Data authority management method and device, computer equipment and storage medium

Abstract

The invention belongs to the field of information security, is applied to the field of financial science and technology, and relates to a data authority management method which comprises the steps that a data operation instruction sent by terminal equipment is received, a corresponding data operation request is configured according to the data operation instruction, and the data operation request comprises a user identifier and an original SQL statement; searching in a preset user table according to the user identifier to obtain a target role corresponding to the user identifier; searching a target role in a preset role permission table, and obtaining a permission data value corresponding to the target role; binding the permission data value as a parameter value to the original SQL statement to obtain a target SQL statement; and executing the target SQL statement to obtain corresponding operation result data. According to the invention, the data authority management efficiency and the data security can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data authority management method, apparatus, computer equipment and storage medium. Background Art

[0002] With the rapid development of Internet information technology, information systems are widely used in enterprises, and the data that can be queried or obtained by staff in different positions for the same type of data is also different. Especially for financial enterprises with high security requirements such as banks, or insurance companies, in order to achieve data operation authority control for staff in different positions, the data operation scope of staff is usually controlled through roles and data authority management corresponding to roles.

[0003] Traditional permission management controls the scope of data permissions that each role can see through hard coding. Each time a new role is added, the underlying code needs to be modified, resulting in a large amount of manpower investment in development and testing. There is a certain delay in the response speed to business needs, and the permission management efficiency is low. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a data permission management method, apparatus, computer equipment and storage medium, the main purpose of which is to improve the efficiency of data permission management.

[0005] In order to solve the above technical problems, the present application embodiment provides a data rights management method, which adopts the following technical solutions:

[0006] Receiving a data operation instruction sent by a terminal device, and configuring a corresponding data operation request according to the data operation instruction, wherein the data operation request includes a user identifier and an original SQL statement;

[0007] Searching in a preset user table according to the user identifier to obtain a target role corresponding to the user identifier;

[0008] Searching for the target role in a preset role permission table to obtain the permission data value corresponding to the target role;

[0009] Binding the permission data value as a parameter value to the original SQL statement to obtain a target SQL statement;

[0010] Execute the target SQL statement to obtain corresponding operation result data.

[0011] Furthermore, the step of binding the permission data value as a parameter value to the original SQL statement to obtain a target SQL statement specifically includes:

[0012] Precompiling the original SQL statement and obtaining a precompiling result, wherein the original SQL statement is an SQL statement supporting parameterized operation;

[0013] If the pre-compilation result is successful, obtaining the initial parameterized operation object generated during the pre-compilation process;

[0014] Based on the initial parameterized operation object, the permission data value is bound as a parameter value to a placeholder position in the original SQL statement to obtain a target parameterized operation object and an execution function corresponding to the target parameterized operation object;

[0015] The execution function is determined as a target SQL statement.

[0016] Further, based on the initial parameterized operation object, the permission data value is bound as a parameter value to a placeholder position in the original SQL statement to obtain a target parameterized operation object and an execution function corresponding to the target parameterized operation object, comprising:

[0017] Obtaining a keyword in the initial parameterized operation object, and determining a parameterized operation type of the initial parameterized operation object;

[0018] Determine the corresponding execution function category according to the parameterized operation type;

[0019] According to the execution function category, the permission data value is bound as a parameter to the placeholder position in the original SQL statement, and a target parameterized operation object and an execution function corresponding to the target parameterized operation object are configured.

[0020] Furthermore, after executing the target SQL statement and obtaining the corresponding operation result data, the following steps are also included:

[0021] Acquire the operation mode of the data operation instruction;

[0022] According to the operation mode and the operation result data, a visual operation result page is configured;

[0023] Feedback the visualization operation result page to the terminal device.

[0024] Furthermore, after the step of obtaining the corresponding operation result data of the target SQL statement, the following steps are further included:

[0025] Acquire the operation mode of the data operation instruction;

[0026] According to the operation mode and the operation result data, a visual operation result page is configured;

[0027] Feedback the visualization operation result page to the terminal device.

[0028] Further, the step of receiving a data operation instruction sent by a terminal device and configuring a corresponding data operation request according to the data operation instruction includes:

[0029] Receive data operation instructions sent by the terminal device and obtain target data;

[0030] Determining whether the target data involves management authority;

[0031] If the target data involves management authority, a corresponding data operation request is configured according to the operation instruction;

[0032] If the target data does not involve management authority, the data operation instruction is executed.

[0033] Furthermore, before the step of searching the target role in the preset role permission table and obtaining the permission data value corresponding to the target role, the method further includes:

[0034] A role configuration request is received, and a role permission table is configured according to the role information in the configuration request, wherein the role permission table stores multiple roles and permission data values ​​corresponding to each role, wherein the permission data values ​​are used to limit the permission operation scope of the role.

[0035] Further, receiving a role configuration request, and configuring a role permission table according to the role information in the configuration request includes:

[0036] Receive a role configuration request, and obtain role information and configuration type in the configuration request;

[0037] If the configuration type is new, adding the role and the corresponding permission data value in the role permission table according to the role information;

[0038] If the configuration type is change, updating the role permission table according to the role information;

[0039] If the configuration type is deletion, the corresponding role and permission data value in the role permission table are deleted according to the role information.

[0040] In order to solve the above technical problems, the embodiment of the present application further provides a data rights management device, which adopts the following technical solution:

[0041] A configuration module, configured to receive a data operation instruction sent by a terminal device, and configure a corresponding data operation request according to the data operation instruction, wherein the data operation request includes a user identifier and an original SQL statement;

[0042] An identification module, used to search in a preset user table according to the user identifier to obtain a target role corresponding to the user identifier;

[0043] A search module is used to search for the target role in a preset role permission table and obtain the permission data value corresponding to the target role;

[0044] A processing module, used for binding the permission data value as a parameter value to the original SQL statement to obtain a target SQL statement;

[0045] The execution module is used to execute the target SQL statement to obtain corresponding operation result data.

[0046] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0047] The computer device includes a memory and a processor, the memory stores computer-readable instructions, and the processor implements the steps of the above-mentioned data authority management method when executing the computer-readable instructions.

[0048] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0049] The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the above-mentioned data authority management method are implemented.

[0050] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0051] This application receives data operation instructions sent by a terminal device, configures a data operation request containing a parameterizable operation SQL statement, and converts the data operation into a parameterizable operation mode, thereby improving the configurability and flexibility of data operation. Furthermore, the corresponding target role can be found according to the user identifier, the permission data value corresponding to the target role can be determined, and then the permission data value can be bound to the original SQL statement as a parameter value to obtain the target SQL statement. When executing the target SQL statement, data can be automatically filtered according to the permission defined by the permission data value, and only data that meets the permission range of the target role can be operated, thereby ensuring data security. This application controls data permissions through role correspondence, realizes functional modularization and configuration, reduces repeated development, can achieve the results of reducing costs and increasing efficiency, reduces the manpower cost of development and testing, improves the timeliness of demand response, and improves the efficiency of data permission management. In addition, the use of parameterizable operation SQL statements to perform data operations improves the response speed of data operations while ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0053] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0054] Figure 2 A flowchart according to an embodiment of the data rights management method of the present application;

[0055] Figure 3 yes Figure 2 A flowchart of a specific implementation of step S204;

[0056] Figure 4 yes Figure 2 A flowchart of a specific implementation of step S201;

[0057] Figure 5 is a flow chart of another embodiment of the data rights management method according to the present application;

[0058] Figure 6 is a structural diagram of an embodiment of a data rights management device according to the present application;

[0059] Figure 7 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0061] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0062] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0063] like Figure 1 As shown, the system architecture 100 may be a banking system, an insurance system, etc., and includes a terminal device 101, a network 102, and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012, or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links, or optical fiber cables.

[0064] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0065] The terminal device 101 can be any electronic device with a display screen and supporting web browsing. In addition to a laptop computer 1011, a tablet computer 1012 or a mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, etc.

[0066] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0067] It should be noted that the data authority management method provided in the embodiment of the present application is generally executed by a server, and accordingly, the data authority management device is generally set in the server.

[0068] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0069] Continue to refer Figure 2 , shows a flow chart of an embodiment of a method for data authority management according to the present application. The data authority management method comprises the following steps:

[0070] Step S201, receiving a data operation instruction sent by a terminal device, and configuring a corresponding data operation request according to the data operation instruction, wherein the data operation request includes a user identifier and an original SQL statement.

[0071] In this embodiment, the data authority management method is executed on the electronic device (eg Figure 1 The server shown in the figure) can be connected via a wired connection or a wireless connection, receive a data operation instruction sent by the terminal device, and configure a corresponding data operation request according to the data operation instruction, wherein the data operation request includes a user identifier and an original SQL statement to be executed. It should be noted that the above-mentioned wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0072] Specifically, the user performs operations such as button operations or menu item selections in the user interface provided by the terminal device, for example, including but not limited to viewing data, deleting data, modifying data, adding data, etc. The terminal device generates corresponding data operation instructions according to information such as the target data operated by the user, and sends the data operation instructions to the server.

[0073] The server receives the data operation instruction sent by the terminal device and determines the user ID, target data, operation mode and other information. Then, the server generates a corresponding data operation request according to the data operation instruction of the user ID, target data and other information, and the data operation request includes the user ID and the original SQL statement.

[0074] In some optional implementations, step S201 includes:

[0075] Receive data operation instructions sent by the terminal device and obtain target data;

[0076] Determining whether the target data involves management authority;

[0077] If the target data involves management authority, a corresponding data operation request is configured according to the operation instruction;

[0078] If the target data does not involve management authority, the data operation instruction is executed.

[0079] The server receives the data operation instruction sent by the terminal device, parses the data operation instruction to obtain the target data to be operated. Then, the server determines whether the target data is in the sensitive list according to the preset sensitive list. If the target data is in the sensitive list, it is determined that the target involves management authority; if the target data is not in the sensitive list, it is determined that the target data does not involve management authority.

[0080] If the target data involves management authority, the corresponding data operation request is configured according to the operation instruction, so that only data operations within the scope of the current user's authority are performed.

[0081] If the target data does not involve management authority, the data operation instruction is directly executed to add, modify and / or delete operations based on the target data.

[0082] Therefore, the present application can quickly respond to data operation instructions that do not involve management authority by making a confidential authority management judgment on the target data to be operated, and only further configure management authority for data operation instructions that involve management authority, thereby improving the response speed of data operations, reducing the occupation of processing resources, and improving the timeliness of data operations.

[0083] Step S202: searching in a preset user table according to the user identifier to obtain a target role corresponding to the user identifier.

[0084] In this embodiment, the preset user table includes multiple user identifiers and roles corresponding to the user identifiers. The server searches the user table for the current user identifier by looking up the table.

[0085] As an implementation manner, before step S202, the electronic device may further perform the following steps:

[0086] A user configuration request is received, and a user table is configured according to user information in the user configuration request, wherein the user table stores a plurality of user identifiers and a role corresponding to each user identifier.

[0087] Specifically, the user can perform user configuration operations through the user configuration page provided by the terminal device, such as adding a new user, deleting a user, modifying a user, etc. The user terminal generates a corresponding user configuration request according to the user configuration operation and sends it to the server. The user configuration request includes the user information to be operated and the operation type. The user information to be operated may include the user ID to be operated and the corresponding role information; the operation type includes deletion, addition and / or modification, etc.

[0088] The server may receive a user configuration request sent by a terminal device, etc., and parse the user configuration request to obtain the user information to be operated and the operation type. Then, according to the user information to be operated and the operation type, the user table is configured, for example, the role corresponding to the user ID is modified, the role corresponding to the user ID is deleted, the role corresponding to the user ID is changed, etc. according to the user information to be operated.

[0089] This enables free and flexible configuration of user IDs and corresponding roles, facilitating user authority management.

[0090] Step S203: searching the target role in a preset role permission table to obtain the permission data value corresponding to the target role.

[0091] In this embodiment, the preset role permission table includes each role and the corresponding permission data value. The permission data values ​​corresponding to different roles may be different, or partially the same, or completely the same.

[0092] The server searches for the target role in the role permission table, and then obtains the permission data value corresponding to the target role.

[0093] As an implementation manner, before step S203, the electronic device may further perform the following steps:

[0094] A role configuration request is received, and a role permission table is configured according to the role information in the configuration request, wherein the role permission table stores multiple roles and permission data values ​​corresponding to each role, wherein the permission data values ​​are used to limit the permission operation scope of the role.

[0095] Specifically, the role permission table stores multiple roles and the permission data values ​​corresponding to each role, thereby limiting the corresponding data permission range for each different user role. It should be noted that the permission data value can be a field value that the role has permission to, which is used to limit the permission operation range of the role.

[0096] For example, in financial and banking scenarios, the role permission table records the teller role, manager role, and administrator role. The permission field value corresponding to the teller role is the field value of the data that the teller role has the permission to operate, such as deposit account name data, deposit balance data, etc.; the permission field value corresponding to the manager role may include deposit account name data, deposit balance data, account financial management data, etc.; the permission field value corresponding to the administrator role may include deposit account name data, deposit balance data, account financial management data, etc.

[0097] The server receives the role configuration request and parses it to obtain the role information. The role information may include the role and the permission data value corresponding to the role. Then, the server configures the role permission table according to the role to be configured in the role information and the permission data value corresponding to the role to be configured.

[0098] As a result, users or administrators can freely allocate and flexibly change the data operation permissions corresponding to each role as needed. The operation is convenient and can effectively prevent users from accessing data beyond their authority, thus ensuring data security.

[0099] As an implementation manner, the step of receiving a role configuration request and configuring a role permission table according to role information in the configuration request includes:

[0100] Receive a role configuration request, and obtain role information and configuration type in the configuration request;

[0101] If the configuration type is new, adding the role and the corresponding permission data value in the role permission table according to the role information;

[0102] If the configuration type is change, updating the role permission table according to the role information;

[0103] If the configuration type is deletion, the corresponding role and permission data value in the role permission table are deleted according to the role information.

[0104] Specifically, the user can perform role configuration operations through the role configuration page provided by the terminal device, such as adding a new role, deleting a role, modifying a role, etc. The user terminal generates a corresponding role configuration request according to the user configuration operation and sends it to the server. The role configuration request includes the role information configured by the user and the configuration type. The role information may include the role to be configured and the permission data value corresponding to the role to be configured; the configuration type includes deletion, addition and / or modification, etc.

[0105] The server may receive a role configuration request sent by a terminal device, etc., parse the role configuration request to obtain role information and configuration type, and then configure the role permission table according to the role information and configuration type.

[0106] Specifically, if the configuration type is new addition, then according to the role information, the role to be configured and the permission data value corresponding to the role to be configured are added to the role permission table to complete the addition of the role and the corresponding permission data value.

[0107] If the configuration type is change, then according to the role information, the permission data value corresponding to the role to be configured recorded in the role permission table is modified to the permission data value corresponding to the role to be configured in the user information, thereby realizing the change of the role permission data value.

[0108] If the configuration type is deletion, the role to be configured and its corresponding permission data value recorded in the role permission table are deleted according to the role information to achieve the deletion of the role.

[0109] As a result, the free and flexible configuration of roles and corresponding data permission ranges is achieved, which is convenient for users to manage and change permissions. Compared with the hard coding in the prior art, this application can achieve flexible management of data permission ranges without changing the underlying coding, reducing labor costs. Compared with the hard coding control in the prior art, this application provides a configurable function with flexible design. Operations such as introducing new roles can complete the data permission control of new roles through configuration without investing development and testing manpower.

[0110] Step S204: Bind the permission data value as a parameter value to the original SQL statement to obtain a target SQL statement.

[0111] In this embodiment, the original SQL statement can support parameterized operations. Specifically, placeholders are used in the original SQL statement to indicate parameter positions. For example, placeholders can be identified by "?". The server binds the permission data value as a parameter corresponding to the parameter position indicated by the placeholder to the original SQL statement. The format of binding the permission data value to the parameter value in the original SQL statement can be: (placeholder count, corresponding data permission value), where the placeholder count is the count of the placeholder in the order from the start character to the end character of the SQL statement.

[0112] For example, the number of placeholders in the original SQL statement may be only one, indicating that there is only one parameter, and the binding format for binding the permission data value corresponding to the placeholder as the parameter value of the original SQL statement may be: (1, data permission value). Of course, the number of placeholders in the original SQL statement may also be multiple, indicating that there may be multiple data permission values, and the binding format for binding multiple permission data values ​​corresponding to the placeholder as the parameter value of the original SQL statement may be: (1, data permission value; 2, data permission value...).

[0113] As an implementation method, refer to Figure 3 , step 204 comprises the following steps:

[0114] Step S2041, precompile the original SQL statement and obtain a precompile result, wherein the original SQL statement is a SQL statement that supports parameterized operations.

[0115] In this embodiment, the original SQL statement may be an SQL statement that supports parameterized operations, and placeholders are used in the original SQL statement to indicate parameter positions.

[0116] Specifically, the pre-compilation process includes parsing the original SQL statement and generating an execution plan, which is stored in the database, but does not perform actual data operations. It can be used directly in subsequent executions. In the process of pre-compiling the original SQL statement, a parameterized operation object is created based on the original SQL statement. The parameterized operation object can be a PreparedStatment object, etc.

[0117] The precompile result can be success or failure, indicating whether the original SQL statement is valid. For example, if there is a syntax error when precompiling the original SQL statement, the precompile result will appear immediately, and an exception will be thrown, returning error information to notify that the original SQL statement is invalid. Specifically, when calling the prepareStatement object, a SQLException will be thrown, and you can handle syntax errors by catching this exception.

[0118] Step S2042: If the pre-compilation result is successful, then obtaining the initial parameterized operation object generated during the pre-compilation process.

[0119] If the precompilation result is successful, it means that the original SQL statement is valid, and the initial parameterized operation object created in the precompilation is obtained. For example, the initial parameterized operation object can be an initial PreparedStatment object, which not only contains the received original SQL statement, but also contains the execution plan and placeholders of the original SQL statement for subsequent binding parameters and execution.

[0120] Step S2043: Based on the initial parameterized operation object, the permission data value is bound as a parameter value to a placeholder position in the original SQL statement to obtain a target parameterized operation object and an execution function corresponding to the target parameterized operation object.

[0121] Specifically, by calling the parameter assignment function, parameters can be added to the initial parameterized operation object, and the permission data value can be bound as the parameter value to the placeholder position in the original SQL statement to obtain a target parameterized operation object with complete parameters and an execution function corresponding to the target parameterized operation object.

[0122] For example, multiple setxxx functions can be used to bind parameters for the initial PreparedStatment object, such as setxxx(parameter position, corresponding permission data value), where the parameter position is the count of the original SQL statement placeholders in the initial PreparedStatment object, such as the first placeholder, whose parameter position is 1, the second placeholder, whose parameter position is 2, and so on. The corresponding permission data values ​​are bound to the parameter positions to obtain the complete target PreparedStatment object and its corresponding execution function.

[0123] As an implementation manner, step S2043 includes the following steps:

[0124] Obtaining a keyword in the initial parameterized operation object, and determining a parameterized operation type of the initial parameterized operation object;

[0125] Determine the corresponding execution function category according to the parameterized operation type;

[0126] According to the execution function category, the permission data value is bound as a parameter to the placeholder position in the original SQL statement, and a target parameterized operation object and an execution function corresponding to the target parameterized operation object are configured.

[0127] Specifically, the server can determine the parameterized operation type in the initial parameterized operation object based on the keywords of the original SQL statement in the initial parameterized operation object. For example, the keyword SELECT in the original SQL statement is a query operation, the keyword INSERT is an insert operation, the keyword UPDATE is an update operation, the keyword DELETE is a delete operation, etc.

[0128] When the parameterized operation type is a query operation, the corresponding execution function category is determined to be the executeQuery() function of the initial PreparedStatment object, and then based on the executeQuery() function, the permission data value is bound as a parameter value to the placeholder position of the original SQL statement to obtain the target parameterized operation object and its corresponding execution function; when the parameterized operation type is an insert operation, an update operation, and a delete operation, the corresponding execution function category is determined to be the executeUpdate() function of the initial PreparedStatment object, and then based on the executeUpdate() function, the permission data value is bound as a parameter value to the placeholder position of the original SQL statement to obtain the target parameterized operation object and its corresponding execution function.

[0129] This application implements the execution of target SQL statements of various operation types by configuring the corresponding execution function according to the parameterized operation type, and realizes the permission management of a wider range of data operation types while ensuring data security.

[0130] Step S2044: determine the execution function as a target SQL statement.

[0131] Therefore, the present application creates an initial parameterized operation object by precompiling the original SQL statement, and obtains a target parameterized operation object with complete parameters and its corresponding execution function by binding the permission data value as the parameter value to the placeholder position in the original SQL statement. The execution function is used as the target SQL statement, and the target SQL statement contains data value permission restrictions, so that the user can only perform data operations within the permissions of his or her role. This method binds to the placeholder in a secure way, prevents SQL injection attacks, and improves the security and efficiency of SQL operations.

[0132] Step S205, executing the target SQL statement to obtain corresponding operation result data.

[0133] In this embodiment, the parameterized operations supported by the target SQL statement may be query operations, insert operations, update operations, and delete operations.

[0134] The operation result data obtained by executing the target SQL statement is the operation data filtered according to the permission data value. Taking the parameterized operation as the query operation as an example, this solution combines the role's permissions with the query conditions in the form of permission data values, and can process permission filtering and condition filtering at the same time in one query, improving query efficiency and ensuring that the user role can only operate the data for which it has permission.

[0135] As an implementation mode, the step of executing the target SQL statement to obtain corresponding operation result data specifically includes:

[0136] The target parameterized operation object is called, and the execution function corresponding to the target parameterized operation object is executed to obtain the operation result data.

[0137] In this embodiment, the parameterized operation type corresponding to the execution function may be a query operation, an insert operation, an update operation, a delete operation, and the like.

[0138] Specifically, the server calls the parameterized operation object and executes its execution function, which may correspond to a query operation, an insert operation, an update operation, a delete operation, etc., thereby implementing the execution of the target SQL statement and obtaining the operation result data.

[0139] This application implements the execution of target SQL statements of various operation types by configuring the corresponding execution function according to the parameterized operation type, and realizes the permission management of a wider range of data operation types while ensuring data security.

[0140] This application receives data operation instructions sent by a terminal device, configures a data operation request containing a parameterizable operation SQL statement, and converts the data operation into a parameterizable operation mode, thereby improving the configurability and flexibility of data operation. Furthermore, the corresponding target role can be found according to the user identifier, the permission data value corresponding to the target role can be determined, and then the permission data value can be bound to the original SQL statement as a parameter value to obtain the target SQL statement. When executing the target SQL statement, data can be automatically filtered according to the permission defined by the permission data value, and only data that meets the permission range of the target role can be operated, thereby ensuring data security. This application controls data permissions through role correspondence, realizes functional modularization and configuration, reduces repeated development, can achieve the results of reducing costs and increasing efficiency, reduces the labor cost of development and testing, improves the timeliness of demand response, and improves the efficiency of data permission management. In addition, the use of parameterizable operation SQL statements to perform data operations improves the response speed of data operations while ensuring data security.

[0141] In some optional implementations of this embodiment, refer to Figure 4 , step 201 comprises:

[0142] Step S2011, receiving a user login request, and verifying the user login request.

[0143] Specifically, when the server receives the login request fed back by the user terminal, it obtains information such as the user ID, password and / or key in the login request and verifies the user login request.

[0144] Step S2012: If the login request passes the verification, a user identification is obtained according to the user login request.

[0145] If the user login request passes the verification, the server determines the corresponding user identification according to the user login information. Specifically, the user identification may be the user ID used by the user to log in.

[0146] Step S2013, receiving a data operation instruction, and generating a data operation request including a user identifier and an original SQL statement according to the user identification and the data operation instruction, wherein the original SQL statement supports parameterized operations.

[0147] The user can perform data operations through the user page provided by the terminal device. The terminal device generates a corresponding data operation instruction and sends it to the server. The server receives the data operation instruction sent by the terminal device and determines information such as user identification, target data, and operation mode. Then, the server generates a corresponding data operation request based on the data operation instruction of information such as user identification and target data. The data operation request includes the user identification and the original SQL statement to be executed.

[0148] Among them, the original SQL statement supports parameterized operations. Specifically, the original SQL statement consists of an SQL statement and one or more placeholders. The placeholder indicates the position of the parameter, and the number of placeholders represents the number of parameters. Parameterized operations can support pre-compiled SQL statements and support binding parameter values.

[0149] Therefore, this application can prevent SQL injection attacks, improve security, and improve performance.

[0150] In some optional implementations, after step S205, the electronic device further performs the following steps:

[0151] Step 206, obtaining the operation mode of the data operation instruction.

[0152] Specifically, the server operates according to the data operation instructions sent by the terminal device, and the operation mode includes adding, deleting, changing, etc.

[0153] Step 207: configuring a visualized operation result page according to the operation mode and the operation result data.

[0154] Specifically, the types of operation result pages may be different or the same depending on the operation mode.

[0155] For example, when the operation type is add, the server can configure, based on the operation result data, a visual operation result page that only includes the operation result data, or a visual operation result page that includes all operable data within the current user's authority. Of course, it can also be a visual operation result page that includes the operation result data and response prompt information, and the prompt information may be "Added successfully" etc.

[0156] When the operation type is change, the server can configure, based on the operation result data, a visual operation result page that only includes the operation result data, or a visual operation result page that includes all operable data within the current user's authority. Of course, it can also be a visual operation result page that includes the operation result data and response prompt information, and the prompt information may be "Change successful" and the like.

[0157] When the operation type is deletion, the server can provide a visual operation result page based on the operation result data, including all operable data within the current user's authority. Of course, it can also be a visual operation result page including the operation result data and response prompt information, and the prompt information may be "deletion successful" etc.

[0158] Step 208: Feedback the visualization operation result page to the terminal device.

[0159] Specifically, the server feeds back the visualized operation result page to the terminal device, so that the user can intuitively confirm the operation result through the terminal device, thereby improving the user experience.

[0160] This application configures the corresponding visual operation result page in combination with the data operation method and feeds back to the terminal device, so that the user can obtain the response results of the data operation in time, facilitate the next operation, etc., and achieve a clearer result display.

[0161] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0162] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0163] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0164] Further references Figure 6 , as a response to the above Figure 2 The present application provides an embodiment of a data rights management device, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0165] like Figure 6As shown, the data authority management device 300 described in this embodiment includes: a configuration module 301, an identification module 302, a search module 303, a processing module 304 and an execution module 305. Among them:

[0166] Configuration module 301, used for receiving a data operation instruction sent by a terminal device, and configuring a corresponding data operation request according to the data operation instruction, wherein the data operation request includes a user identifier and an original SQL statement;

[0167] An identification module 302 is used to search in a preset user table according to the user identifier to obtain a target role corresponding to the user identifier;

[0168] A search module 303 is used to search for the target role in a preset role permission table and obtain the permission data value corresponding to the target role;

[0169] The processing module 304 is used to bind the permission data value as a parameter value to the original SQL statement to obtain a target SQL statement;

[0170] The execution module 305 is used to execute the target SQL statement to obtain corresponding operation result data.

[0171] The specific implementation of the data authority management device 300 of the present application is the same as that of the above embodiment and will not be repeated here.

[0172] To solve the above technical problems, the present application also provides a computer device. Figure 7 , Figure 7 This is a basic structural block diagram of the computer device in this embodiment.

[0173] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components 41-43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0174] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0175] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or D intelligent crop growth prediction memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of the crop monitoring method, etc. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0176] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run computer-readable instructions stored in the memory 41 or process data, such as computer-readable instructions for running the crop monitoring method.

[0177] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0178] The specific implementation of the computer device of the present application is the same as that of the above embodiment and will not be repeated here.

[0179] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the data permission management method as described above.

[0180] The specific implementation of the computer-readable storage medium of the present application is the same as the above embodiment and will not be repeated here.

[0181] The non-Company software tools or components appearing in the embodiments of this application are merely examples and do not represent actual use.

[0182] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0183] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A data rights management method, characterized in that: The steps include: Receiving a data operation instruction sent by a terminal device, and configuring a corresponding data operation request according to the data operation instruction, wherein the data operation request includes a user identifier and an original SQL statement; Searching in a preset user table according to the user identifier to obtain a target role corresponding to the user identifier; Searching for the target role in a preset role permission table to obtain the permission data value corresponding to the target role; Binding the permission data value as a parameter value to the original SQL statement to obtain a target SQL statement; Execute the target SQL statement to obtain corresponding operation result data.

2. The data rights management method according to claim 1, characterized in that: The step of binding the permission data value as a parameter value to the original SQL statement to obtain a target SQL statement specifically includes: Precompiling the original SQL statement and obtaining a precompiling result, wherein the original SQL statement is an SQL statement supporting parameterized operation; If the pre-compilation result is successful, obtaining the initial parameterized operation object generated during the pre-compilation process; Based on the initial parameterized operation object, the permission data value is bound as a parameter value to a placeholder position in the original SQL statement to obtain a target parameterized operation object and an execution function corresponding to the target parameterized operation object; The execution function is determined as a target SQL statement.

3. The data rights management method according to claim 2, characterized in that: The step of binding the permission data value as a parameter value to a placeholder position in the original SQL statement based on the initial parameterized operation object to obtain a target parameterized operation object and an execution function corresponding to the target parameterized operation object includes: Obtaining a keyword in the initial parameterized operation object, and determining a parameterized operation type of the initial parameterized operation object; Determine the corresponding execution function category according to the parameterized operation type; According to the execution function category, the permission data value is bound as a parameter to a placeholder position in the original SQL statement, and a target parameterized operation object and an execution function corresponding to the target parameterized operation object are configured.

4. The data rights management method according to claim 1, characterized in that: After the step of executing the target SQL statement and obtaining corresponding operation result data, the method further includes: Acquire the operation mode of the data operation instruction; According to the operation mode and the operation result data, a visual operation result page is configured; Feedback the visualization operation result page to the terminal device.

5. The data rights management method according to claim 1, characterized in that: The step of receiving a data operation instruction sent by a terminal device and configuring a corresponding data operation request according to the data operation instruction comprises: Receive data operation instructions sent by the terminal device and obtain target data; Determining whether the target data involves management authority; If the target data involves management authority, a corresponding data operation request is configured according to the operation instruction; If the target data does not involve management authority, the data operation instruction is executed.

6. The data rights management method according to claim 1, characterized in that: Before the step of searching the target role in the preset role permission table to obtain the permission data value corresponding to the target role, the step further includes: A role configuration request is received, and a role permission table is configured according to the role information in the configuration request, wherein the role permission table stores a plurality of roles and permission data values ​​corresponding to each role, wherein the permission data values ​​are used to limit the permission operation scope of the role.

7. The data rights management method according to claim 6, characterized in that: The step of receiving a role configuration request and configuring a role permission table according to the role information in the configuration request comprises: Receive a role configuration request, and obtain role information and configuration type in the configuration request; If the configuration type is new, adding the role and the corresponding permission data value in the role permission table according to the role information; If the configuration type is change, updating the role permission table according to the role information; If the configuration type is deletion, the corresponding role and permission data value in the role permission table are deleted according to the role information.

8. A data rights management device, characterized in that: include: A configuration module, configured to receive a data operation instruction sent by a terminal device, and configure a corresponding data operation request according to the data operation instruction, wherein the data operation request includes a user identifier and an original SQL statement; An identification module, used to search in a preset user table according to the user identifier to obtain a target role corresponding to the user identifier; A search module is used to search for the target role in a preset role permission table and obtain the permission data value corresponding to the target role; A processing module, used for binding the permission data value as a parameter value to the original SQL statement to obtain a target SQL statement; The execution module is used to execute the target SQL statement and obtain corresponding operation result data.

9. A computer device, characterized in that: It comprises a memory and a processor, wherein the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the data authority management method as claimed in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the data authority management method according to any one of claims 1 to 7 are implemented.

Images