Data permission identification method and device, equipment and storage medium

Abstract

The invention discloses a data permission identification method and device, equipment and a storage medium, and relates to the technical field of data security. The method is applied to an application plug-in of a data authorization system, and comprises the following steps: when a data access request of a user is identified, performing data extraction on the data access request to obtain user request data; based on the data permission strategy, performing first permission verification on the user request data; the data permission strategy is made in advance by the permission management platform and is issued to the application plug-in; determining target access data according to the user request data under the condition of identifying that the first permission verification is passed, and performing secondary permission verification on the target access data according to the user request data based on a data permission strategy; and feeding back the target access data to the user under the condition of identifying that the secondary permission verification is passed. According to the technical scheme, the security of data access is ensured on the basis that codes of existing application programs do not need to be modified.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, in particular to the field of data security technology, and specifically to a data permission identification method, apparatus, device and storage medium. Background Art

[0002] Fine-grained permissions help prevent unauthorized internal and external personnel from illegally obtaining and using sensitive corporate data, thereby avoiding confidentiality leaks. Problems such as unauthorized behavior and data leakage in situations such as hacker intrusions and phishing attacks can be effectively prevented and controlled.

[0003] Currently, in order to achieve fine-grained permission control of data in all business systems, users often adopt the following measures: on the one hand, new businesses are built according to the requirements of data permission control; on the other hand, the existing business systems are upgraded and transformed according to the requirements of data permission control.

[0004] However, this approach has many disadvantages, especially when faced with large-scale and diversified business systems, the development complexity, maintenance difficulty and potential risks brought about by code modifications will increase significantly. Summary of the invention

[0005] The present application provides a data permission identification method, apparatus, device and storage medium to ensure the security of data access without modifying the code of existing application programs.

[0006] According to one aspect of the present application, a data permission identification method is provided, which is applied to an application plug-in of a data authorization system; the data authorization system also includes a permission management platform; the application plug-in is connected to the permission management platform in communication; the method includes:

[0007] When a data access request from a user is identified, data is extracted from the data access request to obtain user request data; the user request data includes an access path, user information, and requested data field attributes;

[0008] Based on the data permission policy, the user request data is subjected to the first permission check; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in;

[0009] In the case of identifying that the first permission check passes, determining the target access data according to the user request data, and performing a secondary permission check on the target access data according to the user request data based on the data permission policy;

[0010] When it is identified that the secondary permission verification is passed, the target access data is fed back to the user.

[0011] According to another aspect of the present application, a data permission identification device is provided, which is configured in an application plug-in of a data permission authorization system; the data authorization system also includes a permission management platform; the application plug-in is communicatively connected with the permission management platform; the device includes:

[0012] A data extraction module is used to extract data from a data access request of a user when identifying the data access request of the user, and obtain user request data; the user request data includes an access path, user information and requested data field attributes;

[0013] A first verification module, configured to perform an initial permission verification on the user request data based on a data permission policy; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in;

[0014] A second verification module is used to determine the target access data according to the user request data when it is identified that the first permission verification is passed, and perform a secondary permission verification on the target access data according to the user request data based on the data permission policy;

[0015] The data feedback module is used to feed back the target access data to the user when it is identified that the secondary permission verification has passed.

[0016] According to another aspect of the present application, an electronic device is provided, the electronic device comprising:

[0017] one or more processors;

[0018] A memory for storing one or more programs;

[0019] When the one or more programs are executed by the one or more processors, the one or more processors implement any one of the data permission identification methods provided in the embodiments of the present application.

[0020] According to another aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, any one of the data permission identification methods provided in the embodiments of the present application is implemented.

[0021] This application obtains user request data by extracting data from the data access request when identifying the data access request of the user; the user request data includes the access path, user information and the requested data field attributes; based on the data permission policy, the user request data is first checked for permissions; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in; when the first permission check is identified as passed, the target access data is determined according to the user request data, and based on the data permission policy, the target access data is secondarily checked for permissions according to the user request data; when the second permission check is identified as passed, the target access data is fed back to the user. The above technical scheme, by using application plug-ins and adopting the data permission policy pre-formulated by the permission management platform according to the user identity information, solves the problem of how to achieve fine-grained unified authorization of data without modifying the user's original business system, so as to achieve the same user's data permissions in all business systems. It ensures the security of data access without modifying the code of the existing application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a flow chart of a data authority identification method provided according to Embodiment 1 of the present application;

[0023] Figure 2 This is a flow chart of a data authority identification method provided according to Embodiment 2 of the present application;

[0024] Figure 3 It is a structural diagram of a data authority identification device provided according to Embodiment 3 of the present application;

[0025] Figure 4 It is a structural diagram of an electronic device that implements the data authority identification method of an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] In addition, it should be noted that the collection, storage, use, processing, transmission, provision and disclosure of data access requests, user request data and other related data involved in the technical solution of this application comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0029] Before further describing the present application in detail, the data authorization system involved in the embodiments of the present invention is described:

[0030] The data authorization system includes at least one application plug-in and a rights management platform; for each application plug-in, the application plug-in and the rights management platform are communicated and connected; the application plug-in can be an interception module using Hook (Hook Function) technology.

[0031] Specifically, the rights management platform may include core components such as a plug-in management module, a policy management module, an organization management module, and an audit management module.

[0032] Among them, the plug-in management module is used to manage application plug-ins, and its functions include uploading, deleting, configuration management, deployment and installation, deployment and uninstallation, status monitoring, start and stop control, etc. of application plug-ins. The policy management module is used to provide centralized data unified permission policy management capabilities, allowing administrators to dynamically adjust and publish data permission policies without affecting the operation of existing application systems; provide field-level user access authorization configuration, allowing different users to use different data fields; provide dynamic desensitization policy management, which can configure desensitization algorithms for different field contents and can be dynamically adjusted according to user roles. The organization management module is used to manage users, roles, positions, etc. of the enterprise-level organizational structure, and then can authorize different data permissions based on users, roles, positions, etc. The audit management module is used for user management and audit application system user access data logging. Regardless of whether the request is allowed, the module will record the access log to ensure post-audit and compliance checks.

[0033] Specifically, the application plug-in may include core functions such as policy reception, request interception, policy execution, and log reporting.

[0034] Among them, the policy receiving function refers to the function used to receive the data authorization policy and desensitization policy issued by the policy management module of the management platform, and cache them in the execution memory of the application plug-in. The request interception function refers to the function used to intercept the key data access operations of the application without modifying the original application code; this function can be deployed at the application level, capture data access requests through dynamic instrumentation, and pass relevant request information (such as access path, data type, requesting user, etc.) to the policy execution module. The policy execution function refers to the evaluation based on the received request information according to the predefined permission policy; the evaluation process does not require the participation of the original application, thereby achieving the independence of permission management; based on the evaluation results, it is decided whether to allow the data access request or whether to set the returned data field to blank based on the policy modification or perform dynamic desensitization based on the policy; if the request is rejected, the system will return appropriate error or rejection information and record relevant logs. The log reporting function means that regardless of whether the request is allowed or not, the logging and auditing module will record the interception operation and report it to the management platform to ensure post-audit and compliance checks.

[0035] Embodiment 1

[0036] Figure 1 It is a flow chart of a data permission identification method provided according to the first embodiment of the present application. This embodiment can be applied to the situation of fine-grained control of user data access rights, and can be executed by a data permission identification device. The data permission identification device can be implemented in the form of hardware and / or software. The data permission identification device can be configured in a computer device, such as in an application plug-in of a data authorization system.

[0037] like Figure 1 As shown, the method includes:

[0038] S110. When a data access request from a user is identified, data is extracted from the data access request to obtain user request data; the user request data includes an access path, user information, and requested data field attributes.

[0039] Among them, the user refers to the user who currently needs to access business data. Data access request refers to the user or system's need to access specific data; this request can be initiated by the user, usually through an application, database query or API (Application Programming Interface) call. User request data refers to the context information of the user's access request. Access path refers to the path or method used by a user or system to access specific data; this usually involves the location of data storage, the API endpoint accessed, or the structure of the database table. User information refers to the user identity information related to the request, including user name, user ID (Identifier), role, permissions, etc.; this information helps the system verify the user's identity and determine their access rights. The data field attributes of the request refer to the data items or fields specified by the user in the request, including the name, type, format, etc. of the field; these attributes help the system understand what specific data the user wants to obtain.

[0040] Exemplarily, when a user sends a data access request to an application currently managed by an application plug-in, the application plug-in intercepts the data access request and extracts access context information from the data access request, such as access path, user information, requested data field attributes, and other information.

[0041] S120. Based on the data permission policy, perform the first permission check on the user's requested data; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in.

[0042] Among them, data permission policy refers to a set of rules and standards that stipulates the permissions and restrictions of different users or user groups when accessing data; these policies are usually formulated by the permission management platform to ensure that only authorized users can access or operate specific data. The first permission check refers to the permission verification process performed by the system on the request when the user requests data for the first time. This process determines whether the user has access by checking the user's identity, role and the access rights defined in the data permission policy. Application plug-ins refer to modules or components that can be embedded in applications to extend their functions or features; in data permission management, application plug-ins are usually responsible for implementing functions such as permission verification and data access control.

[0043] Exemplarily, according to the data permission policy, an initial permission check is performed on the user's requested data to determine whether the user has the right to access it, so as to decide whether to release the data access request; if the initial permission check passes, the data access request is released; if the initial permission check fails, the data access request is rejected.

[0044] It is understandable that by first verifying the access rights of users, users without access rights can be screened out in advance, avoiding the waste of resources in subsequent screening at a fine-grained level, and effectively improving the response speed and processing efficiency of data access.

[0045] S130. When it is identified that the first permission check is passed, the target access data is determined according to the user request data, and based on the data permission policy, a second permission check is performed on the target access data according to the user request data.

[0046] The target access data refers to the specific data or resources requested by the user; for example, if the user requests to view records in a database, the target access data is those specific records. Secondary permission verification refers to a further permission check on the specific target access data after the initial permission verification; this step ensures that the user reconfirms his or her access rights to the specific data before accessing it.

[0047] It is understandable that through secondary verification, the risk is further reduced to ensure that even if users have basic access rights, they still need to meet more stringent conditions to access sensitive data. In the permission management process, the first permission verification and the second permission verification are important links to ensure data security and user permission compliance. Through a detailed review of user requests, combined with data permission policies, unauthorized access can be effectively prevented and sensitive information can be protected. Such a multi-level permission control strategy improves the security of the system and the integrity of the data.

[0048] For example, after recognizing that the data access request is released, it is necessary to continue to verify whether the user has the right to access all the plaintext data of the target access data, or to evaluate whether to modify the data content of the data returned by the request, such as desensitizing the content, clearing the content, etc.

[0049] Furthermore, when it is identified that the secondary permission check fails, the target access data needs to be modified before being fed back to the user.

[0050] It can be understood that by adaptively modifying sensitive data in target access data based on the user's access rights, the user's access rights to specific tables or fields can be finely controlled without modifying the original code of the system.

[0051] S140: When it is identified that the secondary permission verification has passed, the target access data is fed back to the user.

[0052] In an optional implementation, the data processing process of the data access request is monitored in real time to obtain a log record of the data access request; when it is identified that the data processing process of the data access request is terminated, the log record is fed back to the authority management platform.

[0053] Among them, logging refers to the process of automatically recording event information during the data processing of application plug-ins for data access requests, such as permission verification, target access data changes, etc., to form traceable records for subsequent auditing and analysis.

[0054] Optionally, the identification conditions for termination of the data processing process may include failure of the first permission check, passing of the second permission check, and failure of the second permission check.

[0055] The embodiment of the present application extracts data from the data access request when the data access request of the user is identified, and obtains the user request data; the user request data includes the access path, user information and the data field attributes of the request; based on the data permission policy, the user request data is first checked for permissions; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in; when the first permission check is identified to be passed, the target access data is determined according to the user request data, and based on the data permission policy, the target access data is secondarily checked for permissions according to the user request data; when the second permission check is identified to be passed, the target access data is fed back to the user. The above technical scheme, by using application plug-ins and adopting the data permission policy pre-formulated by the permission management platform according to the user identity information, solves the problem of how to realize fine-grained unified authorization of data without modifying the original business system of the user, so as to achieve the problem of keeping the data permissions of the same user consistent in all business systems, and ensures the security of data access without modifying the code of the existing application.

[0056] Embodiment 2

[0057] Figure 2 This is a flow chart of a data permission identification method provided in accordance with the second embodiment of the present application. Based on the technical solutions of the above embodiments, this embodiment refines "based on the data permission policy, according to the user request data, a secondary permission check is performed on the target access data" into "based on the association between the user request data and the accessible data in the data permission policy, and the user request data, determine the accessible data of the user; perform consistency check on the accessible data and the target access data". It should be noted that for the parts not described in detail in the embodiments of the present application, please refer to the relevant descriptions of other embodiments. Figure 2 As shown, the method includes:

[0058] S210. When a data access request from a user is identified, data is extracted from the data access request to obtain user request data; the user request data includes an access path, user information, and requested data field attributes.

[0059] S220. Based on the data permission policy, perform the first permission check on the user's requested data; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in.

[0060] S230: When it is identified that the first permission check is passed, target access data is determined according to the user request data.

[0061] S240. Based on the association relationship between the user requested data and the accessible data in the data permission policy and the user requested data, determine the accessible data of the user; and perform consistency check on the accessible data and the target access data.

[0062] Among them, accessible data refers to the data set that the user has the right to access within the scope of the user's authority; this data is usually defined according to the user's role, position or other authority standards. The association relationship between user request data and accessible data refers to the logical relationship between user request data and accessible data, indicating whether a user has the right to access the data he requested; this relationship is usually based on the user's identity, role and the sensitivity of the data. Consistency verification refers to the process of comparing and verifying accessible data and target access data when processing user requests to ensure that they match in content, format or other standards.

[0063] S250: When it is identified that the consistency check has passed, the target access data is fed back to the user.

[0064] In an optional implementation, when it is identified that the consistency check has not passed, the data to be modified is determined from the target access data based on the accessible data; based on the data permission policy and according to the user request data, the field content of the data to be modified is modified, and the modified target access data is fed back to the user.

[0065] The data to be modified refers to data that needs to be changed and is identified from the target access data based on the accessible data when the consistency check fails; these data usually need to be modified to meet the user's access rights or compliance requirements.

[0066] Furthermore, the field content modification of the data to be modified can be performed by determining the user's access rights to the data to be modified based on the association between user information and access rights in the data permission policy and the user request data; according to the access rights, determining the target modification method of the data to be modified from the candidate modification methods, and modifying the field content of the data to be modified according to the target modification method.

[0067] Among them, access rights refer to the user's right to access and operate specific data; access rights are determined by the data permission policy to ensure that users can only access data they have access to. Candidate modification methods refer to various modification schemes or methods that can be used to modify the data; these schemes need to be evaluated before implementation to ensure that they meet the user's permissions and data compliance requirements. The target modification method refers to the specific modification scheme selected from the candidate modification methods, which determines how to adjust the data to be modified.

[0068] Optionally, the candidate modification methods may include at least one of content desensitization and content blanking.

[0069] Content desensitization refers to the processing of sensitive information to prevent unauthorized access or disclosure; this processing usually involves blurring, encrypting or replacing personal identity information, financial data, health information, etc. to protect privacy and security. Content nulling refers to setting a specific field or data content to a null value so that it no longer contains any information; this processing method is usually used to ensure that sensitive information is not leaked or to clear unnecessary data when it is not needed.

[0070] The embodiment of the present application extracts data from the data access request when the data access request of the user is identified, and obtains the user request data; the user request data includes the access path, user information and the data field attributes of the request; based on the data permission policy, the user request data is first checked for permission; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in; when the first permission check is identified to be passed, the target access data is determined according to the user request data; based on the association between the user request data and the accessible data in the data permission policy, and the user request data, the accessible data of the user is determined; the accessible data and the target access data are checked for consistency; when the consistency check is identified to be passed, the target access data is fed back to the user. The above technical scheme, by using the application plug-in and adopting the data permission policy pre-formulated by the permission management platform according to the user identity information, solves the problem of how to realize fine-grained unified authorization of data without modifying the original business system of the user, so as to achieve the problem of keeping the data permissions of the same user consistent in all business systems, and ensures the security of data access without modifying the code of the existing application.

[0071] Embodiment 3

[0072] Figure 3 This is a structural diagram of a data permission identification device provided according to the third embodiment of the present application, which can be applied to the situation of fine-grained control of user data access rights. The data permission identification device can be implemented in the form of hardware and / or software. The data permission identification device can be configured in a computer device, such as an application plug-in of a data authorization system. Figure 3 As shown, the device comprises:

[0073] The data extraction module 310 is used to extract data from the data access request when identifying the data access request of the user, and obtain the user request data; the user request data includes the access path, user information and the requested data field attributes;

[0074] The first verification module 320 is used to perform the first permission verification on the user request data based on the data permission policy; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in;

[0075] The second verification module 330 is used to determine the target access data according to the user request data when the first permission verification is identified to be passed, and to perform a second permission verification on the target access data according to the user request data based on the data permission policy;

[0076] The data feedback module 340 is used to feed back the target access data to the user when it is identified that the secondary permission verification has passed.

[0077] The embodiment of the present application extracts data from the data access request when the data access request of the user is identified, and obtains the user request data; the user request data includes the access path, user information and the data field attributes of the request; based on the data permission policy, the user request data is first checked for permissions; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in; when the first permission check is identified to be passed, the target access data is determined according to the user request data, and based on the data permission policy, the target access data is secondarily checked for permissions according to the user request data; when the second permission check is identified to be passed, the target access data is fed back to the user. The above technical scheme, by using application plug-ins and adopting the data permission policy pre-formulated by the permission management platform according to the user identity information, solves the problem of how to realize fine-grained unified authorization of data without modifying the original business system of the user, so as to achieve the problem of keeping the data permissions of the same user consistent in all business systems, and ensures the security of data access without modifying the code of the existing application.

[0078] Optionally, the second verification module 330 is specifically configured to:

[0079] Determine the accessible data of the user based on the association between the user requested data and the accessible data in the data permission policy and the user requested data;

[0080] Perform consistency check on accessible data and target access data.

[0081] Optionally, the device further includes a data modification module, which is used to:

[0082] When it is identified that the consistency check fails, the data to be modified is determined from the target access data according to the accessible data;

[0083] Based on the data permission strategy, according to the user's request for data, the field content of the data to be modified is modified, and the modified target access data is fed back to the user.

[0084] Optional data modification module, specifically used for:

[0085] Based on the association between user information and access rights in the data permission policy, as well as the user's requested data, determine the user's access rights to the data to be modified;

[0086] According to the access rights, a target modification method of the data to be modified is determined from candidate modification methods, and field content of the data to be modified is modified according to the target modification method.

[0087] Optionally, the device further includes a log recording module, which is used to:

[0088] Monitor the data processing process of data access requests in real time to obtain log records of data access requests;

[0089] When it is identified that the data processing of a data access request is aborted, log records are fed back to the rights management platform.

[0090] Optionally, the identification conditions for termination of the data processing process include at least failure of the first permission check, passing of the second permission check, and failure of the second permission check.

[0091] The data permission identification device provided in the embodiments of the present application can execute the data permission identification method provided in any embodiment of the present application, and has the corresponding functional modules and beneficial effects for executing each data permission identification method.

[0092] Embodiment 4

[0093] Figure 4It is a structural diagram of an electronic device 410 that implements the data authority identification method of an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0094] like Figure 4 As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In RAM413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, ROM412 and RAM413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0095] Multiple components in the electronic device 410 are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device 410 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0096] Processor 411 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. Processor 411 performs the various methods and processes described above, such as a data authority identification method.

[0097] In some embodiments, the data permission identification method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 410 via ROM 412 and / or communication unit 419. When the computer program is loaded into RAM 413 and executed by processor 411, one or more steps of the data permission identification method described above may be performed. Alternatively, in other embodiments, processor 411 may be configured as a data permission identification method in any other appropriate manner (e.g., by means of firmware).

[0098] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0099] The computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data authority recognition device, so that when the computer programs are executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0100] In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0101] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0102] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0103] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0104] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0105] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A data authority identification method, characterized in that: An application plug-in applied to a data authorization system; the data authorization system also includes a rights management platform; The application plug-in is communicated with the rights management platform; the method comprises: When a data access request from a user is identified, data is extracted from the data access request to obtain user request data; the user request data includes an access path, user information, and requested data field attributes; Based on the data permission policy, the user request data is subjected to the first permission check; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in; In the case of identifying that the first permission check passes, determining the target access data according to the user request data, and performing a secondary permission check on the target access data according to the user request data based on the data permission policy; When it is identified that the secondary permission verification is passed, the target access data is fed back to the user.

2. The method according to claim 1, characterized in that Based on the data permission policy and according to the user request data, a secondary permission check is performed on the target access data, including: Determining the accessible data of the user based on the association relationship between the user request data and the accessible data in the data permission policy and the user request data; A consistency check is performed on the accessible data and the target access data.

3. The method according to claim 2, characterized in that The method further comprises: In the case of identifying that the consistency check fails, determining the data to be modified from the target access data according to the accessible data; Based on the data permission policy and in accordance with the user request data, the field content of the data to be modified is modified, and the modified target access data is fed back to the user.

4. The method according to claim 3, characterized in that: Based on the data permission policy and according to the user request data, modifying the field content of the data to be modified includes: Determine the user's access rights to the data to be modified based on the association between the user information and the access rights in the data permission policy and the user request data; According to the access permission, a target modification method of the data to be modified is determined from candidate modification methods, and field content of the data to be modified is modified according to the target modification method.

5. The method according to claim 1, characterized in that The method further comprises: Performing real-time monitoring on the data processing process of the data access request to obtain a log record of the data access request; When it is identified that the data processing of the data access request is terminated, the log record is fed back to the rights management platform.

6. The method according to claim 5, characterized in that The identification conditions for terminating the data processing process include at least failure of the first authority check, passing of the second authority check, and failure of the second authority check.

7. A data authority identification device, characterized in that: An application plug-in configured in a data authority authorization system; the data authorization system also includes an authority management platform; The application plug-in is communicatively connected with the rights management platform; the device comprises: A data extraction module is used to extract data from a data access request of a user when identifying the data access request of the user, and obtain user request data; the user request data includes an access path, user information and requested data field attributes; A first verification module, configured to perform an initial permission verification on the user request data based on a data permission policy; the data permission policy is pre-formulated by the permission management platform and sent to the application plug-in; A second verification module is used to determine the target access data according to the user request data when it is identified that the first permission verification is passed, and perform a secondary permission verification on the target access data according to the user request data based on the data permission policy; The data feedback module is used to feed back the target access data to the user when it is identified that the secondary permission verification has passed.

8. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the data permission identification method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data permission identification method as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the data permission identification method according to any one of claims 1 to 6 is implemented.

Images