Metadata processing method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a metadata processing method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: receiving a metadata processing request sent by a request initiator, wherein the metadata processing request comprises a metadata identifier and a user identifier corresponding to the request initiator; acquiring corresponding target non-sensitive information from a database for storing the non-sensitive information based on the metadata identifier; acquiring corresponding target sensitive information from a sensitive information storage server on the basis of the metadata identifier under the condition that the request initiator is determined to have the sensitive information acquisition permission on the basis of the user identifier; the target non-sensitive information and the target sensitive information are combined to obtain target metadata, and the target metadata is used for carrying out data processing operation corresponding to the metadata processing request. In this way, the security of metadata processing is ensured.

Description

Technical Field

[0001] The present application relates to the field of metadata processing technology, and in particular to a metadata processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of data processing technology, metadata management has become particularly important in distributed data processing systems. Metadata is data that describes data, such as database table results.

[0003] In the prior art, during the metadata processing, it is necessary to directly obtain the metadata from the background database of the computing engine, and perform corresponding processing based on the obtained metadata. However, any user of the computing engine can access the background database to obtain metadata, which is prone to information leakage and leads to security risks in the metadata processing process. Summary of the invention

[0004] Based on this, it is necessary to provide a metadata processing method, apparatus, computer device, computer-readable storage medium and computer program product that can ensure the security of metadata processing in response to the above technical problems.

[0005] In a first aspect, the present application provides a metadata processing method, comprising:

[0006] Receiving a metadata processing request sent by a request initiator, wherein the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator;

[0007] Based on the metadata identifier, obtaining corresponding target non-sensitive information from a database for storing non-sensitive information;

[0008] In a case where it is determined based on the user identifier that the request initiator has the sensitive information acquisition permission, acquiring corresponding target sensitive information from a sensitive information storage server based on the metadata identifier;

[0009] The target non-sensitive information and the target sensitive information are combined to obtain target metadata, where the target metadata is used to perform a data processing operation corresponding to the metadata processing request.

[0010] In a second aspect, the present application also provides a metadata processing device, including:

[0011] A request receiving module, used to receive a metadata processing request sent by a request initiator, wherein the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator;

[0012] A first information acquisition module, configured to acquire corresponding target non-sensitive information from a database for storing non-sensitive information based on the metadata identifier;

[0013] A second information acquisition module is used to acquire the corresponding target sensitive information from the sensitive information storage server based on the metadata identifier when it is determined based on the user identifier that the request initiator has the sensitive information acquisition authority;

[0014] The metadata acquisition module is used to combine the target non-sensitive information and the target sensitive information to obtain target metadata, and the target metadata is used to perform a data processing operation corresponding to the metadata processing request.

[0015] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0016] Receiving a metadata processing request sent by a request initiator, wherein the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator;

[0017] Based on the metadata identifier, obtaining corresponding target non-sensitive information from a database for storing non-sensitive information;

[0018] In a case where it is determined based on the user identifier that the request initiator has the sensitive information acquisition permission, acquiring corresponding target sensitive information from a sensitive information storage server based on the metadata identifier;

[0019] The target non-sensitive information and the target sensitive information are combined to obtain target metadata, where the target metadata is used to perform a data processing operation corresponding to the metadata processing request.

[0020] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0021] Receiving a metadata processing request sent by a request initiator, wherein the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator;

[0022] Based on the metadata identifier, obtaining corresponding target non-sensitive information from a database for storing non-sensitive information;

[0023] In a case where it is determined based on the user identifier that the request initiator has the sensitive information acquisition permission, acquiring corresponding target sensitive information from a sensitive information storage server based on the metadata identifier;

[0024] The target non-sensitive information and the target sensitive information are combined to obtain target metadata, where the target metadata is used to perform a data processing operation corresponding to the metadata processing request.

[0025] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0026] Receiving a metadata processing request sent by a request initiator, wherein the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator;

[0027] Based on the metadata identifier, obtaining corresponding target non-sensitive information from a database for storing non-sensitive information;

[0028] In a case where it is determined based on the user identifier that the request initiator has the sensitive information acquisition permission, acquiring corresponding target sensitive information from a sensitive information storage server based on the metadata identifier;

[0029] The target non-sensitive information and the target sensitive information are combined to obtain target metadata, where the target metadata is used to perform a data processing operation corresponding to the metadata processing request.

[0030] The above-mentioned metadata processing method, device, computer equipment, computer-readable storage medium and computer program product receive a metadata processing request sent by a request initiator, wherein the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator; based on the metadata identifier, the corresponding target non-sensitive information is obtained from a database for storing non-sensitive information, that is, only non-sensitive information can be obtained from the database, avoiding directly obtaining sensitive information from the database; when it is determined based on the user identifier that the request initiator has the authority to obtain sensitive information, the corresponding target sensitive information is obtained from a sensitive information storage server based on the metadata identifier. That is, before obtaining sensitive information, it is pre-verified whether the user has the qualification to obtain sensitive information, and only if so, the sensitive information is allowed to be obtained from the server side dedicated to storing sensitive information. Then, by combining the target non-sensitive information and the target sensitive information, the target metadata is obtained, thereby being able to perform a data processing operation corresponding to the metadata processing request based on the obtained target metadata. The whole process can effectively ensure the security of sensitive information and avoid security risks in the metadata processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0032] FIG1 is a diagram of an application environment of a metadata processing method according to an embodiment;

[0033] Figure 2 A schematic diagram of a metadata processing method in one embodiment;

[0034] Figure 3 A schematic diagram of a creation phase in one embodiment;

[0035] Figure 4 A schematic diagram of metadata management steps in an embodiment;

[0036] Figure 5 A schematic diagram of a target metadata determination step in one embodiment;

[0037] Figure 6 is a schematic diagram of a metadata processing process in one embodiment;

[0038] Figure 7 is a structural block diagram of a metadata processing device in one embodiment;

[0039] FIG. 8 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0041] Before introducing the embodiments of the present application, the terms involved in the present application are explained first:

[0042] Catalog: It is a component provided by Flink (an open source, distributed, high-performance, highly available, high-throughput, and low-latency big data processing engine that is mainly used for stream processing and can also be used for batch processing, and realizes unified batch and stream processing) for managing and accessing metadata. It provides a unified interface for easy integration with external systems.

[0043] SQL Client: It is a tool provided by Flink that allows users to execute stream processing tasks on Flink through SQL (Structured Query Language) statements, thereby simplifying the development process of stream processing applications.

[0044] Connector: Flink connector is mainly used to connect the Flink computing engine with the external storage system, enabling Flink to read data from different external data sources, process it, and then write the data to another storage engine.

[0045] Table: Flink is a high-level abstraction based on Connector that is used to define and operate structured data. It allows users to use SQL or Table API (Table interface) to process data from external systems.

[0046] In order to manage metadata, Flink's Catalog is introduced. By centrally managing metadata, the metadata of the same Table object can be shared among different data processing tasks, avoiding repeated definitions of the same Table, inconsistent definitions, and untimely modifications when metadata changes. Catalog provides a unified interface to access and manage the table structure and data of these data sources. Users can interact with various data sources conveniently and quickly based on SQL or Table API, without hard-coding data source connection information.

[0047] In related technologies, the entire metadata is stored in plain text in Flink's backend database. Any Flink user can access the backend database to obtain the metadata when they need to process the metadata (such as management, use, etc.). However, once the metadata contains sensitive information, it is very easy to leak sensitive information, so security cannot be ensured when processing the metadata.

[0048] The embodiment of the present application provides a metadata processing method, which receives a metadata processing request sent by a request initiator, wherein the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator; based on the metadata identifier, the corresponding target non-sensitive information is obtained from a database for storing non-sensitive information, that is, only non-sensitive information can be obtained from the database, avoiding directly obtaining sensitive information from the database; when it is determined based on the user identifier that the request initiator has the authority to obtain sensitive information, the corresponding target sensitive information is obtained from a sensitive information storage server based on the metadata identifier. In other words, before obtaining sensitive information, it is pre-verified whether the user has the qualifications to obtain sensitive information, and only if so, the sensitive information is allowed to be obtained from the server side dedicated to storing sensitive information. Then, by combining the target non-sensitive information and the target sensitive information, the target metadata is obtained, thereby enabling the data processing operation corresponding to the metadata processing request to be performed based on the obtained target metadata. The whole process can effectively ensure the security of sensitive information and avoid security risks in the metadata processing process.

[0049] The metadata processing method provided in the embodiment of the present application can be applied in the application environment shown in Figure 1. The terminal 102 communicates with the target server 104 through a network.

[0050] In some embodiments, after the request initiator logs in to the terminal 102 with a user identifier, the request initiator initiates a metadata processing request through the user identifier, and the terminal 102 sends the metadata processing request to the target server 104. The target server 104 receives the metadata processing request sent by the request initiator, and the metadata processing request includes the metadata identifier and the user identifier corresponding to the request initiator; the target server 104 obtains the corresponding target non-sensitive information from the database for storing non-sensitive information based on the metadata identifier; when the target server 104 determines that the request initiator has the permission to obtain sensitive information based on the user identifier, the target server 104 obtains the corresponding target sensitive information from the sensitive information storage server based on the metadata identifier; the target non-sensitive information and the target sensitive information are combined to obtain target metadata, and the target metadata is used to perform a data processing operation corresponding to the metadata processing request.

[0051] The target server 104 is a server on which a computing engine is deployed, such as a server on which Flink is deployed. The target server 104 is a metadata acquisition server for acquiring target metadata, and is a different server from the sensitive information storage server. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, etc. The server may be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0052] In an exemplary embodiment, Figure 2 As shown, a metadata processing method is provided, which is described by taking the method applied to the target server 104 in FIG. 1 as an example, and includes the following steps S202 to S208. Among them:

[0053] Step S202: receiving a metadata processing request sent by a request initiator, where the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator.

[0054] The user identifier is used to specify the request initiator, and the metadata processing request is a request for metadata processing, exemplarily, a request to manage metadata, for example, to create or modify a table. Exemplarily, a request to use metadata. The metadata identifier is used to refer to the corresponding metadata.

[0055] In an exemplary embodiment, before receiving the metadata processing request sent by the request initiator, the target server creates a metadata processing unit (Catalog proxy object, which can be understood as a Catalog instance) corresponding to the user identifier, and executes steps S204-S208 through the metadata processing component. In this embodiment, the metadata processing unit is used to execute non-sensitive information acquisition services, execute sensitive information acquisition permission verification services, and execute sensitive information acquisition services.

[0056] In an exemplary embodiment, the target server creates a proxy unit (Catalog proxy) and a metadata processing unit (Catalog proxy object) corresponding to the user identifier, and executes steps S204-S208 in collaboration with the proxy unit and the metadata processing unit. In this embodiment, the metadata processing unit is used to perform non-sensitive information acquisition services, and the proxy unit is used to perform sensitive information acquisition permission verification services and sensitive information acquisition services.

[0057] Among them, the proxy unit and the metadata processing unit are both units in the target server.

[0058] For example, Figure 3As shown, it is a schematic diagram of the creation stage in one embodiment. When the target server determines that the current user who triggers the SQL client does not have a user identifier (such as the current user triggers a registration operation on the SQL client of the terminal), first go to the user table of the database to add a user identifier for the user, and set whether it has the permission to obtain sensitive information. If it is set to have, then add the user identifier to the permission table to indicate that the user identifier has the permission to obtain sensitive information, and then execute the following method 1 or method 2. When the target server determines that the current user has a user identifier, directly execute method 1 or method 2. Method 1: The current user uses the SQL client to initiate a Catalog registration request to instruct the target server to register the metadata processing unit and the proxy unit using SQL (or only register the metadata processing unit using SQL). Specifically, the target server needs to specify the type parameter value as the type identifier defined by the proxy unit, and configure the user identifier of the current user to create the proxy unit, and create the metadata processing unit through the proxy unit. After the metadata processing unit is created, the database connection is initialized through the metadata processing unit, and the user identifier is cached through the proxy unit. Method 2: Write an application and register (create) a metadata processing unit through the Table API. You can directly build the proxy unit through a custom proxy unit. After taking the user ID as a construction parameter, the metadata processing unit initializes the database connection and caches the user ID through the proxy unit. If the current user subsequently initiates a metadata processing request, the current user will perform subsequent operations as the request initiator.

[0059] Among them, the steps of customizing proxy units include: the first one: define the proxy unit: directly inherit from the metadata processing unit, add the user ID to the construction method; rewrite the getTable (get Table) method, add permission judgment, and connect to the sensitive information storage server logic. The second one: define the Catalog proxy factory to support the use of proxy units in SQL clients: directly inherit the proxy unit factory class; rewrite the factoryIdentifier method (a common method in software development, especially when using frameworks or libraries to develop custom components or connectors. Its function is to return an identifier (usually a string) to uniquely identify the custom component or connector), return a unique type identifier; rewrite the optionalOptions method (a method that provides optional configuration items) to add a user ID option.

[0060] Step S204: based on the metadata identifier, obtain the corresponding target non-sensitive information from a database for storing non-sensitive information.

[0061] Among them, non-sensitive information refers to information with low security, and non-sensitive information is part of metadata. In some embodiments, the database for storing non-sensitive information only stores non-sensitive information in metadata. For example, the database stores the non-sensitive information in each metadata. It can be understood that for metadata containing only non-sensitive information (non-sensitive information is the metadata itself), the database stores the non-sensitive information, that is, the metadata containing only non-sensitive information itself is stored. Exemplarily, the metadata identifier of each metadata is stored in the database corresponding to the non-sensitive information in the metadata. The database can be understood as the back-end database of the target server.

[0062] When only the metadata processing unit exists, illustratively, the target non-sensitive information corresponding to the metadata identifier is obtained from a database for storing non-sensitive information through the metadata processing unit in the target server.

[0063] When there are a metadata processing unit and an agent unit, illustratively, the agent unit in the target server calls the interface of the metadata processing unit to query the target non-sensitive information corresponding to the metadata identifier from the database for storing non-sensitive information. For example, the agent unit calls the interface of the metadata processing unit to instruct the metadata processing unit to query the corresponding target non-sensitive information from the database and return it to the agent unit.

[0064] Step S206, when it is determined based on the user identifier that the request initiator has the sensitive information acquisition authority, the corresponding target sensitive information is acquired from the sensitive information storage server based on the metadata identifier.

[0065] The sensitive information access permission refers to the permission to access sensitive information. The sensitive information is highly secure information, and the sensitive information is another part of the metadata. Exemplarily, the sensitive information is the connection information of the external data source, such as the connection information of the external data described by the metadata.

[0066] The sensitive information storage server stores the sensitive information in the metadata, which can be understood as a third-party system. Exemplarily, the sensitive information storage server stores the metadata identifier of each metadata in correspondence with the sensitive information in the metadata.

[0067] In an exemplary embodiment, the method also includes: obtaining a permission table for obtaining sensitive information; querying whether a user identifier exists in the permission table to obtain a query result; if the query result indicates that a user identifier exists in the permission table, determining that the request initiator has permission to obtain sensitive information; if the query result indicates that a user identifier does not exist in the permission table, determining that the request initiator does not have permission to obtain sensitive information.

[0068] Furthermore, the permission table also stores the mapping relationship between the user identifier and the sensitive information level. After determining that the user identifier exists in the permission table, the sensitive information level of the user identifier is determined based on the mapping relationship in the permission table. If the sensitive information level is consistent with the sensitive information level corresponding to the metadata identifier, it means that the user identifier has the ability to obtain the sensitive information corresponding to the metadata identifier. Based on the metadata identifier, the corresponding target sensitive information is loaded from the sensitive information storage server.

[0069] It should be noted that in this embodiment, when there is only a metadata processing unit, this embodiment is executed by the metadata processing unit. When there are a metadata processing unit and an agent unit, this embodiment is executed by the agent unit.

[0070] In this embodiment, only the user ID that has configured the sensitive information access permission will be stored in the permission table. Therefore, by querying the permission table to see if there is a user ID, it is possible to quickly determine whether the sensitive information access permission is available, thereby improving the efficiency of permission query. In addition, setting sensitive information setting permissions for users can achieve fine-grained permission management between users and sensitive information.

[0071] Step S208: Combine the target non-sensitive information and the target sensitive information to obtain target metadata, where the target metadata is used to perform a data processing operation corresponding to the metadata processing request.

[0072] When only the metadata processing unit exists, illustratively, the metadata processing unit concatenates the target non-sensitive information and the target sensitive information to obtain the target metadata.

[0073] When there are a metadata processing unit and a proxy unit, illustratively, the proxy unit obtains the target non-sensitive information returned by the metadata processing unit, and the proxy unit splices the target non-sensitive information and the target sensitive information to obtain the target metadata.

[0074] In the above metadata processing method, by receiving the metadata processing request sent by the request initiator, the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator; based on the metadata identifier, the corresponding target non-sensitive information is obtained from the database used to store non-sensitive information, that is, only non-sensitive information can be obtained from the database, avoiding directly obtaining sensitive information from the database; in the case where it is determined based on the user identifier that the request initiator has the authority to obtain sensitive information, based on the metadata identifier, the corresponding target sensitive information is obtained from the sensitive information storage server. In other words, before obtaining sensitive information, it is pre-verified whether the user has the qualification to obtain sensitive information, and if so, it is allowed to obtain sensitive information from the server side dedicated to storing sensitive information. Then, by combining the target non-sensitive information and the target sensitive information, the target metadata is obtained, thereby being able to perform a data processing operation corresponding to the metadata processing request based on the obtained target metadata. The whole process can effectively ensure the security of sensitive information and avoid security risks in the metadata processing process.

[0075] In an exemplary embodiment, the metadata processing request also includes a data processing type, and the method also includes: determining whether the data processing type is a metadata usage type, and if the data processing type is a metadata usage type, returning to the step of obtaining the corresponding target non-sensitive information from a database for storing non-sensitive information based on the metadata identifier to continue execution.

[0076] Exemplarily, when the data processing type is the metadata usage type, after the target metadata is acquired by the above process, the target server returns the target metadata to the terminal logged in by the request initiator to instruct the terminal to perform corresponding operations based on the target metadata.

[0077] For example, when there is only a metadata processing unit, the metadata processing unit returns the target metadata to the terminal. For another example, when there is a metadata processing unit and an agent unit, the agent unit returns the target metadata to the terminal.

[0078] In this embodiment, before obtaining the target non-sensitive information, it is pre-determined whether the current metadata processing request is a request of the metadata use type. If so, it is necessary to obtain the corresponding information from the database or sensitive information storage server to determine the target metadata, so that the terminal can use the target metadata, such as analysis, etc. Therefore, when it is necessary to use the metadata, the security of the metadata acquisition process can be effectively ensured, which also ensures the security of the subsequent metadata use process, avoiding the security risks of metadata acquisition and use.

[0079] In an exemplary embodiment, the method further includes: when the data processing type is a metadata management type, determining management metadata for metadata management, the management metadata does not contain sensitive information; and storing the management metadata and the metadata identifier in a database in correspondence.

[0080] The metadata management type refers to the creation of metadata or the modification of metadata. Management metadata does not contain sensitive information and can be understood as metadata that only contains non-sensitive information. Management metadata can be creation metadata obtained by performing metadata creation or modification metadata obtained by performing metadata modification.

[0081] Optionally, after the request initiator creates a metadata identifier in a SQL client or program through a user identifier, a metadata processing request is generated based on the user identifier, the metadata identifier and the selected metadata creation type, and sent to the target server.

[0082] Exemplarily, when only the metadata processing unit is created, the metadata processing request is parsed by the metadata processing unit, the data processing type is determined to be the metadata creation type, and creation metadata corresponding to the metadata identifier is created (containing only non-sensitive information), and the creation metadata and the metadata identifier are stored correspondingly in the database.

[0083] Exemplarily, when the metadata processing unit and the proxy unit are created, after creating the creation metadata, the proxy unit calls the metadata processing unit to instruct the metadata proxy unit to store the creation metadata and the metadata identifier in the database in correspondence.

[0084] Optionally, after the request initiator determines the metadata identifier of the modified metadata in the SQL client or program through the user identifier, a metadata processing request is generated based on the user identifier, the modified metadata (containing only non-sensitive information), the metadata identifier and the selected metadata modification type, and sent to the target server.

[0085] Exemplarily, after only the metadata processing unit is created, the metadata processing request is parsed by the metadata processing unit, and after determining that the data processing type is a metadata modification type, the corresponding metadata (metadata containing only non-sensitive information) is queried from the database based on the metadata identifier and deleted, and the modified metadata and the metadata identifier are stored in the database accordingly.

[0086] Exemplarily, after the metadata processing unit and the proxy unit are created, after determining that the metadata needs to be modified, the proxy unit calls the metadata processing unit to instruct the metadata proxy unit to query the corresponding metadata (metadata containing only non-sensitive information) from the database based on the metadata identifier and delete it, and store the modified metadata and the metadata identifier in the database accordingly.

[0087] like Figure 4 The figure shows a schematic diagram of the metadata management steps in an embodiment. As described above, after the request initiator uses the SQL client to initiate a metadata processing request, it instructs the target server to create a metadata processing unit and an agent unit corresponding to the metadata processing request. Then, after receiving the metadata processing request sent by the request initiator, the agent unit determines that the data processing type is a metadata modification type of the metadata management type, and determines that the modified metadata indicated by the metadata processing request does not involve sensitive information. The agent unit calls the metadata processing unit interface to instruct the metadata processing unit to modify the metadata based on the modified metadata and store it persistently in the database.

[0088] In this embodiment, when it is determined that the data processing type is a metadata management type, the management metadata that does not contain sensitive information is directly stored in the database, so that it can be easily retrieved from the database later, thereby improving the convenience of obtaining non-sensitive information.

[0089] In an exemplary embodiment, the method further includes: in a case where it is determined based on the user identification that the request initiator does not have permission to obtain sensitive information, using the target non-sensitive information as target metadata.

[0090] Exemplarily, when only the metadata processing unit is created, when the metadata processing unit determines based on the user identifier that the request initiator does not have permission to obtain sensitive information, the metadata processing unit uses the target non-sensitive information as target metadata and returns it to the request initiator.

[0091] Exemplarily, when the proxy unit and the metadata processing unit are created, when the proxy unit determines based on the user identifier that the request initiator does not have permission to obtain sensitive information, the proxy unit obtains the non-sensitive information returned by the metadata processing unit, and uses the non-sensitive information as target metadata and returns it to the request initiator.

[0092] In this embodiment, under the premise that it is determined that the request initiator does not have the authority to obtain sensitive information, there is no need to initiate a sensitive information acquisition request to the sensitive information storage server. The acquired target non-sensitive information is directly used as the target metadata, thereby avoiding the erroneous acquisition of sensitive information and ensuring the legitimacy of the metadata processing process.

[0093] As described above, the sensitive information stored in the sensitive information storage server may be stored in plain text. When it is determined that the sensitive information is allowed to be obtained, the plain text sensitive information may be directly obtained from the sensitive information storage server.

[0094] Of course, the sensitive information stored in the sensitive information storage server may be stored in the form of ciphertext. To this end, in an exemplary embodiment, based on the metadata identifier, the corresponding target sensitive information is obtained from the sensitive information storage server, including: generating a sensitive information acquisition request based on the metadata identifier, and sending the sensitive information acquisition request to the sensitive information storage server to instruct the sensitive information storage server to parse the sensitive information acquisition request, obtain the metadata identifier, and query the corresponding encrypted sensitive information based on the metadata identifier; receiving the encrypted sensitive information returned by the sensitive information storage server, decrypting the encrypted sensitive information, and obtaining the target sensitive information.

[0095] Exemplarily, the encrypted sensitive information determining step includes: the sensitive information storage server encrypts the sensitive information with its own private key to obtain encrypted sensitive information.

[0096] It should be noted that when only the metadata processing unit exists, the above-mentioned steps of generating a sensitive information acquisition request based on the metadata identifier, sending the sensitive information acquisition request to the sensitive information storage server, and receiving the encrypted sensitive information returned by the sensitive information storage server, decrypting the encrypted sensitive information, and obtaining the target sensitive information are executed by the metadata processing unit.

[0097] When there are metadata processing units and proxy units, the above-mentioned steps of generating a sensitive information acquisition request based on the metadata identifier, sending the sensitive information acquisition request to the sensitive information storage server, and receiving the encrypted sensitive information returned by the sensitive information storage server, decrypting the encrypted sensitive information, and obtaining the target sensitive information are executed by the proxy unit.

[0098] The step of decrypting the encrypted sensitive information to obtain the target sensitive information includes: decrypting the encrypted sensitive information based on the public key of the sensitive information storage server to obtain the target sensitive information. The public key may be returned along with the encrypted sensitive information or may be obtained in advance, and the specific details are not limited.

[0099] like Figure 5 FIG. 1 is a schematic diagram of a target metadata determination step in an embodiment. Figure 5The collaborative execution of the proxy unit and the metadata processing unit is used for explanation: First, the proxy unit calls the metadata processing unit to obtain the target non-sensitive information. Specifically, the proxy unit calls the metadata processing unit to instruct the metadata processing unit to query the target non-sensitive information corresponding to the metadata identifier from the database. Next, the proxy unit determines the sensitive information acquisition authority of the user identifier. When the proxy unit determines that the user identifier has the sensitive information acquisition authority, the proxy unit generates a sensitive information acquisition request based on the metadata identifier, and sends the sensitive information acquisition request to the sensitive information storage server to obtain the encrypted sensitive information returned by the sensitive information storage server. The proxy unit decrypts the encrypted sensitive information based on the public key of the sensitive information storage server to obtain the target sensitive information. The proxy unit determines the target metadata based on the target sensitive information and the target non-sensitive information. When the proxy unit determines that the user identifier does not have the sensitive information acquisition authority, the target non-sensitive information is used as the target metadata.

[0100] In the above process, the proxy unit dynamically loads encrypted sensitive information from the sensitive information storage server, which solves the asynchrony caused by the inability to perceive information changes in real time and the complex management problem of manual synchronization to the Catalog.

[0101] In this embodiment, sensitive information is stored in a sensitive information storage server in a ciphertext format, which increases security and avoids security risks caused by centrally storing plaintext sensitive information in a database.

[0102] In a specific embodiment, Figure 6 FIG. 1 is a schematic diagram of a metadata processing process in an embodiment. Figure 6 , involving terminals where SQL clients or programs are deployed, target servers, and sensitive information storage servers. The specific steps are as follows:

[0103] S1: The current user starts the SQL client or program on the terminal. When it is determined that the user ID of the current user exists, a registration operation is performed on the SQL client or program, and the user ID is attached to the proxy unit. The proxy unit creates a metadata processing unit and caches the user ID. The metadata processing unit initializes the database connection.

[0104] Specifically, the target server needs to specify the type parameter value as the type identifier defined by the proxy unit, and configure the user identifier of the current user to create the proxy unit, and create the metadata processing unit through the proxy unit. After the metadata processing unit is created, the database connection is initialized through the metadata processing unit, and the user identifier is cached through the proxy unit.

[0105] After creating the proxy unit and metadata processing unit corresponding to the SQL client or program logged in by the current user on the target server, the current user, as the request initiator, initiates a metadata processing request to the proxy unit.

[0106] If the data processing type in the metadata processing request is the metadata management type, it is determined that the request initiator has executed the trigger operation of creating or modifying a table (not containing sensitive information) in the SQL client or program, and the metadata processing request is determined to be a metadata management request, and the following S2.1 is executed; if the data processing type in the metadata processing request is the metadata usage type, it is determined that the request initiator has executed the trigger operation of viewing the table structure and using metadata during the data processing task operation in the SQL client or program, and the metadata processing request is determined to be a metadata usage request, and S2.21 in the following S2.2 is executed.

[0107] S2.1: After receiving the metadata processing request, the proxy unit calls the metadata processing unit to instruct the metadata unit to perform a creation or update operation, and stores the created metadata or updated metadata in a corresponding database.

[0108] Specifically, after the request initiator creates a metadata identifier in the SQL client or program through the user identifier, a metadata processing request is generated based on the user identifier, the metadata identifier and the selected metadata creation type, and sent to the proxy unit of the target server. After the proxy unit creates metadata corresponding to the metadata creation, the metadata processing unit is called to instruct the metadata proxy unit to store the created metadata and the metadata identifier in the database accordingly.

[0109] Specifically, after the request initiator determines the metadata identifier of the metadata modification in the SQL client or program through the user identifier, the metadata processing request is generated based on the user identifier, the modified metadata (containing only non-sensitive information), the metadata identifier and the selected metadata modification type, and sent to the proxy unit of the target server. The proxy unit determines that the data processing type is the metadata modification type based on the metadata processing request, and therefore, based on the modified metadata and metadata identifier determined in the metadata processing request, calls the metadata processing unit to instruct the metadata proxy unit to query the corresponding metadata (containing only non-sensitive information metadata) from the database based on the metadata identifier and delete it, and store the modified metadata and the metadata identifier in the database accordingly.

[0110] S2.21 in S2.2: After receiving the metadata processing request, the proxy unit determines the metadata identifier and calls the metadata processing unit to instruct the metadata processing unit to query the target non-sensitive information corresponding to the metadata identifier from the database. The proxy unit obtains the target sensitive information returned by the metadata processing unit. The proxy unit makes a sensitive information acquisition authority judgment based on the user identifier. If it is verified that the user identifier does not have the sensitive information acquisition authority, S2.22 is executed. If it is verified that the user identifier has the sensitive information acquisition authority, S2.23 is executed.

[0111] S2.22: The proxy unit directly returns the target non-sensitive information to the terminal to instruct the terminal to perform corresponding metadata usage operations based on the target non-sensitive information. The target non-sensitive information can be regarded as target metadata containing only non-sensitive information without the permission to obtain sensitive information.

[0112] S2.23: The proxy unit requests the sensitive information storage server to load the target sensitive information, and receives the encrypted sensitive information returned by the sensitive information storage server. The encrypted sensitive information is obtained by encrypting the target sensitive information by the sensitive information storage server using its own private key. The proxy unit decodes the encrypted sensitive information using the shared sensitive information storage server to obtain the target sensitive information, and determines the target metadata based on the target sensitive information and the target non-sensitive information. The proxy unit returns the target metadata to the terminal to instruct the terminal to perform corresponding metadata usage operations based on the target metadata. The target metadata is metadata containing sensitive information with the permission to obtain sensitive information.

[0113] In this embodiment, the metadata processing method, apparatus, computer device, computer-readable storage medium and computer program product described above receive a metadata processing request sent by a request initiator, wherein the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator; based on the metadata identifier, the corresponding target non-sensitive information is obtained from a database for storing non-sensitive information, that is, only non-sensitive information can be obtained from the database, avoiding directly obtaining sensitive information from the database; when it is determined based on the user identifier that the request initiator has the authority to obtain sensitive information, the corresponding target sensitive information is obtained from a sensitive information storage server based on the metadata identifier. That is, before obtaining sensitive information, it is pre-verified whether the user has the qualification to obtain sensitive information, and only if so, the sensitive information is allowed to be obtained from the server side dedicated to storing sensitive information. Then, by combining the target non-sensitive information and the target sensitive information, the target metadata is obtained, thereby enabling the data processing operation corresponding to the metadata processing request to be performed based on the obtained target metadata. The whole process can effectively ensure the security of sensitive information and avoid security risks in the metadata processing process.

[0114] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0115] Based on the same inventive concept, the embodiment of the present application also provides a metadata processing device for implementing the metadata processing method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in the one or more metadata processing device embodiments provided below can refer to the limitations of the metadata processing method above, and will not be repeated here.

[0116] In an exemplary embodiment, Figure 7 As shown, a metadata processing device 700 is provided, comprising: a request receiving module 702, a first information obtaining module 704, a second information obtaining module 706 and a metadata obtaining module 708, wherein:

[0117] The request receiving module 702 is used to receive a metadata processing request sent by a request initiator, where the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator;

[0118] A first information acquisition module 704 is used to acquire corresponding target non-sensitive information from a database for storing non-sensitive information based on the metadata identifier;

[0119] The second information acquisition module 706 is used to acquire the corresponding target sensitive information from the sensitive information storage server based on the metadata identifier when it is determined based on the user identifier that the request initiator has the sensitive information acquisition authority;

[0120] The metadata acquisition module 708 is used to combine the target non-sensitive information and the target sensitive information to obtain the target metadata, and the target metadata is used to perform a data processing operation corresponding to the metadata processing request.

[0121] In an exemplary embodiment, the metadata processing request also includes a data processing type, and the device also includes a type judgment module, which is used to judge whether the data processing type is a metadata usage type. When the data processing type is a metadata usage type, the module returns to the step of obtaining the corresponding target non-sensitive information from a database for storing non-sensitive information based on the metadata identifier to continue execution.

[0122] In an exemplary embodiment, the device also includes a metadata storage module, which is used to determine the management metadata for metadata management when the data processing type is a metadata management type, and the management metadata does not contain sensitive information; and the management metadata and metadata identifier are stored in a database accordingly.

[0123] In an exemplary embodiment, the device also includes a permission query module, which is used to obtain a permission table for obtaining sensitive information; query whether there is a user identifier in the permission table to obtain a query result; if the query result indicates that there is a user identifier in the permission table, it is determined that the request initiator has the permission to obtain sensitive information; if the query result indicates that there is no user identifier in the permission table, it is determined that the request initiator does not have the permission to obtain sensitive information.

[0124] In an exemplary embodiment, the metadata obtaining module 708 is further configured to use the target non-sensitive information as the target metadata when it is determined based on the user identification that the request initiator does not have the permission to obtain sensitive information.

[0125] In an exemplary embodiment, the second information acquisition module 706 is used to generate a sensitive information acquisition request based on the metadata identifier, and send the sensitive information acquisition request to the sensitive information storage server to instruct the sensitive information storage server to parse the sensitive information acquisition request, obtain the metadata identifier, and query the corresponding encrypted sensitive information based on the metadata identifier; receive the encrypted sensitive information returned by the sensitive information storage server, decrypt the encrypted sensitive information, and obtain the target sensitive information.

[0126] Each module in the metadata processing device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0127] In an exemplary embodiment, a computer device is provided, which can be a server or a terminal, and its internal structure diagram can be shown in Figure 8. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a metadata processing method is implemented.

[0128] Those skilled in the art will understand that the structure shown in FIG. 8 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0129] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: receiving a metadata processing request sent by a request initiator, the metadata processing request including a metadata identifier and a user identifier corresponding to the request initiator; based on the metadata identifier, obtaining corresponding target non-sensitive information from a database for storing non-sensitive information; when it is determined based on the user identifier that the request initiator has permission to obtain sensitive information, obtaining corresponding target sensitive information from a sensitive information storage server based on the metadata identifier; combining the target non-sensitive information and the target sensitive information to obtain target metadata, the target metadata being used to perform a data processing operation corresponding to the metadata processing request.

[0130] In one embodiment, the metadata processing request also includes a data processing type, and the processor further implements the following steps when executing the computer program: determining whether the data processing type is a metadata usage type, and if the data processing type is a metadata usage type, returning a step based on the metadata identifier to continue execution of obtaining the corresponding target non-sensitive information from a database for storing non-sensitive information.

[0131] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when the data processing type is the metadata management type, the management metadata for metadata management is determined, and the management metadata does not contain sensitive information; the management metadata and the metadata identifier are stored in a database in correspondence.

[0132] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining a permission table for obtaining sensitive information; querying whether there is a user identifier in the permission table to obtain a query result; if the query result indicates that there is a user identifier in the permission table, it is determined that the request initiator has permission to obtain sensitive information; if the query result indicates that there is no user identifier in the permission table, it is determined that the request initiator does not have permission to obtain sensitive information.

[0133] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when it is determined based on the user identification that the request initiator does not have the permission to obtain sensitive information, the target non-sensitive information is used as the target metadata.

[0134] In one embodiment, when the processor executes the computer program, the following steps are also implemented: generating a sensitive information acquisition request based on the metadata identifier, and sending the sensitive information acquisition request to the sensitive information storage server to instruct the sensitive information storage server to parse the sensitive information acquisition request, obtain the metadata identifier, and query the corresponding encrypted sensitive information based on the metadata identifier; receiving the encrypted sensitive information returned by the sensitive information storage server, decrypting the encrypted sensitive information, and obtaining the target sensitive information.

[0135] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: receiving a metadata processing request sent by a request initiator, the metadata processing request including a metadata identifier and a user identifier corresponding to the request initiator; based on the metadata identifier, obtaining corresponding target non-sensitive information from a database for storing non-sensitive information; in a case where it is determined based on the user identifier that the request initiator has permission to obtain sensitive information, obtaining corresponding target sensitive information from a sensitive information storage server based on the metadata identifier; combining the target non-sensitive information and the target sensitive information to obtain target metadata, the target metadata being used to perform a data processing operation corresponding to the metadata processing request.

[0136] In one embodiment, the metadata processing request also includes a data processing type, and when the computer program is executed by the processor, the following steps are also implemented: determining whether the data processing type is a metadata usage type, and if the data processing type is a metadata usage type, returning a step based on the metadata identifier to continue execution of obtaining the corresponding target non-sensitive information from a database for storing non-sensitive information.

[0137] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the data processing type is the metadata management type, management metadata for metadata management is determined, and the management metadata does not contain sensitive information; the management metadata and the metadata identifier are stored in a database in correspondence.

[0138] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining a permission table for obtaining sensitive information; querying whether there is a user identifier in the permission table to obtain a query result; if the query result indicates that there is a user identifier in the permission table, determining that the request initiator has permission to obtain sensitive information; if the query result indicates that there is no user identifier in the permission table, determining that the request initiator does not have permission to obtain sensitive information.

[0139] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when it is determined based on the user identification that the request initiator does not have the authority to obtain sensitive information, the target non-sensitive information is used as the target metadata.

[0140] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: generating a sensitive information acquisition request based on the metadata identifier, and sending the sensitive information acquisition request to the sensitive information storage server to instruct the sensitive information storage server to parse the sensitive information acquisition request, obtain the metadata identifier, and query the corresponding encrypted sensitive information based on the metadata identifier; receiving the encrypted sensitive information returned by the sensitive information storage server, decrypting the encrypted sensitive information, and obtaining the target sensitive information.

[0141] In one embodiment, a computer program product is provided, including a computer program, which implements the following steps when executed by a processor: receiving a metadata processing request sent by a request initiator, the metadata processing request including a metadata identifier and a user identifier corresponding to the request initiator; based on the metadata identifier, obtaining corresponding target non-sensitive information from a database for storing non-sensitive information; in a case where it is determined based on the user identifier that the request initiator has permission to obtain sensitive information, obtaining corresponding target sensitive information from a sensitive information storage server based on the metadata identifier; combining the target non-sensitive information and the target sensitive information to obtain target metadata, the target metadata being used to perform a data processing operation corresponding to the metadata processing request.

[0142] In one embodiment, the metadata processing request also includes a data processing type, and when the computer program is executed by the processor, the following steps are also implemented: determining whether the data processing type is a metadata usage type, and if the data processing type is a metadata usage type, returning a step based on the metadata identifier to continue execution of obtaining the corresponding target non-sensitive information from a database for storing non-sensitive information.

[0143] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the data processing type is the metadata management type, management metadata for metadata management is determined, and the management metadata does not contain sensitive information; the management metadata and the metadata identifier are stored in a database in correspondence.

[0144] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining a permission table for obtaining sensitive information; querying whether there is a user identifier in the permission table to obtain a query result; if the query result indicates that there is a user identifier in the permission table, determining that the request initiator has permission to obtain sensitive information; if the query result indicates that there is no user identifier in the permission table, determining that the request initiator does not have permission to obtain sensitive information.

[0145] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when it is determined based on the user identification that the request initiator does not have the authority to obtain sensitive information, the target non-sensitive information is used as the target metadata.

[0146] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: generating a sensitive information acquisition request based on the metadata identifier, and sending the sensitive information acquisition request to the sensitive information storage server to instruct the sensitive information storage server to parse the sensitive information acquisition request, obtain the metadata identifier, and query the corresponding encrypted sensitive information based on the metadata identifier; receiving the encrypted sensitive information returned by the sensitive information storage server, decrypting the encrypted sensitive information, and obtaining the target sensitive information.

[0147] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0148] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0149] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0150] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A metadata processing method, characterized in that: The method comprises: Receiving a metadata processing request sent by a request initiator, wherein the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator; Based on the metadata identifier, obtaining corresponding target non-sensitive information from a database for storing non-sensitive information; In a case where it is determined based on the user identifier that the request initiator has the sensitive information acquisition permission, acquiring corresponding target sensitive information from a sensitive information storage server based on the metadata identifier; The target non-sensitive information and the target sensitive information are combined to obtain target metadata, where the target metadata is used to perform a data processing operation corresponding to the metadata processing request.

2. The method according to claim 1, characterized in that The metadata processing request also includes a data processing type, and the method further includes: Determine whether the data processing type is a metadata usage type. If the data processing type is a metadata usage type, return to the step of obtaining the corresponding target non-sensitive information from a database for storing non-sensitive information based on the metadata identifier and continue to execute.

3. The method according to claim 2, characterized in that The method further comprises: In the case where the data processing type is a metadata management type, determining management metadata for performing metadata management, wherein the management metadata does not contain sensitive information; The management metadata and the metadata identifier are stored in a database in correspondence.

4. The method according to claim 1, characterized in that: The method further comprises: Get the permission table for sensitive information access; Check whether the user ID exists in the permission table and obtain the query result; If the query result indicates that the user identifier exists in the permission table, it is determined that the request initiator has permission to obtain sensitive information; If the query result indicates that the user identifier does not exist in the permission table, it is determined that the request initiator does not have the permission to obtain sensitive information.

5. The method according to claim 1, characterized in that The method further comprises: When it is determined based on the user identifier that the request initiator does not have permission to obtain sensitive information, the target non-sensitive information is used as target metadata.

6. The method according to claim 1, characterized in that The acquiring corresponding target sensitive information from the sensitive information storage server based on the metadata identifier includes: Generate a sensitive information acquisition request based on the metadata identifier, and send the sensitive information acquisition request to a sensitive information storage server to instruct the sensitive information storage server to parse the sensitive information acquisition request, obtain the metadata identifier, and query the corresponding encrypted sensitive information based on the metadata identifier; The encrypted sensitive information returned by the sensitive information storage server is received, and the encrypted sensitive information is decrypted to obtain target sensitive information.

7. A metadata processing device, characterized in that: The device comprises: A request receiving module, used to receive a metadata processing request sent by a request initiator, wherein the metadata processing request includes a metadata identifier and a user identifier corresponding to the request initiator; A first information acquisition module, configured to acquire corresponding target non-sensitive information from a database for storing non-sensitive information based on the metadata identifier; A second information acquisition module is used to acquire the corresponding target sensitive information from the sensitive information storage server based on the metadata identifier when it is determined based on the user identifier that the request initiator has the sensitive information acquisition authority; The metadata acquisition module is used to combine the target non-sensitive information and the target sensitive information to obtain target metadata, and the target metadata is used to perform a data processing operation corresponding to the metadata processing request.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images