Method and apparatus for secure access of data table of database and related device

Abstract

The application relates to the technical field of databases, and discloses a database data table security access method and device, an electronic device and a storage medium. The method comprises the following steps: creating a security label corresponding to a target database, creating a data label security policy and a user label security policy by using the security label; acquiring a user table and a data table, configuring the user label security policy to the user table, and configuring the data label security policy to the data table; creating a security label column in the data table; creating a corresponding row-level security policy for the data table according to the security label column; when a data request of an access user is received, acquiring a first security label of the access user and a second security label of a data row in a data table corresponding to the data request in the security label column; checking whether the first security label and the second security label match, and if yes, executing a data operation corresponding to the data request, so that the security access of the database data table is simplified, and the risk of invalidation of the data table security access mechanism is solved.

Description

Technical Field

[0001] The present application relates to the field of database technology, and in particular to a method, device, electronic device, and storage medium for securely accessing a database table. Background Art

[0002] In traditional database technology, data security access is primarily based on row-level access control policies. This is achieved by adding WHERE conditions to query statements and checking the validity of data ranges before writing data. Furthermore, existing row-level access control cannot detect whether a user has modified a label column, and determines whether the modification is legal based on the presence of the privilege to modify the label. However, existing technologies are unable to block attempts to delete a row-level access control policy. Summary of the Invention

[0003] The main technical problem to be solved by the implementation of the present application is that the traditional database data table security access strategy is complex and there is a risk of security access mechanism failure.

[0004] To solve the above technical problems, the first technical solution adopted in the implementation mode of the present application is: to provide a method for secure access to a data table of a database, comprising: creating a security label corresponding to a target database by presetting the security officer account authority, and using the security label to create a corresponding data label security policy and a user label security policy according to security requirements; obtaining the user table and data table of the target database, configuring the user label security policy to the user table, and configuring the data label security policy to the data table; applying the data label security policy on the data table, and creating a corresponding security label column in the data table; creating a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function; when a data request from an access user is received, obtaining a first security label corresponding to the access user from the user table, and obtaining a second security label corresponding to the data row in the data table corresponding to the data request in the security label column; checking whether the first security label and the second security label match according to the label check function, and if they match, executing the data operation corresponding to the data request.

[0005] Optionally, the step of creating a corresponding row-level security policy for the data table based on the security label column, wherein, after the step of the row-level security policy including a label check function, further includes: creating a data security trigger corresponding to the data table based on the data label security policy; after the step of receiving a data request from an accessing user, further includes: if the data operation corresponding to the data request is a row-level update operation, comparing the data of the security label column in the new tuple and the old tuple in the data security trigger to see if there is a change; if there is a change, checking whether the data in the security label column in the new tuple and the old tuple is in a containment or contained relationship; if it is a containment or contained relationship, verifying whether the accessing user has specific permissions to the data row in the data table corresponding to the data request; if there is no specific permission, terminating the data request and throwing a corresponding data request security exception message.

[0006] Optionally, the step of applying the data tag security policy on the data table and creating a corresponding security tag column in the data table includes: creating a corresponding security tag column in the data table according to a preset data column name, wherein the data type of the security tag column is an integer type; parsing the data tag security policy to obtain a corresponding security tag, and converting the corresponding security tag into a security tag value; and writing the security tag value to the security tag column.

[0007] Optionally, after the step of applying the data tag security policy on the data table and creating a corresponding security tag column in the data table, the method further includes: updating the data dictionary corresponding to the target database according to the security tag column of the data table; verifying whether the updated information of the data dictionary is consistent with the structural information of the target database; if consistent, updating the current version corresponding to the data dictionary, and storing the current version and current system time.

[0008] Optionally, after the step of receiving a data request from an access user, the step further includes: intercepting the data request through a preset custom command processor injection interface; checking whether the data request is to delete the data tag security policy or the data security trigger; if it is to delete, terminating the data request and throwing a corresponding data request security exception message.

[0009] Optionally, after the step of using the security label to create corresponding data label security policies and user label security policies according to security requirements, the step also includes: receiving the policy management operations of the security officer account on the data label security policies and the user label security policies; if the policy management operation is to disable the policy, then when a data request from an access user is received, the matching check of the first security label and the second security label is not performed, and the data operation corresponding to the data request is directly executed; if the policy management operation is to delete the policy, then the data label security policy, the user label security policy, and the security label column in the data table are deleted.

[0010] Optionally, after the step of using the security tag to create corresponding data tag security policy and user tag security policy according to security requirements, it also includes: receiving the tag management operation of the security tag by the security officer account; if the tag management operation is to delete the target security tag, checking whether the target security tag is referenced by the data tag security policy and / or the user tag security policy; if the target security tag is referenced, terminating the tag management operation.

[0011] To solve the above technical problems, the second technical solution adopted by the embodiment of the present application is: to provide a data table security access device for a database, comprising: a security policy creation module, configured to create a security label corresponding to a target database through preset security officer account permissions, and use the security label to create a corresponding data label security policy and user label security policy according to security requirements; a security policy configuration module, configured to obtain a user table and a data table of the target database, configure the user label security policy to the user table, and configure the data label security policy to the data table; a security label column module, configured to apply the data label security policy on the data table and create a corresponding security label column in the data table; a row-level security policy module, configured to create a corresponding row-level security policy for the data table based on the security label column, wherein the row-level security policy includes a label check function; a security label acquisition module, configured to, when receiving a data request from an access user, obtain a first security label corresponding to the access user from the user table, and obtain a second security label corresponding to the data row in the data table corresponding to the data request in the security label column; a security label check module, configured to check whether the first security label and the second security label match according to the label check function, and if so, perform the data operation corresponding to the data request.

[0012] In order to solve the above technical problems, the third technical solution adopted in the implementation of the present application is: to provide an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the database data table security access method as described above.

[0013] In order to solve the above technical problems, the fourth technical solution adopted in the implementation of the present application is: providing a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are executed by an electronic device, the electronic device can securely access the data table of the database as described above.

[0014] Different from the related art, the present application creates a security label corresponding to the target database, and uses the security label to create a corresponding data label security policy and user label security policy; obtains the user table and the data table, configures the user label security policy to the user table, and configures the data label security policy to the data table; applies the data label security policy on the data table, and creates a security label column in the data table; creates a corresponding row-level security policy for the data table based on the security label column; when a data request from an access user is received, obtains the first security label corresponding to the access user, and obtains the second security label in the security label column for the data row in the data table corresponding to the data request; checks whether the first security label and the second security label match, and if so, executes the data operation corresponding to the data request, thereby achieving secure access to the database data table in a simpler way and solving the risk of failure of the security access mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] One or more embodiments are exemplarily illustrated by corresponding drawings, which do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings are represented as similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0016] Figure 1 This is a schematic diagram of the operating environment of the database data table security access method provided in the embodiment of the present application.

[0017] Figure 2 This is a schematic diagram of the execution flow of the method for securely accessing a database table provided in an embodiment of the present application.

[0018] Figure 3 It is a schematic diagram of the execution flow of performing tag management operations in the database data table security access method provided in the embodiment of the present application.

[0019] Figure 4 This is a schematic diagram of the execution flow of writing security tag values ​​in the database data table security access method provided in an embodiment of the present application.

[0020] Figure 5 This is a schematic diagram of the execution flow of updating the data dictionary in the database data table security access method provided in an embodiment of the present application.

[0021] Figure 6 This is a schematic diagram of the execution flow of executing policy management operations in the database data table security access method provided in an embodiment of the present application.

[0022] Figure 7 This is a schematic diagram of the execution flow of executing a data request in the database data table security access method provided in an embodiment of the present application.

[0023] Figure 8 Schematic diagram of the system structure of the database data table security access device provided in the embodiment of the present application.

[0024] Figure 9 This is a schematic diagram of the hardware structure of an electronic device that executes the method for securely accessing a database table provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0026] It should be noted that, if there is no conflict, the various features in the embodiments of the present application can be combined with each other and are all within the scope of protection of the present application. In addition, although the functional modules are divided in the device schematics and the logical order is shown in the flow charts, in some cases, the steps shown or described can be performed in a different order than the module division in the device schematics or the order in the flow charts.

[0027] Unless otherwise defined, all technical and scientific terms used in this specification have the same meanings as those commonly understood by those skilled in the art to which this application belongs. The terms used in this specification are intended only to describe specific embodiments and are not intended to limit this application. The term "and / or" as used in this specification includes any and all combinations of one or more of the relevant listed items.

[0028] To facilitate understanding of this embodiment, first, a method for securely accessing a database table disclosed in an embodiment of this application is described in detail. Figure 1 , Figure 1Schematic diagram of the operating environment of the database data table security access method provided in the embodiment of the present application. Figure 1 As shown, the execution subject of the database data table security access method provided in the embodiment of the present application is generally an electronic device with certain computing capabilities, such as a computer device. In some possible implementations, the database data table security access method can be implemented by a processor calling computer-readable instructions stored in a memory. Figure 1 The computer device in the above can be a server. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. It can be understood that Figure 1 The number of computer devices in the figure is only for reference and can be expanded to any number according to actual needs.

[0029] Please continue reading Figure 2 , Figure 2 This is a schematic diagram of the execution flow of the database data table security access method provided in the embodiment of the present application, such as Figure 2 As shown, the process includes the following steps S1 to S6.

[0030] S1. Create security labels corresponding to the target database by presetting the security officer account permissions, and use the security labels to create corresponding data label security policies and user label security policies based on security requirements.

[0031] Among them, in addition to the preset security officer account that can perform the relevant operations in the above S1 step on the target database, it can also be the database super administrator account. The super administrator account is mainly responsible for the overall management and configuration of the database system, while the security officer account focuses on the security management and monitoring of the database. The super administrator has broader permissions, while the security officer account usually has more professional security management permissions. The security label corresponding to the created database user can also be called a user label or user security label, and the security label corresponding to the data in the created data table can also be called a data label or data security label.

[0032] A security label is a string that contains the sensitivity level, domain, and organization information. The syntax of a security label is "level:domain:group." By associating security labels with database users and database data, you can achieve more fine-grained access control than role-based access control.

[0033] A tag security policy is a security mechanism that links tags, rules, users, and data tables. Tags with the same meaning are grouped together within a single policy. When assigning tags to a user, a specific policy must be specified. When protecting data in a data table, a specific policy must also be specified. When a user accesses data in a data table, the system checks each user's tags against the table's tag security policy to confirm the user's read and write permissions for the data in the table.

[0034] As an example, the security label corresponding to a user is mainly used to identify the user's permissions when modifying existing data and to control the security labels that can be used when adding new data. When a user reads (SELECT), modifies (UPDATE), or deletes (DELETE) tagged data, it is necessary to authenticate according to the level, domain, and group set by the super administrator, as well as their read and write attributes. When a user adds new data (INSERT), the data security label comes from the user security label set by the super user. The user labels include maximum read, maximum write, minimum write, default read label, and default write label. (1) Maximum read label indicates the maximum level, domain, and group that the user can read. (2) Maximum write label indicates the maximum data label that the user can use when inserting data. The maximum level, group, and domain of the data can be specified. If the maximum write label is not set, the maximum write label defaults to the maximum read label to ensure the principle of being able to write and read. (3) Minimum write label, which only contains the level without the domain and group, indicates the minimum data label that the user can use when adding new data. (4) Default read label, the initialization session label used when the user initiates a connection. If not specified, the default is the maximum read label. (5) Default write tag: The default write tag used when the user adds new data without specifying a security tag.

[0035] As an optional implementation, please continue to refer to Figure 3 , Figure 3 This is a schematic diagram of the execution flow of performing tag management operations in the database data table security access method provided by the embodiment of the present application, such as Figure 3 As shown, after the above step of using security tags to create corresponding data tag security policies and user tag security policies according to security requirements, the following steps S14 to S16 may be specifically included.

[0036] S14. Receive tag management operations on security tags from the security officer account.

[0037] Among them, after receiving the tag management operation, the tag management operation can also be parsed to obtain the target security tag that the tag management operation needs to operate, and at the same time check whether the target security tag exists in the target database. If it does not exist, the response to the tag management operation can be directly terminated. If it exists, the following step S15 can be continued.

[0038] S15. If the tag management operation is to delete the target security tag, check whether the target security tag is referenced by the data tag security policy and / or the user tag security policy.

[0039] S16: If the target security label is referenced, the label management operation is terminated because if the security label that is in use (ie, referenced in step S16) is deleted, data security access problems may occur.

[0040] S2. Obtain the user table and data table of the target database, configure the user tag security policy to the user table, and configure the data tag security policy to the data table.

[0041] S3. Apply the data label security policy to the data table and create a corresponding security label column in the data table.

[0042] As an optional implementation, please continue to refer to Figure 4 , Figure 4 This is a schematic diagram of the execution flow of writing a security tag value in the database data table security access method provided by the embodiment of the present application, such as Figure 4 As shown, the above step S3 may specifically include the following steps S31 to S33.

[0043] S31. Create a corresponding security label column in the data table according to the preset data column name, wherein the data type of the security label column is an integer type.

[0044] S32. Analyze the data tag security policy, obtain the corresponding security tag, and convert the corresponding security tag into a security tag value.

[0045] The process of converting the security tag into the security tag value may be based on pre-set corresponding conversion rules.

[0046] S33. Write the security tag value into the security tag column.

[0047] As another optional implementation, please refer to Figure 5 , Figure 5 This is a schematic diagram of the execution flow of updating the data dictionary in the database data table security access method provided by the embodiment of the present application, such as Figure 5 As shown, after the above step S3, the following steps S34 to S36 may also be included.

[0048] S34. Update the data dictionary corresponding to the target database according to the security label column of the data table.

[0049] A database's data dictionary is a collection of metadata that describes the structure, elements, attributes, and relationships between the data stored in the database. The data dictionary provides detailed information about the data in the database, helping users understand the database's composition and structure, as well as the meaning and purpose of the data.

[0050] S35. Verify whether the updated information in the data dictionary is consistent with the structural information of the target database.

[0051] S36. If they are consistent, update the current version corresponding to the data dictionary and store the current version and current system time.

[0052] In addition to storing the current version and current system time, it can also store the update information corresponding to the data dictionary, so that database management users can perform corresponding security access problem troubleshooting based on the version upgrade record of the data dictionary.

[0053] S4. Create a corresponding row-level security policy for the data table based on the security label column, where the row-level security policy includes a label check function.

[0054] After the above step S4, a data security trigger corresponding to the above data table may be created according to the above data tag security policy.

[0055] S5. When a data request from an access user is received, a first security tag corresponding to the access user is obtained from the user table, and a second security tag corresponding to the security tag column of the data row in the data table corresponding to the data request is obtained.

[0056] As an optional implementation, please continue to refer to Figure 6 , Figure 6 This is a schematic diagram of the execution flow of the policy management operation in the database data table security access method provided by the embodiment of the present application, such as Figure 6 As shown, after the above step of using security tags to create corresponding data tag security policies and user tag security policies according to security requirements, the following steps S11 to S13 may be specifically included.

[0057] S11. Receive policy management operations of the security officer account on data tag security policies and user tag security policies.

[0058] S12. If the policy management operation is to disable the policy, when a data request from an access user is received, a matching check between the first security tag and the second security tag is not performed, and the data operation corresponding to the data request is directly performed.

[0059] S13. If the policy management operation is to delete the policy, the data label security policy, the user label security policy, and the security label column in the data table are deleted.

[0060] Among them, when deleting a policy, the deleted data label security policy also needs to be verified to detect whether the data label security policy to be deleted is being used. If it is being used, the deletion operation can be omitted. If the super administrator user or security officer user of the database continues to issue forced deletion instructions, the above-mentioned deletion operation will be executed.

[0061] As an optional implementation, please continue to refer to Figure 7 , Figure 7 : is a schematic diagram of the execution flow of executing a data request in the database data table security access method provided in the embodiment of the present application, such as Figure 7 As shown, after the above step of creating the corresponding data security trigger, when a data access request from a user is received, the following steps S51 to S54 may also be included.

[0062] S51: If the data operation corresponding to the data request is a row-level update operation, compare the data of the security label column in the new tuple and the old tuple in the data security trigger to see whether there is any change.

[0063] S52: If there is a change, check whether the data in the security label column of the new tuple and the old tuple are in a containment or contained relationship.

[0064] S53: If it is a containment or contained relationship, verify whether the accessing user has specific authority over the data row in the data table corresponding to the data request.

[0065] S54. If there is no specific permission, the data request is terminated and a corresponding data request security exception message is thrown.

[0066] Among them, by comparing the changes of the new tuple and the old tuple of the data security trigger and detecting the data relationship of the corresponding security label, effective access security protection can also be performed on the data in the data table.

[0067] As another optional implementation, after the above step of receiving a request to access user data, the following steps S55 to S57 may be further included.

[0068] S55. Intercept data requests by injecting an interface using a preset custom command processor.

[0069] S56. Check whether the data request is to delete the data tag security policy or data security trigger.

[0070] S57: If it is a deletion, the data request is terminated and a corresponding data request security exception message is thrown.

[0071] Among them, by pre-intercepting data requests and determining whether the data request is to delete security policies or data security triggers, the problem of invalidation of the security access mechanism of the created database data table can be effectively prevented.

[0072] S6. Check whether the first security tag and the second security tag match according to the tag check function. If they match, execute the data operation corresponding to the data request.

[0073] The embodiment of the present application provides a method for secure access to a database table, which creates a security label corresponding to a target database, uses the security label to create a corresponding data label security policy and a user label security policy; obtains a user table and a data table, configures the user label security policy to the user table, and configures the data label security policy to the data table; applies the data label security policy to the data table, and creates a security label column in the data table; creates a corresponding row-level security policy for the data table according to the security label column; when a data request from an access user is received, obtains a first security label corresponding to the access user, and obtains a second security label in the security label column for the data row in the data table corresponding to the data request; checks whether the first security label and the second security label match, and if so, executes the data operation corresponding to the data request, thereby achieving secure access to the database table in a simpler way and solving the risk of failure of the security access mechanism.

[0074] Please continue reading Figure 8 , Figure 8 This is a schematic diagram of the system structure of a database data table security access device provided by the embodiment of the present application. Figure 8 As shown, the apparatus 80 includes: a security policy creation module 81 , a security policy configuration module 82 , a security label column module 83 , a row-level security policy module 84 , a security label acquisition module 85 and a security label checking module 86 .

[0075] The security policy creation module 81 is used to create security labels corresponding to the target database by presetting the security officer account permissions, and use the security labels to create corresponding data label security policies and user label security policies according to security requirements;

[0076] The security policy configuration module 82 is used to obtain the user table and data table of the target database, configure the user tag security policy to the user table, and configure the data tag security policy to the data table;

[0077] The security label column module 83 is used to apply the data label security policy on the data table and create a corresponding security label column in the data table;

[0078] The row-level security policy module 84 is used to create a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function;

[0079] The security tag acquisition module 85 is configured to, upon receiving a data request from an accessing user, acquire a first security tag corresponding to the accessing user from the user table, and acquire a second security tag corresponding to the security tag column of the data row in the data table corresponding to the data request;

[0080] The security tag checking module 86 is configured to check whether the first security tag and the second security tag match according to the tag checking function, and if so, execute the data operation corresponding to the data request.

[0081] As an optional implementation, the row-level security policy module 84 is also used to create a data security trigger corresponding to the data table according to the data label security policy; after the step of receiving the data request from the access user, it also includes: if the data operation corresponding to the data request is a row-level update operation, then compare whether the data of the security label column in the new tuple and the old tuple in the data security trigger has changed; if it has changed, check whether the data of the security label column in the new tuple and the old tuple is a containment or contained relationship; if it is a containment or contained relationship, check whether the access user has specific permissions for the data row in the data table corresponding to the data request; if there is no specific permission, terminate the data request and throw a corresponding data request security exception information.

[0082] As an optional implementation, the security label column module 83 is also used to create a corresponding security label column in the data table according to a preset data column name, wherein the data type of the security label column is an integer type; parse the data label security policy to obtain the corresponding security label, and convert the corresponding security label into a security label value; and write the security label value to the security label column.

[0083] As an optional implementation, the security label column module 83 is also used to update the data dictionary corresponding to the target database based on the security label column of the data table; verify whether the updated information of the data dictionary is consistent with the structural information of the target database; if consistent, update the current version corresponding to the data dictionary, and store the current version and current system time.

[0084] As an optional implementation, the security tag acquisition module 85 is also used to intercept the data request through a preset custom command processor injection interface; check whether the data request is to delete the data tag security policy or the data security trigger; if it is to delete, terminate the data request and throw a corresponding data request security exception information.

[0085] As an optional implementation, the security policy creation module 81 is also used to receive the policy management operations of the security officer account on the data tag security policy and the user tag security policy; if the policy management operation is to disable the policy, then when a data request from an access user is received, the matching check of the first security tag and the second security tag is not performed, and the data operation corresponding to the data request is directly executed; if the policy management operation is to delete the policy, then the data tag security policy, the user tag security policy, and the security tag column in the data table are deleted.

[0086] As an optional implementation, the security policy creation module 81 is also used to receive the tag management operation of the security officer account on the security tag; if the tag management operation is to delete the target security tag, it is checked whether the target security tag is referenced by the data tag security policy and / or the user tag security policy; if the target security tag is referenced, the tag management operation is terminated.

[0087] It should be noted that the aforementioned database data table security access device can execute the database data table security access method provided in the embodiments of this application, and has the corresponding functional modules and beneficial effects of the execution method. For technical details not fully described in the embodiments of the database data table security access device, please refer to the database data table security access method provided in the embodiments of this application.

[0088] Figure 9 Schematic diagram of the hardware structure of the electronic device 900 for executing the database data table security access method provided in the embodiment of the present application. Figure 9 As shown, the electronic device 900 includes:

[0089] One or more processors 910 and memory 920, Figure 9 A processor 910 is taken as an example.

[0090] The processor 910 and the memory 920 may be connected via a bus or other means. Figure 9 The bus connection is taken as an example.

[0091] Memory 920, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs, and modules, such as the program instructions / modules corresponding to the database data table secure access method in the embodiments of the present application. Processor 910 executes the non-volatile software programs, instructions, and modules stored in memory 920 to execute various server functional applications and data processing, thereby implementing the database data table secure access method in the above method embodiment.

[0092] The memory 920 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the database data table security access device, etc. In addition, the memory 920 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 920 may optionally include a memory remotely located relative to the processor 910, and these remote memories may be connected to the database data table security access device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0093] The one or more modules are stored in the memory 920, and when executed by the one or more processors 910, execute the database data table security access method in any of the above method embodiments, for example, execute the above described Figure 2 Steps S1 to S6 of the method, Figure 3 Steps S11 to S13 of the method, Figure 4 Steps S14 to S16 of the method, Figure 5 Steps S31 to S33 of the method, Figure 6 Steps S34 to S36 of the method, Figure 7 Steps S51 to S54 of the method are implemented Figure 8 The functions of modules 81-86 in.

[0094] The above-mentioned product can execute the method provided in the embodiment of this application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided in the embodiment of this application.

[0095] An embodiment of the present application provides a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by one or more processors, for example Figure 9A processor 910 in the embodiment may enable the one or more processors to execute the database data table security access method in any of the above method embodiments, for example, executing the above described Figure 2 Steps S1 to S6 of the method, Figure 3 Steps S11 to S13 of the method, Figure 4 Steps S14 to S16 of the method, Figure 5 Steps S31 to S33 of the method, Figure 6 Steps S34 to S36 of the method, Figure 7 Steps S51 to S54 of the method are implemented Figure 8 The functions of modules 81-86 in.

[0096] The embodiment of the present application provides a computer program product, which includes a computer program stored on a non-volatile computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by the electronic device, the electronic device is enabled to perform the database data table security access method in any of the above method embodiments, for example, performing the above described Figure 2 Steps S1 to S6 of the method, Figure 3 Steps S11 to S13 of the method, Figure 4 Steps S14 to S16 of the method, Figure 5 Steps S31 to S33 of the method, Figure 6 Steps S34 to S36 of the method, Figure 7 Steps S51 to S54 of the method are implemented Figure 8 The functions of modules 81-86 in.

[0097] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0098] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, or of course by hardware. Those skilled in the art can understand that all or part of the processes in the above embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0099] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Based on the concept of the present application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of the different aspects of the present application as described above. For the sake of simplicity, they are not provided in detail. Although the present application has been described in detail with reference to the above embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features can be replaced by equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application. The non-Company software tools or components that appear in the embodiments of the present application are merely examples and do not represent actual use.

Claims

1. A method for securely accessing a data table of a database, characterized in that: include: Create security labels corresponding to the target database by presetting the security officer account permissions, and use the security labels to create corresponding data label security policies and user label security policies according to security requirements; Obtain the user table and data table of the target database, configure the user tag security policy to the user table, and configure the data tag security policy to the data table; Applying the data tag security policy on the data table and creating a corresponding security tag column in the data table; Creating a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function; When receiving a data request from an access user, obtaining a first security tag corresponding to the access user from the user table, and obtaining a second security tag corresponding to the security tag column of the data row in the data table corresponding to the data request; checking whether the first security tag and the second security tag match according to the tag checking function, and if they do, executing the data operation corresponding to the data request; The step of creating a corresponding row-level security policy for the data table based on the security label column, wherein the row-level security policy includes a label check function, further comprising: creating a data security trigger corresponding to the data table based on the data label security policy; after the step of receiving a data request from an accessing user, further comprising: if the data operation corresponding to the data request is a row-level update operation, comparing the data of the security label column in the new tuple and the old tuple in the data security trigger to see if there is any change; if there is any change, checking whether the data of the security label column in the new tuple and the old tuple is in a containment or contained relationship; if it is a containment or contained relationship, verifying whether the accessing user has specific permissions to the data row in the data table corresponding to the data request; if there is no specific permission, terminating the data request and throwing a corresponding data request security exception message.

2. The method for securely accessing a database table according to claim 1, wherein: The step of applying the data tag security policy on the data table and creating a corresponding security tag column in the data table includes: Creating a corresponding security label column in the data table according to a preset data column name, wherein the data type of the security label column is an integer type; Parsing the data tag security policy to obtain a corresponding security tag, and converting the corresponding security tag into a security tag value; Writing the security tag value to the security tag column.

3. The method for securely accessing a database table according to claim 1, wherein: After the step of applying the data tag security policy on the data table and creating a corresponding security tag column in the data table, the method further includes: Update the data dictionary corresponding to the target database according to the security label column of the data table; Verifying whether the updated information in the data dictionary is consistent with the structural information of the target database; If they are consistent, the current version corresponding to the data dictionary is updated, and the current version and current system time are stored.

4. The method for securely accessing a database table according to claim 1, wherein: After the step of receiving a request to access user data, the method further includes: Intercept the data request by injecting an interface into a preset custom command processor; Checking whether the data request is to delete the data tag security policy or the data security trigger; If it is a deletion, the data request is terminated and a corresponding data request security exception message is thrown.

5. The method for securely accessing a database table according to claim 1, wherein: After the step of using the security tag to create a corresponding data tag security policy and user tag security policy according to security requirements, the method further includes: receiving a policy management operation of the security officer account on the data tag security policy and the user tag security policy; If the policy management operation is to disable the policy, when receiving a data request from an access user, a matching check between the first security tag and the second security tag is not performed, and the data operation corresponding to the data request is directly performed; If the policy management operation is to delete a policy, the data tag security policy, the user tag security policy, and the security tag column in the data table are deleted.

6. The method for securely accessing a database table according to claim 1, wherein: After the step of using the security tag to create a corresponding data tag security policy and user tag security policy according to security requirements, the method further includes: receiving a tag management operation on the security tag from the security officer account; If the tag management operation is to delete the target security tag, checking whether the target security tag is referenced by the data tag security policy and / or the user tag security policy; If the target security label is referenced, the label management operation is terminated.

7. A data table security access device for a database, characterized in that: include: A security policy creation module is used to create security labels corresponding to the target database by presetting the security officer account permissions, and use the security labels to create corresponding data label security policies and user label security policies according to security requirements; A security policy configuration module is used to obtain the user table and data table of the target database, configure the user tag security policy to the user table, and configure the data tag security policy to the data table; A security label column module, configured to apply the data label security policy to the data table and create a corresponding security label column in the data table; A row-level security policy module, configured to create a corresponding row-level security policy for the data table according to the security label column, wherein the row-level security policy includes a label check function; a security tag acquisition module configured to, upon receiving a data request from an access user, acquire from the user table a first security tag corresponding to the access user, and acquire from the data table a second security tag corresponding to the security tag column of the data row corresponding to the data request; a security tag checking module, configured to check whether the first security tag and the second security tag match according to the tag checking function, and if so, perform a data operation corresponding to the data request; Among them, the row-level security policy module is also used to create a data security trigger corresponding to the data table according to the data label security policy; after the step of receiving the data request of the access user, it also includes: if the data operation corresponding to the data request is a row-level update operation, then compare the data of the security label column in the new tuple and the old tuple in the data security trigger to see if it has changed; if it has changed, check whether the data in the security label column in the new tuple and the old tuple is a containment or contained relationship; if it is a containment or contained relationship, check whether the access user has specific permissions for the data row in the data table corresponding to the data request; if there is no specific permission, terminate the data request and throw a corresponding data request security exception information.

8. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method for securely accessing a data table of a database according to any one of claims 1 to 6.

9. A non-volatile computer-readable storage medium, characterized in that: The non-volatile computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are executed by an electronic device, the electronic device executes the method for securely accessing a database table according to any one of claims 1 to 6.

Images