Database access authority control method and device, computer equipment and storage medium

Abstract

The invention relates to a database access permission control method and device, computer equipment and a storage medium. The method comprises the steps that an access request initiated by a user is received, an object of an interface is returned according to the access request, a target attribute carrying a label is determined in the object, and the target attribute comprises a mapping relation between an object field and a table field; obtaining a permission role list of the table field according to the label and the mapping relation, and performing permission verification on the permission role list of the table field; intercepting the target object passing the permission verification, and obtaining a list pointed by the attribute of the target object; and filtering the list without the access permission of the user and then returning data. By adopting the method, the flexible control of the database access authority can be realized.

Description

Technical Field

[0001] The present application relates to the field of databases, and in particular to a method, apparatus, computer equipment and storage medium for controlling access rights to a database. Background Art

[0002] The database is one of the most important assets of an enterprise, containing a large amount of business secrets and customer information. If important data in the database is leaked, it will cause serious losses to the enterprise. However, these confidential data are particularly critical data for people in certain special roles, so the viewing permissions of the data in the database (it may be the entire table or certain columns in the table) will also vary depending on the role. How to achieve flexible control of access permissions for the entire database table or certain columns in the table is of great significance to improving database management efficiency.

[0003] The traditional method is to perform logical processing according to different roles in the business code. However, this method will inevitably cause bloated code, and the modification of data access permissions or the addition of roles may involve code modification. Because some fields of the table are accessed in many places, and these places are implemented by different interfaces, a logical processing code must be written for each additional interface.

[0004] Currently, no effective solution has been proposed for the problem that database access permission control is not flexible enough in related technologies. Summary of the invention

[0005] Based on this, it is necessary to provide a database access permission control method, device, computer equipment and storage medium that can flexibly control database access permissions in order to address the above technical problems.

[0006] In a first aspect, the present application provides a method for controlling access rights to a database. The method comprises:

[0007] Receive an access request initiated by a user, return an object of the interface according to the access request, and determine a target attribute carrying a tag in the object, wherein the target attribute includes a mapping relationship between an object field and a table field;

[0008] Acquire the permission role list of the table field according to the tag and the mapping relationship, and perform permission verification on the permission role list of the table field;

[0009] Intercepting the target object that passes the permission check, and obtaining the table column pointed to by the attribute of the target object;

[0010] The data is returned after filtering out the table columns to which the user does not have access permissions.

[0011] In one embodiment, performing permission verification on the permission role list of the table field includes:

[0012] Get the permission role list of the configured sensitive fields;

[0013] Compare the permission role list of the table field with the permission role list of the sensitive field;

[0014] If every permission role in the permission role list of the table field exists in the permission role list of the sensitive field, it is determined that the permission check has passed; otherwise, it is determined that the permission check has failed.

[0015] In one embodiment, obtaining the table column pointed to by the attribute of the target object includes:

[0016] The properties of the target object are obtained by using a reflection mechanism, where the properties include common field names, table names and field names corresponding to the object fields carrying the labels.

[0017] In one embodiment, filtering the table columns to which the user does not have access rights and then returning the data includes:

[0018] Obtaining the permission role of the user according to the access request;

[0019] Querying the table column access permissions corresponding to the table column stored in the cache;

[0020] According to the permission role of the user and the table column access permission, the table columns to which the user does not have access permission are determined.

[0021] In one of the embodiments, before responding to the access request initiated by the user, the method further includes:

[0022] Define a tag class, wherein the tag class includes table attributes and field attributes;

[0023] An entity class is created, and the object fields in the entity class are annotated based on the tag class to map the object fields with the table fields.

[0024] In one of the embodiments, before responding to the access request initiated by the user, the method further includes:

[0025] Create permission roles, configure the permission roles for table fields of the database, and generate a permission role list for sensitive fields.

[0026] In a second aspect, the present application provides a database access permission control device, the device comprising:

[0027] A response module, used to receive an access request initiated by a user, return an object of the interface according to the access request, and determine a target attribute carrying a tag in the object, wherein the target attribute includes a mapping relationship between an object field and a table field;

[0028] A verification module, used for obtaining a permission role list of the table field according to the label and the mapping relationship, and performing permission verification on the permission role list of the table field;

[0029] An interception module, used to intercept the target object that passes the permission check and obtain the table column pointed to by the attribute of the target object;

[0030] The filtering module is used to filter the table columns to which the user has no access rights before returning the data.

[0031] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in the first aspect when executing the computer program.

[0032] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in the first aspect above.

[0033] The above-mentioned database access permission control method, device, computer equipment and storage medium return objects based on the interface by adding a new interface, and some attributes of the object carry tags. The tags are used to map the relationship between object fields and table fields, intercept objects with tag attributes, obtain the table columns pointed to by the attributes in the object, and return data after filtering the table columns to which the user does not have access permissions. With such a setting, it is only necessary to label the table fields controlled by the permission role without writing business code to achieve flexible control of database access permissions. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a hardware structure block diagram of a computer of a database access permission control method according to an embodiment of the present application;

[0035] Figure 2 An application environment diagram of a method for controlling access rights to a database in one embodiment;

[0036] Figure 3 A schematic diagram of a flow chart of a method for controlling access rights to a database in one embodiment;

[0037] Figure 4 A schematic diagram of a flow chart of a method for controlling database access rights in another embodiment;

[0038] Figure 5A schematic diagram of a flow chart of a method for controlling database access rights in another embodiment;

[0039] Figure 6 is a structural block diagram of a database access permission control device in one embodiment;

[0040] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0042] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the", "these" and the like in this application do not represent quantitative restrictions, and they can be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether directly or indirectly. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships. For example, "A and / or B" can mean: A exists alone, A and B exist at the same time, and B exists alone. Usually, the character " / " indicates that the objects associated with each other are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0043] The method embodiment provided in this embodiment can be executed in a computer or a similar computing device. For example, running on a computer, Figure 1 1 is a hardware structure diagram of a computer of a database access permission control method according to an embodiment of the present application. Figure 1 As shown, the computer may include one or more ( Figure 1Only one is shown in the figure) processor 101 and memory 102 for storing data, wherein processor 101 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA. The above computer may also include a transmission device 103 and an input and output device 104 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above-mentioned computer. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0044] The memory 102 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the database access permission control method in this embodiment. The processor 101 executes various functional applications and data processing by running the computer program stored in the memory 102, that is, to implement the above method. The memory 102 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 102 may further include a memory remotely arranged relative to the processor 101, and these remote memories may be connected to the computer via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0045] The transmission device 103 is used to receive or send data via a network. The above network includes a wireless network provided by a communication provider of the computer. In one example, the transmission device 103 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 103 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0046] The database access permission control method provided in the embodiment of the present application can be applied to Figure 2 In the application environment shown, the terminal 201 communicates with the server 202 via a network. The data storage system 203 can store data that the server 202 needs to process. The data storage system 203 can be integrated on the server 202, or placed on the cloud or other network servers.

[0047] When server 202 receives an access request initiated by terminal 201 (user), server 202 will return the object of the interface according to the access request, and determine the target attribute carrying the label in the object, and the target attribute includes the mapping relationship between the object field and the table field; server 202 obtains the permission role list of the table field according to the label and the mapping relationship, and performs permission verification on the permission role list of the table field; server 202 intercepts the target object that passes the permission verification, and obtains the table column pointed to by the attribute of the target object; server 202 filters the table columns to which the user does not have access rights and then returns the data to terminal 201.

[0048] The terminal 201 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 202 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0049] The database query method of the related technology intercepts the SQL query data, parses the table column fields of the query, and then reassembles the SQL after filtering out the columns with access rights according to the role. However, parsing SQL and reassembling SQL require writing code to implement, and there are syntax errors in parsing or assembling SQL, causing program errors. For SQL involving particularly complex multi-table associations, and the queried columns also involve multiple tables, it is necessary to find which table each column belongs to based on the parsed SQL, which is not only troublesome but also prone to errors. For different SQLs, the parsing and assembly logic is different, and R&D personnel need to consider that the code must support various different SQLs.

[0050] In view of the analysis of the above problems, in one embodiment, Figure 3 As shown, a flowchart of a method for controlling access rights of a database is provided, and the method is applied to Figure 1 The computer in the example is used to illustrate the process, including the following steps:

[0051] Step S101, receiving an access request initiated by a user, returning an object of the interface according to the access request, and determining a target attribute carrying a tag in the object, wherein the target attribute includes a mapping relationship between an object field and a table field.

[0052] The query interface of the computer receives the access request input by the user, and the access request contains business query information. Generally, the business query information can be to query a certain table, a certain column, and a certain range of data. For example, to query the interests of male users in the user table in the database, you can write a SQL query statement to achieve it. The command is as follows:

[0053] SELECT interests

[0054] FROM user

[0055] WHERE sex='male';

[0056] In this step, the computer will not directly return the table column data queried by the user, but will first return the object of the (query) interface, which contains multiple attributes, some of which carry labels and are considered target attributes. The target attribute contains the mapping relationship between the object field and the table field, that is, the target attribute points to a table column.

[0057] Step S102: Obtain a permission role list of the table field according to the tag and the mapping relationship, and perform permission verification on the permission role list of the table field.

[0058] The computer will determine the target attribute based on the label, and then based on the table column pointed to by the target attribute, for the table column that has been configured with access rights, the permission role of the corresponding table field can be obtained, that is, the permission role list of the table field can be obtained. When performing permission verification on the permission role list of the table field, the permission role list of the configured sensitive field can be obtained first; the permission role list of the table field and the permission role list of the sensitive field are compared; if every permission role in the permission role list of the table field exists in the permission role list of the sensitive field, the permission verification is determined to have passed; otherwise, the permission verification is determined to have failed. Optionally, the database administrator can add the configuration of the maximum access permission role list for people with sensitive fields to the database to prevent the administrator from misconfiguring the permission role of the data, resulting in sensitive data being seen by people who should not see it.

[0059] Step S103, intercepting the target object that has passed the authority check, and obtaining the table column pointed to by the attribute of the target object.

[0060] The computer regards the object that has passed the permission check as the target object and intercepts it. The reflection mechanism can be used to obtain the properties of the target object, which include the common field name, the table name and field name corresponding to the object field with the label, that is, the table column pointed to by the target attribute.

[0061] Step S104, filtering the table columns to which the user does not have access rights and then returning the data.

[0062] The computer can obtain the user's permission role according to the access request; query the table column access rights corresponding to the table column stored in the cache; determine the table columns to which the user does not have access rights according to the user's permission role and table column access rights. After filtering out the table columns to which the user does not have access rights, the remaining table column data is returned to the user.

[0063] In the above steps S101 to S104, a new interface is added, and an object is returned based on the interface. Some attributes of the object carry tags, and the tags are used to map the relationship between the object field and the table field. The object with the tag attribute is intercepted, the table column pointed to by the attribute in the object is obtained, and the table column to which the user does not have access rights is filtered and then the data is returned. With such a setting, it is only necessary to label the table fields controlled by the permission role without writing business code to achieve flexible control of database access rights. Compared with intercepting SQL, it can reduce the error rate and reduce the R&D cost of R&D personnel to adapt to various complex SQLs and to write code for parsing and assembling SQLs.

[0064] In one embodiment, Figure 4 Another database access permission control method is provided. Before receiving an access request initiated by a user, the method further includes the following steps:

[0065] Step S201, creating permission roles, configuring permission roles for table fields of the database, and generating a permission role list for sensitive fields.

[0066] For example, Table 1 shows the various permission roles, which are super administrator, administrator, and ordinary member from high to low. Table 2 shows the permission roles of various sensitive fields, among which sensitive fields such as gender and ID number are configured with special permission roles, while the rest are not configured with special permission roles. This step can be configured in the management background, and operators can configure it according to business needs. Columns without permission configuration do not distinguish permissions, and users with ordinary roles can also access them. After configuration, the configuration information can be stored in the cache redis.

[0067] Table 1 Permission roles

[0068] Permission roles illustrate super Super Administrator admin administrator common Ordinary Member

[0069] Table 2 Permission roles for sensitive fields

[0070]

[0071] Step S202, define a tag class, which includes table attributes and field attributes. An example is as follows:

[0072]

[0073] In the code snippet provided, DataSourceAspect is a custom annotation type with two properties: table and field. Both properties are string types and have a default value of an empty string. When developers use this annotation in code, they can specify a table name and field name.

[0074] Step S203, create an entity class, and annotate the object fields in the entity class based on the tag class to map the object fields to the table fields. An example is as follows:

[0075]

[0076]

[0077] In the code snippet provided, a Java class named UserVO is defined to implement the Serializable interface. The UserVO class contains four attributes: name, sex, idCard, and interest, which are all object fields. The @DataSourceAspect annotation is used to mark object fields that require permission control and indicate the mapping location of these object fields in the database. Among them, the sex and idCard fields use the @DataSourceAspect annotation to specify the correspondence with specific database table columns. For example, the sex object field is mapped to the sex column in the database user, and the idCard object field is mapped to the id_card column in the database table user. Attributes such as name and interest that are not annotated indicate that this object field does not require special permission control and does not need to be mapped to a specific database table column.

[0078] In this embodiment, when querying data from the database, the system can decide whether to return data for certain fields based on the user's permissions and the information provided by the @DataSourceAspect annotation. For example, if the user does not have permission to access the id_card column, then even if the UserVO object is queried, the value of the idCard field will not be returned. This method separates the permission control logic from the business logic, making permission control more flexible and easier to maintain. When you need to adjust permissions or add new sensitive fields, you only need to modify the annotations without modifying the business code.

[0079] In one embodiment, when adding, deleting or adjusting permission roles, the permission roles can be added, deleted or adjusted in the existing restricted role list. Alternatively, when modifying the access rights of a table column, the table column with configured access rights can be modified directly. With this setting, only the configuration needs to be modified, without modifying the code, and it can take effect on all places involving the table column.

[0080] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0081] In one embodiment, Figure 5 Another database access permission control method is provided, which includes the following steps:

[0082] Step S301, create permission roles, and configure permission roles for table fields of the database, and generate a permission role list for sensitive fields. For example, create level administrators, administrators, and ordinary members as shown in Table 1 above, and configure special permission roles for sensitive fields as shown in Table 2 above.

[0083] Step S302, define a tag class, the tag class includes table attributes and field attributes; create an entity class, and annotate the object fields in the entity class based on the tag class to map the object fields to the table fields. For example, as shown in the above code snippet, a custom annotation type is defined to implement a new functional interface. The Java class includes multiple attributes, and the object fields that need to be controlled by permissions are labeled so that the object fields correspond to a column in the database table, indicating the mapping position of these object fields in the database.

[0084] Step S303, receiving the access request initiated by the user, returning the interface object according to the access request, and determining the target attribute with the tag in the object, the target attribute contains the mapping relationship between the object field and the table field. The computer will not directly return the table column data queried by the user, but first returns (queries) the interface object, these objects contain multiple attributes, some of which carry tags and are regarded as target attributes. The target attribute contains the mapping relationship between the object field and the table field, that is, the target attribute points to a certain table column.

[0085] Step S304, obtain the permission role list of the table field according to the label and the mapping relationship, and perform permission verification on the permission role list of the table field. The computer will determine the target attribute according to the label, and then according to the table column pointed to by the target attribute, for the table column that has been configured with access rights, it can obtain the permission role of the corresponding table field, that is, obtain the permission role list of the table field. When performing permission verification on the permission role list of the table field, you can first obtain the permission role list of the configured sensitive field; compare the permission role list of the table field with the permission role list of the sensitive field; if each permission role in the permission role list of the table field exists in the permission role list of the sensitive field, it is determined that the permission verification has passed; otherwise, it is determined that the permission verification has failed. Optionally, the database administrator adds the configuration of the maximum access permission role list for people with sensitive fields to the database to prevent the administrator from misconfiguring the permission role of the data, resulting in sensitive data being seen by people who should not see it.

[0086] Step S305, intercept the target object that has passed the permission check, and obtain the table column pointed to by the attribute of the target object. The computer regards the object that has passed the permission check as the target object and intercepts it. The properties of the target object can be obtained by using the reflection mechanism. The properties include the common field name, the table name and field name corresponding to the object field with the label, that is, the table column pointed to by the target attribute.

[0087] Step S306, filter out the table columns that the user does not have access rights to and then return the data. The computer can obtain the user's permission role according to the access request; query the table column access rights corresponding to the table column stored in the cache; determine the table columns that the user does not have access rights to according to the user's permission role and the table column access rights. After filtering out the table columns that the user does not have access rights to, the remaining table column data is returned to the user.

[0088] In the above steps S301 to S306, through a new interface, an object is returned based on the interface, some attributes of the object carry tags, and the tags are used to map the relationship between the object field and the table field, intercept objects with tag attributes, obtain the table column pointed to by the attribute in the object, and filter the table column to which the user has no access rights and return the data. With such a setting, it is only necessary to label the table fields controlled by the permission role without writing business code to achieve flexible control of database access rights. Compared with intercepting SQL, it can reduce the error rate and reduce the R&D cost of R&D personnel to adapt to various complex SQL and parse and assemble SQL to write code. When it is necessary to adjust permissions or add new sensitive fields, it is only necessary to modify the annotations and configurations without modifying the business code, and it can take effect on all places involving the table column. The specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.

[0089] In this embodiment, a database access permission control device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. The terms "module", "unit", "subunit", etc. used below can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0090] Figure 6 : is a structural block diagram of the database access permission control device of this embodiment. Figure 6 As shown, the device includes: a response module 301, a verification module 302, an interception module 303, and a filtering module 304. Among them, the response module 301 is used to receive an access request initiated by a user, return the object of the interface according to the access request, and determine the target attribute carrying a label in the object, and the target attribute includes a mapping relationship between the object field and the table field; the verification module 302 is used to obtain the permission role list of the table field according to the label and the mapping relationship, and perform permission verification on the permission role list of the table field; the interception module 303 is used to intercept the target object that passes the permission verification, and obtain the table column pointed to by the attribute of the target object; the filtering module 304 is used to filter the table column to which the user does not have access rights and then return the data. It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation methods, and will not be repeated in this embodiment.

[0091] In one embodiment, the verification module 302 includes: an acquisition unit, used to obtain the permission role list of the configured sensitive field; a comparison unit, used to compare the permission role list of the table field with the permission role list of the sensitive field; if every permission role in the permission role list of the table field exists in the permission role list of the sensitive field, it is determined that the permission check has passed; otherwise, it is determined that the permission check has failed.

[0092] In one embodiment, the interception module 303 includes: a reflection unit, which is used to obtain the attributes of the target object by using the reflection mechanism, and the attributes include the common field name, the table name and field name corresponding to the object field carrying the label.

[0093] In one embodiment, the filtering module 304 includes: an acquisition unit, used to obtain the user's permission role according to the access request; a query unit, used to query the table column access rights corresponding to the table column stored in the cache; and determine the table columns to which the user does not have access rights according to the user's permission role and the table column access rights.

[0094] In one embodiment, the device also includes a configuration module, which includes: a definition unit for defining a tag class, the tag class includes table attributes and field attributes; a creation unit for creating an entity class, and annotating object fields in the entity class based on the tag class to map the object fields and table fields.

[0095] In one embodiment, the configuration module further includes: a configuration unit, which is used to create permission roles, configure permission roles for table fields of the database, and generate a permission role list for sensitive fields.

[0096] The above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0097] In addition, in combination with the database access permission control method provided in the above embodiments, a storage medium can also be provided in this embodiment to implement the method. The storage medium stores a computer program; when the computer program is executed by a processor, any one of the database access permission control methods in the above embodiments is implemented.

[0098] In one embodiment, the computer program, when executed by a processor, implements the following steps:

[0099] Receive access requests initiated by users, return the interface object according to the access request, and determine the target attribute with the label in the object. The target attribute contains the mapping relationship between the object field and the table field.

[0100] Obtain the permission role list of the table field according to the label and mapping relationship, and perform permission verification on the permission role list of the table field;

[0101] Intercept the target object that has passed the permission check and obtain the table column pointed to by the target object's attributes;

[0102] Filter out table columns that the user does not have access permissions to before returning data.

[0103] In one embodiment, the computer program, when executed by a processor, implements the following steps:

[0104] Get the permission role list of the configured sensitive fields;

[0105] Compare the permission role list of the table field with the permission role list of the sensitive field;

[0106] If every permission role in the permission role list of the table field exists in the permission role list of the sensitive field, the permission check is determined to have passed; otherwise, the permission check is determined to have failed.

[0107] In one embodiment, the computer program, when executed by a processor, implements the following steps:

[0108] The reflection mechanism is used to obtain the properties of the target object. The properties include common field names, table names and field names corresponding to object fields with labels.

[0109] In one embodiment, the computer program, when executed by a processor, implements the following steps:

[0110] Get the user's permission role based on the access request;

[0111] Query the table column access permissions corresponding to the table columns stored in the cache;

[0112] Based on the user's permission role and table column access permissions, determine the table columns to which the user does not have access permissions.

[0113] In one embodiment, the computer program, when executed by a processor, implements the following steps:

[0114] Define the tag class, which contains table attributes and field attributes;

[0115] Create an entity class and annotate the object fields in the entity class based on the tag class to map the object fields and table fields.

[0116] In one embodiment, the computer program, when executed by a processor, implements the following steps:

[0117] Create permission roles, configure permission roles for database table fields, and generate a permission role list for sensitive fields.

[0118] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store tabular data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a database access permission control method is implemented.

[0119] Those skilled in the art will understand that Figure 7The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0122] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for controlling access rights to a database, characterized in that: include: Receive an access request initiated by a user, return an object of the interface according to the access request, and determine a target attribute carrying a tag in the object, wherein the target attribute includes a mapping relationship between an object field and a table field; Acquire the permission role list of the table field according to the tag and the mapping relationship, and perform permission verification on the permission role list of the table field; Intercepting the target object that passes the permission check, and obtaining the table column pointed to by the attribute of the target object; The data is returned after filtering out the table columns to which the user does not have access permissions.

2. The database access permission control method according to claim 1, characterized in that: Perform permission check on the permission role list of the table field, including: Get the permission role list of the configured sensitive fields; Compare the permission role list of the table field with the permission role list of the sensitive field; If every permission role in the permission role list of the table field exists in the permission role list of the sensitive field, it is determined that the permission check has passed; otherwise, it is determined that the permission check has failed.

3. The method for controlling database access rights according to claim 1, characterized in that: Get the table column pointed to by the attribute of the target object, including: The properties of the target object are obtained by using a reflection mechanism, where the properties include common field names, table names and field names corresponding to the object fields carrying the labels.

4. The method for controlling database access rights according to claim 1, characterized in that: Filter the table columns that the user does not have access rights to before returning the data, including: Obtaining the permission role of the user according to the access request; Querying the table column access permissions corresponding to the table column stored in the cache; According to the permission role of the user and the table column access permission, the table columns to which the user does not have access permission are determined.

5. The method for controlling database access rights according to claim 1, characterized in that: Before responding to the access request initiated by the user, the method further includes: Define a tag class, wherein the tag class includes table attributes and field attributes; An entity class is created, and the object fields in the entity class are annotated based on the tag class to map the object fields with the table fields.

6. The method for controlling database access rights according to claim 1, characterized in that: Before responding to the access request initiated by the user, the method further includes: Create permission roles, configure the permission roles for table fields of the database, and generate a permission role list for sensitive fields.

7. A database access permission control device, characterized in that: The device comprises: A response module, used to receive an access request initiated by a user, return an object of the interface according to the access request, and determine a target attribute carrying a tag in the object, wherein the target attribute includes a mapping relationship between an object field and a table field; A verification module, used for obtaining a permission role list of the table field according to the label and the mapping relationship, and performing permission verification on the permission role list of the table field; An interception module, used to intercept the target object that passes the permission check and obtain the table column pointed to by the attribute of the target object; The filtering module is used to filter the table columns to which the user has no access rights before returning the data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of accessing the database according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of accessing the database according to any one of claims 1 to 6 are implemented.

Images