagged data, it is necessary to authenticate according to the level, domain, and group set by the super administrator, as well as their read and write attributes. When a user adds data (INSERT), the data security label comes from the user security label set by the super user. The user labels include maximum read, maximum write, minimum write, default read label, and default write label. (1) Maximum read label, which indicates the maximum level, domain, and group that the user can read. (2) Maximum write label, which indicates the maximum data label that the user can use when inserting data. The maximum level, group, and domain of the data can be specified. If the maximum write label is not set, the maximum write label defaults to the maximum read label to ensure the principle of being able to write and read. (3) Minimum write label, which only contains the level without the domain and group, indicates the minimum data label that the user can use when adding new data. (4) Default read label, which is the initialization session label used when the user initiates a connection. If not specified, the default is the maximum read label. (5) Default write tag: The default write tag used when the user adds new data without specifying a security tag.

[0035] As an optional implementation, please continue to refer to Figure 3 , Figure 3 : is a schematic diagram of the execution flow of performing tag management operations in the database data table security access method provided in the embodiment of the present application, such as Figure 3 As shown, after the above step of using security tags to create corresponding data tag security policies and user tag security policies according to security requirements, the following steps S14 to S16 may be specifically included.

[0036] S14. Receive tag management operations on security tags from the security officer account.

[0037] Among them, after receiving the tag management operation, the tag management operation can also be parsed to obtain the target security tag that the tag management operation needs to operate, and at the same time check whether the target security tag exists in the target database. If not, the response to the tag management operation can be directly terminated. If it exists, the following step S15 can be continued.

[0038] S15. If the tag management operation is to delete the target security tag, check whether the target security tag is referenced by the data tag security policy and / or the user tag security policy.

[0039] S16: If the target security label is referenced, the label management operation is terminated because if the security label that is in use (ie, referenced in step S16) is deleted, data security access problems may occur.

[0040] S2. Obtain the user table and data table of the target database, configure the user tag security policy to the user table, and configure the data tag security policy to the data table.

[0041] S3. Apply the data label security policy to the data table and create a corresponding security label column in the data table.

[0042] As an optional implementation, please continue to refer to Figure 4 , Figure 4 : is a schematic diagram of the execution flow of writing a security tag value in the database data table security access method provided in the embodiment of the present application, such as Figure 4 As shown, the above step S3 may specifically include the following steps S31 to S33.

[0043] S31. Create a corresponding security label column in the data table according to the preset data column name, wherein the data type of the security label column is an integer type.

[0044] S32. Analyze the data tag security policy, obtain the corresponding security tag, and convert the corresponding security tag into a security tag value.

[0045] The process of converting the security tag into the security tag value may pre-set corresponding conversion rules.

[0046] S33, write the security tag value into the security tag column.

[0047] As another optional implementation, please continue to refer to Figure 5 , Figure 5 : is a schematic diagram of the execution flow of updating the data dictionary in the database data table security access method provided in the embodiment of the present application, such as Figure 5 As shown, after the above step S3, the following steps S34 to S36 may also be included.

[0048] S34. Update the data dictionary corresponding to the target database according to the security label column of the data table.

[0049] The database data dictionary is a collection of metadata that describes the data structure, data elements, data attributes, and the relationships between them stored in the database. The data dictionary provides detailed information about the data in the database, helping users understand the composition and structure of the database, as well as the meaning and purpose of the data.

[0050] S35. Verify whether the updated information in the data dictionary is consistent with the structural information of the target database.

[0051] S36. If they are consistent, update the current version corresponding to the data dictionary, and store the current version and current system time.

[0052] In addition to storing the current version and the current system time, the corresponding update information of the data dictionary can also be stored, so that the database management user can perform corresponding security access problem troubleshooting according to the version upgrade record of the data dictionary.

[0053] S4. Create a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function.

[0054] Among them, after the above step S4, a data security trigger corresponding to the above data table may also be created according to the above data tag security policy.

[0055] S5. When a data request from an access user is received, a first security tag corresponding to the access user is obtained from the user table, and a second security tag corresponding to the data row in the security tag column in the data table corresponding to the data request is obtained.

[0056] As an optional implementation, please continue to refer to Figure 6 , Figure 6 : is a schematic diagram of the execution flow of executing the policy management operation in the database data table security access method provided in the embodiment of the present application, such as Figure 6 As shown, after the above step of using security tags to create corresponding data tag security policies and user tag security policies according to security requirements, the following steps S11 to S13 may be specifically included.

[0057] S11. Receive the policy management operations of the security officer account on the data label security policy and the user label security policy.

[0058] S12. If the policy management operation is to disable the policy, when a data request from an access user is received, a matching check between the first security tag and the second security tag is not performed, and a data operation corresponding to the data request is directly performed.

[0059] S13. If the policy management operation is to delete the policy, then the data label security policy, the user label security policy, and the security label column in the data table are deleted.

[0060] Among them, when deleting the policy, the deleted data label security policy also needs to be verified to detect whether the data label security policy to be deleted is being used. If it is being used, the deletion operation can be ignored. If the super administrator user or security officer user of the database continues to issue forced deletion instructions, the above deletion operation is performed.

[0061] As an optional implementation, please continue to refer to Figure 7 , Figure 7 : is a schematic diagram of the execution flow of executing a data request in the database data table security access method provided in the embodiment of the present application, such as Figure 7 As shown, after the above step of creating the corresponding data security trigger, when a request for accessing user data is received, the following steps S51 to S54 may also be included.

[0062] S51. If the data operation corresponding to the data request is a row-level update operation, compare whether the data in the security label column in the new tuple and the old tuple in the data security trigger has changed.

[0063] S52: If there is a change, check whether the data in the security label column in the new tuple and the old tuple are in a containment or contained relationship.

[0064] S53. If it is a containment or included relationship, verify whether the accessing user has specific authority over the data row in the data table corresponding to the data request.

[0065] S54. If there is no specific permission, the data request is terminated and a corresponding data request security exception message is thrown.

[0066] Among them, by comparing the changes of the new tuple and the old tuple of the data security trigger and detecting the data relationship of the corresponding security label, effective access security protection can also be performed on the data in the data table.

[0067] As another optional implementation, after the above step of receiving a request for accessing user data, the following steps S55 to S57 may also be included.

[0068] S55. Intercept data requests by injecting an interface using a preset custom command processor.

[0069] S56. Check whether the data request is to delete the data tag security policy or the data security trigger.

[0070] S57: If it is a deletion, the data request is terminated and a corresponding data request security exception message is thrown.

[0071] Among them, by pre-intercepting data requests and determining whether the data request is to delete a security policy or a data security trigger, the problem of invalidation of the security access mechanism of the created database data table can be effectively prevented.

[0072] S6. Check whether the first security tag and the second security tag match according to the tag check function, and if they match, execute the data operation corresponding to the data request.

[0073] The method for secure access to a database table provided in an embodiment of the present application creates a security label corresponding to a target database, uses the security label to create a corresponding data label security policy and a user label security policy; obtains a user table and a data table, configures the user label security policy to the user table, and configures the data label security policy to the data table; applies the data label security policy to the data table, and creates a security label column in the data table; creates a corresponding row-level security policy for the data table according to the security label column; when a data request from an access user is received, obtains a first security label corresponding to the access user, and obtains a second security label in the security label column for the data row in the data table corresponding to the data request; checks whether the first security label matches the second security label, and if so, executes the data operation corresponding to the data request, thereby achieving secure access to the database table in a simpler manner and solving the risk of failure of the security access mechanism.

[0074] Please continue reading Figure 8 , Figure 8 : is a schematic diagram of the system structure of a database data table security access device provided by an embodiment of the present application, such as Figure 8 As shown, the device 80 includes: a security policy creation module 81, a security policy configuration module 82, a security label column module 83, a row-level security policy module 84, a security label acquisition module 85 and a security label checking module 86.

[0075] The security policy creation module 81 is used to create a security label corresponding to the target database by presetting the security officer account authority, and use the security label to create a corresponding data label security policy and user label security policy according to security requirements;

[0076] The security policy configuration module 82 is used to obtain the user table and the data table of the target database, configure the user tag security policy to the user table, and configure the data tag security policy to the data table;

[0077] The security label column module 83 is used to apply the data label security policy on the data table and create a corresponding security label column in the data table;

[0078] The row-level security policy module 84 is used to create a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function;

[0079] The security tag acquisition module 85 is used for, when receiving a data request from an access user, acquiring a first security tag corresponding to the access user from the user table, and acquiring a second security tag corresponding to the security tag column of the data row in the data table corresponding to the data request;

[0080] The security tag checking module 86 is used to check whether the first security tag matches the second security tag according to the tag checking function, and if they match, execute the data operation corresponding to the data request.

[0081] As an optional implementation, the row-level security policy module 84 is also used to create a data security trigger corresponding to the data table according to the data label security policy; after the step of receiving the data request from the access user, it also includes: if the data operation corresponding to the data request is a row-level update operation, then compare whether the data of the security label column in the new tuple and the old tuple in the data security trigger has changed; if it has changed, check whether the data of the security label column in the new tuple and the old tuple is a containment or contained relationship; if it is a containment or contained relationship, check whether the access user has specific permissions to the data row in the data table corresponding to the data request; if there is no specific permission, terminate the data request and throw a corresponding data request security exception information.

[0082] As an optional implementation, the security label column module 83 is also used to create a corresponding security label column in the data table according to a preset data column name, wherein the data type of the security label column is an integer type; parse the data label security policy to obtain the corresponding security label, and convert the corresponding security label into a security label value; and write the security label value to the security label column.

[0083] As an optional implementation, the security label column module 83 is also used to update the data dictionary corresponding to the target database according to the security label column of the data table; verify whether the updated information of the data dictionary is consistent with the structural information of the target database; if consistent, update the current version corresponding to the data dictionary, and store the current version and current system time.

[0084] As an optional implementation, the security tag acquisition module 85 is also used to intercept the data request through a preset custom command processor injection interface; check whether the data request is to delete the data tag security policy or the data security trigger; if it is to delete, terminate the data request and throw a corresponding data request security exception information.

[0085] As an optional implementation, the security policy creation module 81 is also used to receive the policy management operations of the security officer account on the data tag security policy and the user tag security policy; if the policy management operation is to disable the policy, then when a data request from an access user is received, the matching check of the first security tag and the second security tag is not performed, and the data operation corresponding to the data request is directly executed; if the policy management operation is to delete the policy, then the data tag security policy, the user tag security policy, and the security tag column in the data table are deleted.

[0086] As an optional implementation, the security policy creation module 81 is also used to receive the tag management operation of the security officer account on the security tag; if the tag management operation is to delete the target security tag, check whether the target security tag is referenced by the data tag security policy and / or the user tag security policy; if the target security tag is referenced, terminate the tag management operation.

[0087] It should be noted that the above-mentioned database data table security access device can execute the database data table security access method provided in the embodiment of the present application, and has the corresponding functional modules and beneficial effects of the execution method. For technical details not fully described in the embodiment of the database data table security access device, please refer to the database data table security access method provided in the embodiment of the present application.

[0088] Fig. 9 is a schematic diagram of the hardware structure of an electronic device 900 for executing a method for securely accessing a database table provided in an embodiment of the present application, such as Fig. 9 As shown, the electronic device 900 includes:

[0089] One or more processors 910 and memory 920, Fig. 9 A processor 910 is taken as an example.

[0090] The processor 910 and the memory 920 may be connected via a bus or other means. Fig. 9 The example of connecting through bus is taken in the following.

[0091] The memory 920, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules corresponding to the method for securely accessing a data table of a database in the embodiment of the present application. The processor 910 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 920, that is, implements the method for securely accessing a data table of a database in the above method embodiment.

[0092] The memory 920 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created according to the use of a data table security access device of a database, etc. In addition, the memory 920 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 920 may optionally include a memory remotely arranged relative to the processor 910, and these remote memories may be connected to the data table security access device of the database via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0093] The one or more modules are stored in the memory 920, and when executed by the one or more processors 910, execute the database data table security access method in any of the above method embodiments, for example, execute the above described Figure 2 Steps S1 to S6 of the method, Figure 3 Steps S11 to S13 of the method, Figure 4 Steps S14 to S16 of the method, Figure 5 Steps S31 to S33 of the method, Figure 6 Steps S34 to S36 of the method, Figure 7 Steps S51 to S54 of the method are implemented Figure 8 The functions of modules 81-86 in.

[0094] The above-mentioned product can execute the method provided in the embodiment of the present application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided in the embodiment of the present application.

[0095] The embodiment of the present application provides a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by one or more processors, such as Fig. 9A processor 910 in the embodiment may enable the one or more processors to execute the database data table security access method in any of the above method embodiments, for example, to execute the above described Figure 2 Steps S1 to S6 of the method, Figure 3 Steps S11 to S13 of the method, Figure 4 Steps S14 to S16 of the method, Figure 5 Steps S31 to S33 of the method, Figure 6 Steps S34 to S36 of the method, Figure 7 Steps S51 to S54 of the method are implemented Figure 8 The functions of modules 81-86 in.

[0096] The present application provides a computer program product, wherein the computer program product includes a computer program stored on a non-volatile computer-readable storage medium, wherein the computer program includes program instructions, and when the program instructions are executed by the electronic device, the electronic device is enabled to execute the database data table security access method in any of the above method embodiments, for example, to execute the above described Figure 2 Steps S1 to S6 of the method, Figure 3 Steps S11 to S13 of the method, Figure 4 Steps S14 to S16 of the method, Figure 5 Steps S31 to S33 of the method, Figure 6 Steps S34 to S36 of the method, Figure 7 Steps S51 to S54 of the method are implemented Figure 8 The functions of modules 81-86 in.

[0097] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0098] Through the description of the above implementation methods, ordinary technicians in this field can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, it can also be implemented by hardware. Ordinary technicians in this field can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0099] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them; under the idea of ​​the present application, the technical features in the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes in different aspects of the present application as described above, which are not provided in detail for the sake of simplicity; although the present application is described in detail with reference to the above embodiments, ordinary technicians in this field should understand that they can still modify the technical solutions recorded in the above embodiments, or replace some of the technical features by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application. The non-company software tools or components that appear in the embodiments of the present application are only examples and do not represent actual use.

Claims

1. A method for securely accessing a data table of a database, characterized in that: include: Create security labels corresponding to the target database by presetting the security officer account permissions, and use the security labels to create corresponding data label security policies and user label security policies according to security requirements; Obtain a user table and a data table of the target database, configure the user tag security policy to the user table, and configure the data tag security policy to the data table; Applying the data tag security policy on the data table, and creating a corresponding security tag column in the data table; Creating a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function; When receiving a data request from an access user, obtaining a first security tag corresponding to the access user from the user table, and obtaining a second security tag corresponding to the security tag column of the data row in the data table corresponding to the data request; Check whether the first security tag matches the second security tag according to the tag check function, and if they match, execute the data operation corresponding to the data request.

2. The method for securely accessing a database table according to claim 1, characterized in that: After the step of creating a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function, the step further includes: Creating a data security trigger corresponding to the data table according to the data tag security policy; After the step of receiving a request to access user data, the method further includes: If the data operation corresponding to the data request is a row-level update operation, comparing whether the data in the security label column in the new tuple and the old tuple in the data security trigger have changed; If there is a change, checking whether the data in the security label column of the new tuple and the old tuple are in a containment or contained relationship; If it is a containment or included relationship, verify whether the accessing user has specific authority over the data row in the data table corresponding to the data request; If there is no specific permission, the data request is terminated and a corresponding data request security exception message is thrown.

3. The method for securely accessing a database table according to claim 1, characterized in that: The step of applying the data tag security policy on the data table and creating a corresponding security tag column in the data table includes: Creating a corresponding security label column in the data table according to a preset data column name, wherein the data type of the security label column is an integer type; Parsing the data tag security policy to obtain a corresponding security tag, and converting the corresponding security tag into a security tag value; Writing the security tag value to the security tag column.

4. The method for securely accessing a database table according to claim 1, characterized in that: After the step of applying the data tag security policy on the data table and creating a corresponding security tag column in the data table, the method further includes: Update the data dictionary corresponding to the target database according to the security label column of the data table; Verifying whether the updated information of the data dictionary is consistent with the structural information of the target database; If they are consistent, the current version corresponding to the data dictionary is updated, and the current version and current system time are stored.

5. The method for securely accessing a database table according to claim 2, characterized in that: After the step of receiving a request to access user data, the method further includes: Intercepting the data request by presetting a custom command processor injection interface; Checking whether the data request is to delete the data tag security policy or the data security trigger; If it is a deletion, the data request is terminated and a corresponding data request security exception message is thrown.

6. The method for securely accessing a database table according to claim 1, characterized in that: After the step of using the security tag to create a corresponding data tag security policy and a user tag security policy according to the security requirements, the method further includes: Receiving the policy management operation of the security officer account on the data tag security policy and the user tag security policy; If the policy management operation is a disabling policy, when a data request from an access user is received, a matching check between the first security tag and the second security tag is not performed, and a data operation corresponding to the data request is directly performed; If the policy management operation is to delete a policy, the data tag security policy, the user tag security policy, and the security tag column in the data table are deleted.

7. The method for securely accessing a database table according to claim 1, characterized in that: After the step of using the security tag to create a corresponding data tag security policy and a user tag security policy according to the security requirements, the method further includes: Receiving a tag management operation of the security officer account on the security tag; If the tag management operation is to delete the target security tag, checking whether the target security tag is referenced by the data tag security policy and / or the user tag security policy; If the target security label is referenced, the label management operation is terminated.

8. A data table security access device for a database, characterized in that: include: A security policy creation module is used to create security labels corresponding to the target database by presetting the security officer account permissions, and use the security labels to create corresponding data label security policies and user label security policies according to security requirements; A security policy configuration module, used to obtain the user table and data table of the target database, configure the user tag security policy to the user table, and configure the data tag security policy to the data table; A security label column module, used to apply the data label security policy on the data table and create a corresponding security label column in the data table; A row-level security policy module, used to create a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function; A security label acquisition module, configured to, when receiving a data request from an access user, acquire a first security label corresponding to the access user from the user table, and acquire a second security label corresponding to the security label column of the data row in the data table corresponding to the data request; The security tag checking module is used to check whether the first security tag matches the second security tag according to the tag checking function, and if they match, execute the data operation corresponding to the data request.

9. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for securely accessing a data table of a database as described in any one of claims 1 to 7.

10. A non-volatile computer-readable storage medium, characterized in that: The non-volatile computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are executed by an electronic device, the electronic device executes the method for securely accessing a data table of a database according to any one of claims 1 to 7.

Images