Data authority control method and device and related product

Abstract

The invention discloses a data permission control method and device and a related product. Obtaining a data access method, a data access statement under the data access method and access permission information corresponding to a data access request of an access person; analyzing the data access method and the access permission information to obtain a first access permission type and a first access permission attribute in the data access method and a second access permission type and a second access permission attribute in the access permission information; and if the first access permission type is the same as the second access permission type, modifying the data access statement according to the first access permission attribute and the second access permission attribute to obtain the modified data access statement so as to complete data permission control. Therefore, modification of the data access statement can be realized based on the first access permission attribute in the data access method and the second access permission attribute in the access permission information, so that the flexibility of data permission control is improved.

Description

Technical Field

[0001] The present application relates to the technical field of data authority control, and in particular to a data authority control method, device and related products. Background Art

[0002] Data permission control is an important security control method, which can limit the data that users can access according to their roles in a multi-user system. In the related art, corresponding code statements are usually generated according to the business needs of each user, and the code statements can implement data permission control, so that data access can be achieved based on the code statements during the data access process. However, since the business needs of users may change, the corresponding code statements need to be regenerated at this time, which may result in poor flexibility of data permission control. Therefore, how to improve the flexibility of data permission control is a key issue that technicians in this field are concerned about. Summary of the invention

[0003] Based on the above problems, the present application provides a data permission control method, device and related products to improve the flexibility of data permission control.

[0004] The embodiments of the present application disclose the following technical solutions:

[0005] The first aspect of the present application provides a data authority control method. The data authority control method includes:

[0006] Acquire a data access method, a data access statement under the data access method, and access permission information corresponding to a data access request of an access person, wherein the data access method is used to support access to the data access request according to the data access statement;

[0007] Parsing the data access method and the access permission information to obtain a first access permission type and a first access permission attribute in the data access method, and a second access permission type and a second access permission attribute in the access permission information;

[0008] If the first access permission type and the second access permission type are the same, the data access statement is modified according to the first access permission attribute and the second access permission attribute to obtain a modified data access statement to complete data permission control.

[0009] In an achievable implementation manner, before parsing the data access method and the access permission information to obtain the first access permission type and the first access permission attribute in the data access method and the second access permission type and the second access permission attribute in the access permission information, the method further includes:

[0010] Based on the interceptor, the data access method is intercepted and processed to obtain the interception result corresponding to the data access method;

[0011] The parsing of the data access method and the access permission information to obtain the first access permission type and the first access permission attribute in the data access method, and the second access permission type and the second access permission attribute in the access permission information includes:

[0012] If the interception result corresponding to the data access method indicates that there is a data permission annotation in the data access method, performing method parsing on the data access method to obtain a first data permission type, a first data operation type, and a first access permission attribute in the data access method, and performing information parsing on the access permission information to obtain a second data permission type, a second data operation type, and a second access permission attribute in the access permission information;

[0013] The first data permission type and the first data operation type in the data access method are used as the first access permission type in the data access method, and the second data permission type and the second data operation type in the access permission information are used as the second access permission type in the access permission information.

[0014] In an achievable implementation manner, the first access permission attribute includes an access data attribute and an attribute value corresponding to the access data attribute, and the second access permission attribute includes an identity permission attribute and an attribute value corresponding to the identity permission attribute;

[0015] If the first access permission type and the second access permission type are the same, modifying the data access statement according to the first access permission attribute and the second access permission attribute to obtain a modified data access statement to complete data permission control, including:

[0016] If the first data permission type is the same as the second data permission type, and the first data operation type is the same as the second data operation type, converting the access data attribute and the identity permission attribute to obtain a data attribute placeholder corresponding to the access data attribute and a permission attribute placeholder corresponding to the identity permission attribute;

[0017] The data access statement is modified according to the data attribute placeholder, the attribute value corresponding to the access data attribute, the permission attribute placeholder and the attribute value corresponding to the identity permission attribute to obtain a modified data access statement to complete data permission control.

[0018] In an achievable implementation, the data access statement is modified according to the data attribute placeholder, the attribute value corresponding to the access data attribute, the permission attribute placeholder and the attribute value corresponding to the identity permission attribute to obtain a modified data access statement to complete data permission control, including:

[0019] According to the data attribute placeholder, determine a first attribute placeholder in the data access statement corresponding to the data attribute placeholder, and according to the permission attribute placeholder, determine a second attribute placeholder in the data access statement corresponding to the permission attribute placeholder;

[0020] The first attribute placeholder is replaced according to the attribute value corresponding to the access data attribute to obtain the replaced first attribute placeholder, and the second attribute placeholder is replaced according to the attribute value corresponding to the identity authority attribute to obtain the replaced second attribute placeholder;

[0021] According to the replaced first attribute placeholder and the replaced second attribute placeholder, a modified data access statement is obtained to complete data authority control.

[0022] In an achievable implementation, obtaining a modified data access statement according to the replaced first attribute placeholder and the replaced second attribute placeholder to complete data authority control includes:

[0023] Generate a data permission character string according to the replaced first attribute placeholder and the replaced second attribute placeholder;

[0024] If there is a target placeholder in the data access statement, the target placeholder in the data access statement is replaced with the data permission string to obtain a modified data access statement to complete data permission control;

[0025] Or if the target placeholder does not exist in the data access statement, the data permission character string is concatenated after the data access statement to obtain a modified data access statement to complete data permission control.

[0026] In an achievable implementation, the data access method includes a DAO method, the interceptor includes a Mybatis interceptor and a Hibernate interceptor, the data permission annotation includes a DataPermission annotation, and the target placeholder includes a DATA_PERMISSION_CONDITION placeholder.

[0027] In an achievable implementation manner, before obtaining the data access method, the data access statement under the data access method, and the access right information corresponding to the data access request of the access person, the method further includes:

[0028] Obtain data access requests submitted by access personnel;

[0029] The method for obtaining data access, the data access statement under the data access method, and the access right information corresponding to the data access request of the access personnel include:

[0030] receiving request conversion information submitted by an operator for the data access request, and using the request conversion information as access permission information corresponding to the data access request of the access operator;

[0031] Receiving a data access method submitted by the operator for the access permission information;

[0032] According to the data access method, a data access statement under the data access method is obtained.

[0033] A second aspect of the present application provides a data authority control device. The data authority control device comprises:

[0034] an access information acquisition unit, used to acquire access permission information corresponding to a data access method, a data access statement under the data access method, and a data access request of an access person, wherein the data access method is used to support access to the data access request according to the data access statement;

[0035] an access information parsing unit, configured to parse the data access method and the access permission information to obtain a first access permission type and a first access permission attribute in the data access method, and a second access permission type and a second access permission attribute in the access permission information;

[0036] An access statement modification unit is used to modify the data access statement according to the first access permission attribute and the second access permission attribute if the first access permission type and the second access permission type are the same, to obtain a modified data access statement to complete data permission control.

[0037] In one feasible embodiment, the device further includes:

[0038] An interception result obtaining unit, used to intercept the data access method based on the interceptor, and obtain an interception result corresponding to the data access method;

[0039] The access information parsing unit is specifically used to:

[0040] If the interception result corresponding to the data access method indicates that there is a data permission annotation in the data access method, performing method parsing on the data access method to obtain a first data permission type, a first data operation type, and a first access permission attribute in the data access method, and performing information parsing on the access permission information to obtain a second data permission type, a second data operation type, and a second access permission attribute in the access permission information;

[0041] The first data permission type and the first data operation type in the data access method are used as the first access permission type in the data access method, and the second data permission type and the second data operation type in the access permission information are used as the second access permission type in the access permission information.

[0042] In an achievable implementation manner, the first access permission attribute includes an access data attribute and an attribute value corresponding to the access data attribute, and the second access permission attribute includes an identity permission attribute and an attribute value corresponding to the identity permission attribute;

[0043] The access statement modification unit includes:

[0044] an attribute conversion processing unit, configured to, if the first data permission type is the same as the second data permission type, and the first data operation type is the same as the second data operation type, convert the access data attribute and the identity permission attribute to obtain a data attribute placeholder corresponding to the access data attribute and a permission attribute placeholder corresponding to the identity permission attribute;

[0045] The attribute statement modification unit is used to modify the data access statement according to the data attribute placeholder, the attribute value corresponding to the access data attribute, the permission attribute placeholder and the attribute value corresponding to the identity permission attribute, and obtain the modified data access statement to complete data permission control.

[0046] In an achievable implementation manner, the attribute statement modification unit includes:

[0047] an attribute placeholder determination unit, configured to determine, according to the data attribute placeholder, a first attribute placeholder in the data access statement corresponding to the data attribute placeholder, and, according to the permission attribute placeholder, determine a second attribute placeholder in the data access statement corresponding to the permission attribute placeholder;

[0048] an attribute placeholder replacement unit, configured to replace the first attribute placeholder according to the attribute value corresponding to the access data attribute to obtain the replaced first attribute placeholder, and replace the second attribute placeholder according to the attribute value corresponding to the identity authority attribute to obtain the replaced second attribute placeholder;

[0049] The attribute placeholder modification unit is used to obtain a modified data access statement according to the replaced first attribute placeholder and the replaced second attribute placeholder to complete data authority control.

[0050] In an achievable implementation manner, the attribute placeholder modification unit is specifically used to:

[0051] Generate a data permission character string according to the replaced first attribute placeholder and the replaced second attribute placeholder;

[0052] If there is a target placeholder in the data access statement, the target placeholder in the data access statement is replaced with the data permission string to obtain a modified data access statement to complete data permission control;

[0053] Or if the target placeholder does not exist in the data access statement, the data permission character string is concatenated after the data access statement to obtain a modified data access statement to complete data permission control.

[0054] In an achievable implementation, the data access method includes a DAO method, the interceptor includes a Mybatis interceptor and a Hibernate interceptor, the data permission annotation includes a DataPermission annotation, and the target placeholder includes a DATA_PERMISSION_CONDITION placeholder.

[0055] In one feasible embodiment, the device further includes:

[0056] An access request acquisition unit, used to acquire a data access request submitted by an access person;

[0057] The access information acquisition unit is specifically used to:

[0058] receiving request conversion information submitted by an operator for the data access request, and using the request conversion information as access permission information corresponding to the data access request of the access operator;

[0059] Receiving a data access method submitted by the operator for the access permission information;

[0060] According to the data access method, a data access statement under the data access method is obtained.

[0061] A third aspect of the present application provides a computer device. The computer device includes:

[0062] a memory having a computer program stored thereon;

[0063] A processor is used to execute the computer program in the memory to implement the steps of the data authority control method provided in the first aspect.

[0064] A fourth aspect of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the data authority control method provided in the first aspect are implemented.

[0065] Compared with the prior art, this application has the following beneficial effects:

[0066] In the present application, firstly, the data access method, the data access statement under the data access method, and the access permission information corresponding to the data access request of the access personnel can be obtained; thereafter, the data access method and the access permission information can be parsed and processed to obtain the first access permission type and the first access permission attribute in the data access method, as well as the second access permission type and the second access permission attribute in the access permission information; finally, if the first access permission type and the second access permission type are the same, the data access statement is modified according to the first access permission attribute and the second access permission attribute to obtain the modified data access statement to complete the data permission control.

[0067] It can be seen that in this application, when the first access permission type in the data access method and the second access permission type in the access permission information are the same, the data access statement can be modified according to the first access permission attribute in the data access method and the second access permission attribute in the access permission information corresponding to the data access request of the access personnel, so that the modified data access statement can meet the data access needs of the access personnel. In this way, in this application, the data access statement can be further adjusted according to the access permission information of different access personnel, thereby improving the modification flexibility of the data access statement and the flexibility of data permission control. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0069] Figure 1 A flowchart of a data authority control method provided in an embodiment of the present application;

[0070] Figure 2 A flowchart of interception processing in a data authority control method provided in an embodiment of the present application;

[0071] Figure 3 A flowchart of interception processing in another data authority control method provided in an embodiment of the present application;

[0072] Figure 4 A flowchart for modifying a data access statement in a data authority control method provided in an embodiment of the present application;

[0073] Figure 5 A full flow chart of data authority control in a data authority control method provided in an embodiment of the present application;

[0074] Figure 6 A schematic diagram of the structure of a data permission control device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] As described above, data permission control is an important security control method, which can limit the data that users can access based on their roles in a multi-user system. For example, if user A can only access the data of the department where user A is located, then data permission control can prevent user A from accessing data from other departments, thereby improving data security.

[0076] In the related art, corresponding code statements are usually generated based on the business needs of each user, and the code statements can implement data permission control, so that data access can be implemented based on the code statements during the data access process. However, since the business needs of users may change, the corresponding code statements need to be regenerated at this time, which may result in poor flexibility in data permission control.

[0077] It is understandable that if user A can only access the data of the department where user A is located (i.e., department A), the code statement generated at this time includes the code statements of user A and department A, so that during the data access process, access to the data under department A can be achieved according to the code statement. And when user A can only access the data of the department where user A is located (i.e., department B), the code statement needs to be regenerated, that is, the code statement generated at this time includes the code statements of user A and department B. This may, to a certain extent, lead to poor flexibility in data permission control. Therefore, how to improve the flexibility of data permission control is a key issue that technicians in this field are concerned about.

[0078] In view of the above problems, a solution is provided in the embodiment of the present application, and a data permission control method, device and related products are proposed, aiming to improve the flexibility of data permission control. In the technical solution of the present application, the data access method, the data access statement under the data access method and the access right information corresponding to the data access request of the access personnel can be obtained first, and then the data access method and the access right information can be parsed and processed to obtain the first access right type and the first access right attribute in the data access method, as well as the second access right type and the second access right attribute in the access right information. Finally, it is determined whether the first access right type and the second access right type are the same. If the first access right type and the second access right type are the same, the data access statement is modified according to the first access right attribute and the second access right attribute to obtain the modified data access statement to complete the data permission control.

[0079] It can be seen that in this application, when the first access permission type in the data access method and the second access permission type in the access permission information are the same, the data access statement can be modified according to the first access permission attribute in the data access method and the second access permission attribute in the access permission information corresponding to the data access request of the access personnel, so that the modified data access statement can meet the data access needs of the access personnel. In this way, in this application, the data access statement can be further adjusted according to the access permission information of different access personnel, thereby improving the modification flexibility of the data access statement, the flexibility of data permission control, and the access convenience of the access personnel.

[0080] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0081] Next, the technical terms that may appear in this application are explained.

[0082] DAO method: Data Access Objects, data access object, is a commonly used design pattern in software development. The DAO method is mainly used to implement data access based on data access statements.

[0083] See also Figure 1 , which is a flow chart of a data authority control method provided by an embodiment of the present application. Figure 1 The data permission control method shown includes:

[0084] S101: Acquire a data access method, a data access statement under the data access method, and access permission information corresponding to a data access request of an access person.

[0085] In this step, the data access method includes a DAO method, and the data access method is used to support access to data access requests according to data access statements, that is, the application can execute the data access statement under the action of the data access method to achieve access to the data access request. The data access request can be understood as a request to access data, and the data access request can also be understood as a request to download data, and the data access request is not limited here.

[0086] It should be noted that before executing the operation of obtaining the data access method, the data access statement under the data access method, and the access permission information corresponding to the data access request of the access personnel, the application can also obtain the data access request submitted by the access personnel through the request interceptor, wherein the request interceptor is applicable in Dubbo, Web, gRPC, etc. For example: in the teaching system, the access personnel can submit the score query request corresponding to the access personnel in the teaching system, and the score query request can be used as a data access request.

[0087] Furthermore, the operator can call a preset conversion model to convert the data access request to obtain the request conversion information corresponding to the data access request, wherein the preset conversion model supports local calls or remote service calls, which are not specifically limited here. And the preset conversion model can support the conversion of data access requests into a unified data permission information format to facilitate subsequent control of data permissions. It should be noted that at this time, the operator can also add custom information to the request conversion information to further realize the control and adjustment of the data permissions of the access personnel.

[0088] And the request conversion information corresponding to the data access request can be submitted to the server. At this time, the server can use the request conversion information as the access permission information corresponding to the data access request of the access personnel, and can store the access permission information in the permission information context, wherein the permission information context is used to store the access permission information in the local thread cache, and support the extraction of the access permission information in subsequent processes.

[0089] And the operating personnel can annotate the initial data access method according to the access permission information, that is, the data permission annotation can be annotated on the initial data access method to obtain the data access method, wherein the data permission annotation includes the DataPermission annotation, and the data permission annotation can annotate the data permission information of the access personnel (that is, it can know what kind of data the access personnel needs to access according to the data access request, and annotate the attributes of this kind of data in the data permission annotation, so that in the subsequent process, the data access method can implement data permission control based on the data permission annotation). In this way, in this application, it is only necessary to add the corresponding data permission annotation to the initial data access method to adapt to the data access needs of different access personnel. Its integration is simple, and it decouples the data access requirements and fixed code statements to a certain extent.

[0090] In one example, the data permission annotation can be @DataPermission(userAlias="",userIdColum="id",deptAlias="",deptIdColumn="dept_id",supportTypes="{DpTypes.USER,DpTypes.DEPT_AND_CHILD}). This data permission annotation indicates that only the accessor is allowed to query the personnel information corresponding to the accessor, and the department information corresponding to the department and sub-department to which the accessor belongs. It should be noted that the data permission annotations here are only some examples and are not specifically limited here.

[0091] And the data access method can be submitted to the server, at which time the server can receive the data access method, and can obtain the data access statement under the data access method according to the data access method. It can be understood that when the server calls the data access method, it can obtain the data access statement to achieve access to the data access request. This lays the foundation for the subsequent modification of the data access statement, improves the modification efficiency of the data access statement to a certain extent, and improves the scalability of data permission control.

[0092] S102: Parse the data access method and the access permission information to obtain a first access permission type and a first access permission attribute in the data access method, and a second access permission type and a second access permission attribute in the access permission information.

[0093] It should be noted that, before the application performs the parsing process on the data access method and the access right information to obtain the first access right type and the first access right attribute in the data access method, and the second access right type and the second access right attribute in the access right information, it can also intercept the data access method based on the interceptor to obtain the interception result corresponding to the data access method, wherein the interceptor includes the Mybatis interceptor and the Hibernate interceptor, and the Mybatis interceptor and the Hibernate interceptor can also be used to implement the operations of step S102 and step S103. In this way, the difficulty of traditional Spring integrated data permission control is reduced and the completeness of data permission control is improved.

[0094] Next, we will introduce the process of intercepting data access methods through Mybatis interceptors and Hibernate interceptors. Figure 2 As shown, Figure 2 A flowchart of interception processing in a data authority control method provided in an embodiment of the present application, Figure 2 The process of intercepting the data access method based on the Mybatis interceptor and obtaining the interception result corresponding to the data access method is shown, wherein the Mybatis interceptor can also be a Mybatis-Plus interceptor.

[0095] Specifically, in Figure 2 After obtaining the data access method and the data access statement, the present application can intercept the data access method based on the Mybatis interceptor or the Mybatis-Plus interceptor to obtain the interception result corresponding to the data access method, that is, it can parse whether there is a data permission annotation in the data access statement in the data access method based on the Interceptor in the Mybatis interceptor or the Mybatis-Plus interceptor. The interception result can indicate that there is a data permission annotation in the data access method, and the interception result can also indicate that there is no data permission annotation in the data access method. After that, if the interception result corresponding to the data access method indicates that there is a data permission annotation in the data access method, the access permission information can be obtained from the permission information context to execute step S102.

[0096] like Figure 3 As shown, Figure 3 A flowchart of interception processing in another data authority control method provided in an embodiment of the present application, Figure 3 The following figure shows the process of intercepting the data access method based on Hibernate interceptor and obtaining the interception result corresponding to the data access method. Figure 3After obtaining the data access method and data access statement, the present application can intercept the data access method based on the AOP aspect under the action of the Hibernate interceptor to obtain the interception result corresponding to the data access method, that is, it can analyze whether there is a data permission annotation in the data access statement in the data access method based on the AOP aspect under the action of the Hibernate interceptor.

[0097] The interception result may indicate that a data permission annotation exists in the data access method, or may indicate that a data permission annotation does not exist in the data access method. Afterwards, if the interception result corresponding to the data access method indicates that a data permission annotation exists in the data access method, access permission information may be obtained from the permission information context based on the StatementInterceptor in the Hibernate interceptor to execute step S102.

[0098] Furthermore, in this step, it can be first determined whether the interception result corresponding to the data access method indicates that there is a data permission annotation in the data access method. If the interception result corresponding to the data access method indicates that there is a data permission annotation in the data access method, the data access method is parsed to obtain the first data permission type, the first data operation type and the first access permission attribute in the data access method, and the access permission information is parsed to obtain the second data permission type, the second data operation type and the second access permission attribute in the access permission information.

[0099] The first data permission type and the second data permission type include fixed permission types and custom permission types. Specifically, the first data permission type includes but is not limited to any one or more of the following: ADMIN, USER, USER_CUSTOM, DEPT, DEPT_AND_CHILD and DEPT_CUSTOM, and the second data permission type includes but is not limited to any one or more of the following: ADMIN, USER, USER_CUSTOM, DEPT, DEPT_AND_CHILD and DEPT_CUSTOM. The ADMIN is the administrator data permission, which has the permission for all data; USER is the data permission for the operator, which only allows the operation of his own data; USER_CUSTOM is the custom operator data permission, which only allows the operation of the data of the designated operator; DEPT is the department data permission, which only allows the operation of the data of the same department; DEPT_AND_CHILD is the department and sub-department data permission, which only allows the operation of the data of the same department and sub-department; DEPT_CUSTOM is the custom department data permission, which only allows the operation of the data of the designated department.

[0100] The first data operation type and the second data operation type include operation types that can be performed on the data. Specifically, the first data operation type includes but is not limited to any one or more of the following: query operation type, modification operation type, new operation type and deletion operation type; the second data operation type includes but is not limited to any one or more of the following: query operation type, modification operation type, new operation type and deletion operation type.

[0101] Furthermore, at this time, the first data permission type and the first data operation type in the data access method can be used as the first access permission type in the data access method, and the second data permission type and the second data operation type in the access permission information can be used as the second access permission type in the access permission information. This facilitates the subsequent judgment operation on the access permission type. And if the interception result corresponding to the data access method indicates that there is no data permission annotation in the data access method, it means that the access person can access all data, and the subsequent step S103 is not executed.

[0102] S103: If the first access permission type and the second access permission type are the same, modify the data access statement according to the first access permission attribute and the second access permission attribute to obtain a modified data access statement to complete data permission control.

[0103] It should be noted that when the present application is executed, if the first access permission type and the second access permission type are the same, the data access statement is modified according to the first access permission attribute and the second access permission attribute to obtain the modified data access statement to complete the data permission control operation. It is also necessary to determine whether the first access permission type and the second access permission type are the same.

[0104] It should also be noted that the first access permission attribute includes an access data attribute and an attribute value corresponding to the access data attribute, and the second access permission attribute includes an identity permission attribute and an attribute value corresponding to the identity permission attribute. Among them, the access data attribute includes but is not limited to any one or more of the following table names of the access personnel table, the column names in the table names of the access personnel table, the table names of the access department table, and the column names in the table names of the access department table; the identity permission attribute includes but is not limited to any one or more of the following identity identifiers of the access personnel and the identity identifiers of the departments to which the access personnel belong. It should be noted that the access data attributes, the attribute values ​​corresponding to the access data attributes, the identity permission attributes, and the attribute values ​​corresponding to the identity permission attributes can be determined in actual applications based on the data access request of the access personnel, and are not specifically limited here.

[0105] like Figure 4 As shown, Figure 4 A flowchart of modifying a data access statement in a data authority control method provided in an embodiment of the present application, Figure 4 The method includes step S3031 and step S3032, and the specific details of step S3031 and step S3032 are as follows:

[0106] S3031: If the first data permission type and the second data permission type are the same, and the first data operation type and the second data operation type are the same, the access data attributes and the identity permission attributes are converted to obtain data attribute placeholders corresponding to the access data attributes and permission attribute placeholders corresponding to the identity permission attributes.

[0107] It can be understood that if the first data permission type in the first access permission type in the data access method and the second data permission type in the second access permission type in the access permission information are the same, and the first data operation type in the first access permission type in the data access method and the second data operation type in the second access permission type in the access permission information are the same, then the access data attributes are attribute converted to obtain data attribute placeholders corresponding to the access data attributes, and the identity permission attributes are attribute converted to obtain permission attribute placeholders corresponding to the identity permission attributes.

[0108] In some examples, the first data permission type in the simulated data access method is USER and the first data operation type is a query operation type, and the second data permission type in the access permission information is USER and the second data operation type is a query operation type, that is, the first data permission type and the second data permission type are the same, and the first data operation type and the second data operation type are the same. At this time, the deptAlias ​​(i.e., the access data attribute) can be attribute converted to obtain {deptAlias} (i.e., the data attribute placeholder corresponding to the access data attribute), and the userId (i.e., the identity permission attribute) can be attribute converted to obtain {userId} (i.e., the permission attribute placeholder corresponding to the identity permission attribute).

[0109] It should be noted that the access data attributes include but are not limited to one or more of the following: deptIdColumn, userAlias, and userIdColumn. In this case, the data attribute placeholders corresponding to the access data attributes include but are not limited to one or more of the following: {deptIdColumn}, {userAlias}, and {userIdColumn}. The identity permission attributes include but are not limited to one or more of the following: userIdIdWithSingleQuote and userIdIdWithDoubleQuote. In this case, the permission attribute placeholders corresponding to the identity permission attributes include but are not limited to one or more of the following: {userIdIdWithSingleQuote} and {userIdIdWithDoubleQuote}.

[0110] It should also be noted that if the first data permission type in the first access permission type in the data access method and the second data permission type in the second access permission type in the access permission information are the same, or the first data operation type in the first access permission type in the data access method and the second data operation type in the second access permission type in the access permission information are the same, subsequent operations will not be performed.

[0111] S3032: Modify the data access statement according to the data attribute placeholder, the attribute value corresponding to the access data attribute, the permission attribute placeholder and the attribute value corresponding to the identity permission attribute to obtain a modified data access statement to complete data permission control.

[0112] In this step, first, according to the data attribute placeholder, a first attribute placeholder corresponding to the data attribute placeholder in the data access statement can be determined, and according to the permission attribute placeholder, a second attribute placeholder corresponding to the permission attribute placeholder in the data access statement can be determined. It can be understood that since there are attribute placeholders in the data access statement, at this time, according to the data attribute placeholder and the permission attribute placeholder, a first attribute placeholder identical to the data attribute placeholder and a second attribute placeholder identical to the permission attribute placeholder can be found in the data access statement.

[0113] It should be noted that, for different data access requests, there may be different data access statements, and there may also be different attribute placeholders in the different data access statements. For example: if the data access request includes the USER attribute, the attribute placeholder in the data access statement includes {userAlias}.{userIdColumn}={userId}; if the data access request includes the USER_CUSTOM attribute, the attribute placeholder in the data access statement includes {userAlias}.{userIdColumn}in({manageUserIds}; if the data access request includes the DEPT attribute, the attribute placeholder in the data access statement includes {deptAlias}.{deptIdColumn}={deptId}; if the data access request includes the DEPT_AND_CHILD attribute, the attribute placeholder in the data access statement includes {deptAlias}.{deptIdColumn}in({deptAndChildDeptIds}; if the data access request includes the DEPT_CUSTOM attribute, the attribute placeholder in the data access statement includes {deptAlias}.{deptIdColumn}in({manageDeptIds}.

[0114] After that, the first attribute placeholder can be replaced according to the attribute value corresponding to the access data attribute to obtain the replaced first attribute placeholder, and the second attribute placeholder can be replaced according to the attribute value corresponding to the identity authority attribute to obtain the replaced second attribute placeholder. For example: the first attribute placeholder can be {deptAlias}, the attribute value corresponding to the access data attribute can be d, the second attribute placeholder can be {userId}, and the attribute value corresponding to the identity authority attribute can be 5. At this time, {deptAlias} can be replaced with d, and {userId} can be replaced with 5.

[0115] Finally, in this step, a data permission string (i.e., a data access statement with replaced attribute placeholders) can be generated according to the replaced first attribute placeholder and the replaced second attribute placeholder in the data access statement. And it can be determined whether there is a target placeholder in the data access statement, wherein the target placeholder includes a DATA_PERMISSION_CONDITION placeholder, and the target placeholder is used to specify the position where the data permission string needs to be inserted.

[0116] If there is a target placeholder in the data access statement, the target placeholder in the data access statement is replaced with the data permission string to obtain a modified data access statement; or if there is no target placeholder in the data access statement, the data permission string is concatenated after the data access statement to obtain a modified data access statement. In this way, data permission control is completed, and there is no need to generate fixed hard coding. By modifying the placeholder in the data access statement to a specific attribute value, data access can be accurately implemented in the subsequent data access process, thereby improving the scalability and flexibility of data permission control.

[0117] In addition, in the present application, the data access method can continue to be called to execute the modified data access statement to obtain the target data corresponding to the data access request. In this way, there is no need to rewrite the hard code, and data access can be achieved by simply modifying the data access statement, which improves the data access efficiency to a certain extent.

[0118] like Figure 5 As shown, Figure 5 A full flow chart of data authority control in a data authority control method provided in an embodiment of the present application. Figure 5 First, the access permission information corresponding to the data access method, the data access statement under the data access method and the data access request of the access personnel can be obtained, and the access permission information can be stored in the permission information context; thereafter, the data access method can be intercepted based on the interceptor to obtain the interception result corresponding to the data access method. If the interception result corresponding to the data access method indicates that there is a data permission annotation in the data access statement in the data access method, the access permission information is obtained from the permission information context based on the interceptor, and the first data permission type, the first data operation type and the first access permission attribute in the data access method are obtained, and the second data permission type, the second data operation type and the second access permission attribute in the access permission information are obtained.

[0119] Finally, if the first data permission type and the second data permission type are the same, and the first data operation type and the second data operation type are the same, then according to the attribute value corresponding to the access data attribute in the first access permission attribute, the first attribute placeholder corresponding to the access data attribute in the first access permission attribute in the data access statement is replaced to obtain the replaced first attribute placeholder. And according to the attribute value corresponding to the identity permission attribute in the second access permission attribute, the second attribute placeholder corresponding to the identity permission attribute in the second access permission attribute in the data access statement is replaced to obtain the replaced second attribute placeholder, and based on the replaced first attribute placeholder and the replaced second attribute placeholder, a modified data access statement is obtained to complete data permission control. This improves the modification flexibility of data access statements and the flexibility of data permission control.

[0120] In summary, in this embodiment, when the first access permission type in the data access method and the second access permission type in the access permission information are the same, the data access statement can be modified according to the first access permission attribute in the data access method and the second access permission attribute in the access permission information corresponding to the data access request of the access personnel, so that the modified data access statement can meet the data access needs of the access personnel. In this way, in this application, the data access statement can be further adjusted according to the access permission information of different access personnel, thereby improving the modification flexibility of the data access statement, the flexibility of data permission control, and the access convenience of the access personnel.

[0121] Based on the data authority control method provided in the aforementioned embodiment, the present application also provides a data authority control device accordingly. Figure 6 This is a schematic diagram of the structure of a data authority control device provided in an embodiment of the present application. Figure 6 As shown, the data authority control device includes:

[0122] An access information acquisition unit 601 is used to acquire access permission information corresponding to a data access method, a data access statement under the data access method, and a data access request of an access person, wherein the data access method is used to support access to the data access request according to the data access statement;

[0123] An access information parsing unit 602 is used to parse the data access method and the access permission information to obtain a first access permission type and a first access permission attribute in the data access method, and a second access permission type and a second access permission attribute in the access permission information;

[0124] The access statement modification unit 603 is used to modify the data access statement according to the first access permission attribute and the second access permission attribute if the first access permission type and the second access permission type are the same, to obtain a modified data access statement to complete data permission control.

[0125] In one feasible embodiment, the device further includes:

[0126] An interception result obtaining unit, used to intercept the data access method based on the interceptor, and obtain an interception result corresponding to the data access method;

[0127] The access information parsing unit 602 is specifically used to:

[0128] If the interception result corresponding to the data access method indicates that there is a data permission annotation in the data access method, performing method parsing on the data access method to obtain a first data permission type, a first data operation type, and a first access permission attribute in the data access method, and performing information parsing on the access permission information to obtain a second data permission type, a second data operation type, and a second access permission attribute in the access permission information;

[0129] The first data permission type and the first data operation type in the data access method are used as the first access permission type in the data access method, and the second data permission type and the second data operation type in the access permission information are used as the second access permission type in the access permission information.

[0130] In an achievable implementation manner, the first access permission attribute includes an access data attribute and an attribute value corresponding to the access data attribute, and the second access permission attribute includes an identity permission attribute and an attribute value corresponding to the identity permission attribute;

[0131] The access statement modification unit 603 includes:

[0132] an attribute conversion processing unit, configured to, if the first data permission type is the same as the second data permission type, and the first data operation type is the same as the second data operation type, convert the access data attribute and the identity permission attribute to obtain a data attribute placeholder corresponding to the access data attribute and a permission attribute placeholder corresponding to the identity permission attribute;

[0133] The attribute statement modification unit is used to modify the data access statement according to the data attribute placeholder, the attribute value corresponding to the access data attribute, the permission attribute placeholder and the attribute value corresponding to the identity permission attribute, and obtain the modified data access statement to complete data permission control.

[0134] In an achievable implementation manner, the attribute statement modification unit includes:

[0135] an attribute placeholder determination unit, configured to determine, according to the data attribute placeholder, a first attribute placeholder in the data access statement corresponding to the data attribute placeholder, and, according to the permission attribute placeholder, determine a second attribute placeholder in the data access statement corresponding to the permission attribute placeholder;

[0136] an attribute placeholder replacement unit, configured to replace the first attribute placeholder according to the attribute value corresponding to the access data attribute to obtain the replaced first attribute placeholder, and replace the second attribute placeholder according to the attribute value corresponding to the identity authority attribute to obtain the replaced second attribute placeholder;

[0137] The attribute placeholder modification unit is used to obtain a modified data access statement according to the replaced first attribute placeholder and the replaced second attribute placeholder to complete data authority control.

[0138] In an achievable implementation manner, the attribute placeholder modification unit is specifically used to:

[0139] Generate a data permission character string according to the replaced first attribute placeholder and the replaced second attribute placeholder;

[0140] If there is a target placeholder in the data access statement, the target placeholder in the data access statement is replaced with the data permission string to obtain a modified data access statement to complete data permission control;

[0141] Or if the target placeholder does not exist in the data access statement, the data permission character string is concatenated after the data access statement to obtain a modified data access statement to complete data permission control.

[0142] In an achievable implementation, the data access method includes a DAO method, the interceptor includes a Mybatis interceptor and a Hibernate interceptor, the data permission annotation includes a DataPermission annotation, and the target placeholder includes a DATA_PERMISSION_CONDITION placeholder.

[0143] In one feasible embodiment, the device further includes:

[0144] An access request acquisition unit, used to acquire a data access request submitted by an access person;

[0145] The access information acquisition unit 601 is specifically used to:

[0146] receiving request conversion information submitted by an operator for the data access request, and using the request conversion information as access permission information corresponding to the data access request of the access operator;

[0147] Receiving a data access method submitted by the operator for the access permission information;

[0148] According to the data access method, a data access statement under the data access method is obtained.

[0149] The data authority control device provided in the embodiment of the present application has the same beneficial effects as the data authority control method provided in the above embodiment, and will not be described in detail here.

[0150] The present application also provides a computer device. The computer device includes:

[0151] A memory having a computer program stored therein.

[0152] The processor is used to execute the computer program in the memory to implement some or all of the steps in the data authority control method introduced in the above embodiment.

[0153] The present application also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, some or all of the steps in the data authority control method described in the above embodiment are implemented.

[0154] It should be noted that the "first" and "second" (if any) in the names such as "first" and "second" mentioned in the embodiments of the present application are only used as name identifiers and do not represent the first or second in order.

[0155] It should also be noted that the various embodiments in this specification are described in a progressive manner, and the same and similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and equipment embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and equipment embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0156] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data authority control method, characterized in that: include: Acquire a data access method, a data access statement under the data access method, and access permission information corresponding to a data access request of an access person, wherein the data access method is used to support access to the data access request according to the data access statement; Parsing the data access method and the access permission information to obtain a first access permission type and a first access permission attribute in the data access method, and a second access permission type and a second access permission attribute in the access permission information; If the first access permission type and the second access permission type are the same, the data access statement is modified according to the first access permission attribute and the second access permission attribute to obtain a modified data access statement to complete data permission control.

2. The method according to claim 1, characterized in that Before parsing the data access method and the access permission information to obtain the first access permission type and the first access permission attribute in the data access method and the second access permission type and the second access permission attribute in the access permission information, the method further includes: Based on the interceptor, the data access method is intercepted and processed to obtain the interception result corresponding to the data access method; The parsing of the data access method and the access permission information to obtain the first access permission type and the first access permission attribute in the data access method, and the second access permission type and the second access permission attribute in the access permission information includes: If the interception result corresponding to the data access method indicates that there is a data permission annotation in the data access method, performing method parsing on the data access method to obtain a first data permission type, a first data operation type, and a first access permission attribute in the data access method, and performing information parsing on the access permission information to obtain a second data permission type, a second data operation type, and a second access permission attribute in the access permission information; The first data permission type and the first data operation type in the data access method are used as the first access permission type in the data access method, and the second data permission type and the second data operation type in the access permission information are used as the second access permission type in the access permission information.

3. The method according to claim 2, characterized in that The first access permission attribute includes an access data attribute and an attribute value corresponding to the access data attribute, and the second access permission attribute includes an identity permission attribute and an attribute value corresponding to the identity permission attribute; If the first access permission type and the second access permission type are the same, modifying the data access statement according to the first access permission attribute and the second access permission attribute to obtain a modified data access statement to complete data permission control, including: If the first data permission type is the same as the second data permission type, and the first data operation type is the same as the second data operation type, converting the access data attribute and the identity permission attribute to obtain a data attribute placeholder corresponding to the access data attribute and a permission attribute placeholder corresponding to the identity permission attribute; The data access statement is modified according to the data attribute placeholder, the attribute value corresponding to the access data attribute, the permission attribute placeholder and the attribute value corresponding to the identity permission attribute to obtain a modified data access statement to complete data permission control.

4. The method according to claim 3, characterized in that The modifying process of the data access statement according to the data attribute placeholder, the attribute value corresponding to the access data attribute, the authority attribute placeholder and the attribute value corresponding to the identity authority attribute to obtain a modified data access statement to complete data authority control includes: According to the data attribute placeholder, determine a first attribute placeholder in the data access statement corresponding to the data attribute placeholder, and according to the permission attribute placeholder, determine a second attribute placeholder in the data access statement corresponding to the permission attribute placeholder; The first attribute placeholder is replaced according to the attribute value corresponding to the access data attribute to obtain the replaced first attribute placeholder, and the second attribute placeholder is replaced according to the attribute value corresponding to the identity authority attribute to obtain the replaced second attribute placeholder; According to the replaced first attribute placeholder and the replaced second attribute placeholder, a modified data access statement is obtained to complete data authority control.

5. The method according to claim 4, characterized in that The step of obtaining a modified data access statement according to the replaced first attribute placeholder and the replaced second attribute placeholder to complete data authority control includes: Generate a data permission character string according to the replaced first attribute placeholder and the replaced second attribute placeholder; If there is a target placeholder in the data access statement, the target placeholder in the data access statement is replaced with the data permission string to obtain a modified data access statement to complete data permission control; Or if the target placeholder does not exist in the data access statement, the data permission character string is concatenated after the data access statement to obtain a modified data access statement to complete data permission control.

6. The method according to claim 5, characterized in that The data access method includes a DAO method, the interceptor includes a Mybatis interceptor and a Hibernate interceptor, the data permission annotation includes a DataPermission annotation, and the target placeholder includes a DATA_PERMISSION_CONDITION placeholder.

7. The method according to claim 1, characterized in that Before obtaining the data access method, the data access statement under the data access method, and the access right information corresponding to the data access request of the access person, the method further includes: Obtain data access requests submitted by access personnel; The method for obtaining data access, the data access statement under the data access method, and the access right information corresponding to the data access request of the access personnel include: receiving request conversion information submitted by an operator for the data access request, and using the request conversion information as access permission information corresponding to the data access request of the access operator; Receiving a data access method submitted by the operator for the access permission information; According to the data access method, a data access statement under the data access method is obtained.

8. A data authority control device, characterized in that: include: an access information acquisition unit, used to acquire access permission information corresponding to a data access method, a data access statement under the data access method, and a data access request of an access person, wherein the data access method is used to support access to the data access request according to the data access statement; an access information parsing unit, configured to parse the data access method and the access permission information to obtain a first access permission type and a first access permission attribute in the data access method, and a second access permission type and a second access permission attribute in the access permission information; An access statement modification unit is used to modify the data access statement according to the first access permission attribute and the second access permission attribute if the first access permission type and the second access permission type are the same, to obtain a modified data access statement to complete data permission control.

9. A computer device, characterized in that: include: a memory having a computer program stored thereon; A processor is used to execute the computer program in the memory to implement the steps of the data authority control method described in claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the data authority control method described in claims 1-7 are implemented.

Images