Data resource processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a data resource processing method and device, electronic equipment and a storage medium, the method comprises the following steps: receiving a current resource access request initiated by a current access object to a target database through SaaS service, the target database adopting an independent database system with completely isolated data; in response to the current resource access request, detecting whether a current role associated with the current access object is changed relative to the reference role or not through SaaS service; authenticating the current resource access request of the current access object to the target database based on whether the current role associated with the current access object is changed relative to the reference role; and performing data resource access on the target database through the SaaS service based on the authentication result of the current access object on the current resource access request of the target database. By adopting the scheme, not only can the access object be quickly detected, but also business data isolation can be realized, and unified service and monitoring management on the access object by a platform side are facilitated.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular, to a data resource processing method, device, electronic device, and storage medium. Background Art

[0002] With the rapid development of information technology, Software as a Service (SaaS) has entered a stage of rapid development with its advantages of low cost, fast access, and easy upgrade and maintenance. In SaaS services, data isolation is a key issue. Currently, there are three main ways to isolate data. The first way is to configure an independent database for each tenant. Although this method is extremely secure, it is impossible to effectively optimize and manage tenant data due to complete data isolation. The second and third methods are shared database, independent schema, and shared database and schema, respectively, and distinguished by the tenant id field. Although these solutions have high resource utilization, the degree of isolation of tenant data at the logical or physical level is relatively low. Once a security vulnerability occurs in the database, it is very likely that the data of multiple tenants will be threatened at the same time, resulting in significant deficiencies in the balance of security, cost, and platform supervision capabilities. Summary of the invention

[0003] The present invention provides a data resource processing method, device, electronic device and storage medium, which can not only quickly detect access objects, but also realize business data isolation, which helps the platform side to perform unified service and monitoring management on access objects.

[0004] According to one aspect of the present invention, a data resource processing method is provided, the method comprising:

[0005] Receiving a current resource access request initiated by a current access object to a target database through a SaaS service, wherein the target database adopts an independent database system with completely isolated data;

[0006] In response to the current resource access request, the SaaS service is used to detect whether the current role associated with the current access object has changed relative to the reference role, wherein the current role is the role associated with the current access object read from the current resource access request received, and the reference role is the role that has been authenticated and configured for the current access object before the current access object initiates the current resource access request to the target database, and the role that has been authenticated and configured for the access object has the specified data resource access rights that are authorized to be used when accessing data resources on the database;

[0007] Authenticating a current resource access request of the current access object to the target database based on whether a current role associated with the current access object has changed relative to a reference role;

[0008] Based on the authentication result of the current resource access request of the current access object to the target database, data resource access is performed on the target database through the SaaS service.

[0009] According to one aspect of the present invention, a data resource processing device is provided, the device comprising:

[0010] An access request receiving module, used to receive a current resource access request initiated by a current access object to a target database through a SaaS service, wherein the target database adopts an independent database system with completely isolated data;

[0011] A role detection module is used to detect, in response to the current resource access request, whether the current role associated with the current access object has changed relative to the reference role through the SaaS service, wherein the current role is the role associated with the current access object read from the current resource access request received, and the reference role is the role that has been authenticated and configured for the current access object before the current access object initiates the current resource access request to the target database, and the role that has been authenticated and configured for the access object has the specified data resource access rights that are authorized to be used when accessing data resources on the database;

[0012] An access request authentication module, used to authenticate a current resource access request of a current access object to a target database based on whether a current role associated with the current access object has changed relative to a reference role;

[0013] The data resource access module is used to access the data resources of the target database through the SaaS service based on the authentication result of the current resource access request of the current access object to the target database.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data resource processing method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data resource processing method described in any embodiment of the present invention when executed.

[0019] The technical solution of the embodiment of the present invention is to receive a current resource access request initiated by a current access object to a target database through a SaaS service, and the target database adopts an independent database system with completely isolated data; in response to the current resource access request, detect through the SaaS service whether a current role associated with the current access object has changed relative to a reference role, the current role is a role associated with the current access object read from the received current resource access request, the reference role is a role that completes authentication and configuration association for the current access object before the current access object initiates the current resource access request to the target database, and the role that completes authentication and configuration association for the access object has the designated data resource access rights authorized to use when accessing data resources in the database; based on whether the current role associated with the current access object has changed relative to the reference role, authenticate the current resource access request of the current access object to the target database; and access the data resources of the target database through the SaaS service based on the authentication result of the current resource access request of the current access object to the target database. This solution determines whether the current access object can access the data resource based on the difference between the current role and the reference role associated with the current access object. This solution only relies on the difference in roles to make judgments, and does not need to frequently call complete user permission resources for verification, which reduces the pressure on backend services and databases, and can quickly detect access objects with high response speed. At the same time, the target database used in this solution adopts an independent database system with completely isolated data, which not only retains the independent tenant data of the SaaS system, realizes business data isolation, and effectively prevents data unauthorized access, but also helps the platform side to provide unified services and monitoring management for access objects.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1A flowchart of a data resource processing method provided by an embodiment of the present invention;

[0023] Figure 2 A flowchart of another data resource processing method provided by an embodiment of the present invention;

[0024] Figure 3 A schematic diagram of the structure of a data resource processing device provided by an embodiment of the present invention;

[0025] Figure 4 A schematic diagram of the structure of an electronic device for implementing a data resource processing method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Figure 1 This is a flowchart of a data resource processing method provided by an embodiment of the present invention. This embodiment is applicable to the case where data resources are processed through SaaS services. The method can be executed by a data resource processing device. The data resource processing device can be implemented in the form of hardware and / or software. The data resource processing device can be configured in any electronic device with network communication function. Figure 1 As shown, the data resource processing method of the embodiment of the present invention may include the following process:

[0029] S110. Receive a current resource access request initiated by a current access object to a target database through a SaaS service. The target database adopts an independent database system with completely isolated data.

[0030] Among them, SaaS service is Software as a Service. The current access object is the object that needs to access the target database resources. For example, the current access object can be a user using the SaaS service. The target database uses an independent database system with completely isolated data. For example, the target database can be any one of business database 1, business database 2...business database N. Using an independent database system can not only achieve business data isolation and meet the differentiated needs of different users, but also ensure data security.

[0031] Specifically, when the target object needs to access the resources of the target database, the target object will initiate a resource access request, that is, a current resource access request. The current resource access request initiated by the current access object can be received through the SaaS service.

[0032] S120. In response to the current resource access request, the SaaS service is used to detect whether the current role associated with the current access object has changed relative to the reference role. The current role is the role associated with the current access object read from the current resource access request received. The reference role is the role that has been authenticated and configured for the current access object before the current access object initiates the current resource access request to the target database. The role that has been authenticated and configured for the access object has the specified data resource access rights authorized to use when accessing data resources in the database.

[0033] The access object is associated with role information, and the current role is the role associated with the current access object that is read from the current resource access request received. The reference role is the role that has been authenticated and configured for the current access object before the current access object initiates the current resource access request to the target database. If the access object is authenticated, the associated role will be configured for the access object, and the role will have the specified data resource access rights that are authorized to be used when accessing data resources in the database.

[0034] It should be noted that the current role reflects the role information corresponding to the current access object at the time of this access request. The reference role reflects the role information that has been authenticated and associated with the current access object before this access request. For the same current access object, the two corresponding role information may be consistent or different. Specifically, when responding to the current resource access request, the SaaS service can be used to detect whether the current role associated with the current access object has changed relative to the reference role.

[0035] For example, suppose there are two roles that can access the target database, one is "Manager" and the other is "Employee". These two roles correspond to different database resource access permissions. The "Manager" role can access all data resources in the department, but the "Employee" role can only access data resources related to the department and cannot access all data resources. For the current access object A, suppose the role associated with object A is read as "Manager" from the current resource access request, that is, the current role of object A is "Manager", and the role that object A has authenticated and associated with before this access request may be "Manager" or "Employee" (for example, the role change may be caused by a job change), that is, the current role and the reference role information may be consistent or different.

[0036] S130 . Authenticate the current resource access request of the current access object to the target database based on whether the current role associated with the current access object is changed relative to the reference role.

[0037] Specifically, the authentication result of the current resource access request can be obtained by determining whether the current role and the reference role associated with the current access object are the same to determine whether the two roles have changed. If the current role and the reference role are the same, the current role has not changed relative to the reference role, and the authentication result is passed; if the current role and the reference role are not the same, the current role has changed relative to the reference role, and the authentication result is failed.

[0038] S140: Access data resources of the target database through the SaaS service based on the authentication result of the current resource access request of the current access object to the target database.

[0039] Specifically, if the authentication result is passed, the current access object can access the data resources of the target database through the SaaS service. If the authentication result is not passed, the current access object cannot access the data resources of the target database through the SaaS service.

[0040] The technical solution of the embodiment of the present invention is to receive a current resource access request initiated by a current access object to a target database through a SaaS service, and the target database adopts an independent database system with completely isolated data; in response to the current resource access request, detect through the SaaS service whether a current role associated with the current access object has changed relative to a reference role, the current role is a role associated with the current access object read from the received current resource access request, the reference role is a role that completes authentication and configuration association for the current access object before the current access object initiates the current resource access request to the target database, and the role that completes authentication and configuration association for the access object has the designated data resource access rights authorized to use when accessing data resources in the database; based on whether the current role associated with the current access object has changed relative to the reference role, authenticate the current resource access request of the current access object to the target database; and access the data resources of the target database through the SaaS service based on the authentication result of the current resource access request of the current access object to the target database. This solution determines whether the current access object can access the data resource based on the difference between the current role and the reference role associated with the current access object. This solution only relies on the difference in roles to make judgments, and does not need to frequently call complete user permission resources for verification, which reduces the pressure on backend services and databases, and can quickly detect access objects with high response speed. At the same time, the target database used in this solution adopts an independent database system with completely isolated data, which not only retains the independent tenant data of the SaaS system, realizes business data isolation, and effectively prevents data unauthorized access, but also helps the platform side to provide unified services and monitoring management for access objects.

[0041] Figure 2 This is a flow chart of another data resource processing method provided by an embodiment of the present invention. The technical solution of this embodiment further optimizes the process of detecting whether the current role of the currently accessed object has changed relative to the reference role in the above embodiment on the basis of the technical solution of the above embodiment. The technical features that are the same or similar to those in the above embodiment are not repeated here. This embodiment can be combined with various optional solutions in one or more of the above embodiments. Figure 2 As shown, the data resource processing method of the embodiment of the present invention may include the following process:

[0042] S210: Receive a current resource access request initiated by a current access object to a target database through the SaaS service.

[0043] S220. In response to the current resource access request, the preset access management service is called to detect whether the role version information of the current role of the current access object is identical to the role version information of the reference role, the role version information includes the role identifier and the role authority, and the role authority is used to indicate the data resource access authority that the role to which the role version information belongs is authorized to use when accessing the data resources in the database; wherein the preset access management service is used to integrate and manage access objects corresponding to different databases.

[0044] Among them, the preset access management service is used to integrate and manage the access objects corresponding to different databases. For example, the preset access management service can be a management service that uses the RBAC (Role-Based Access Control) model. RBAC is a general role permission model that can be used to grant permissions and manage permissions to different roles, and can also be used to integrate and manage access objects corresponding to multiple different databases. For example, the management service using the RBAC model can create users and roles, and configure accessible resource permissions for roles; for another example, the management service using the RBAC model can also record user information and corresponding associated role version information. At the same time, there will also be a special RBAC database to record and store this information content.

[0045] The role version information includes the role identification and the role authority, and the role version information may also include at least one of a timestamp, an expiration date information, and a universal unique identifier. The specific data content and structure contained in the role version information can be customized based on actual needs. Among them, the role identification is the identification information of the role, and the role authority is used to indicate the data resource access rights that the role to which the role version information belongs is authorized to use when accessing data resources in the database. When the preset access management service detects whether the role version information of the current role of the current access object is completely the same as the role version information of the reference role, it is necessary to determine whether the role identification and role authority in the two role version information are completely the same. If the role identification and role authority are the same, the role version information of the current role is completely the same as the role version information of the reference role. If there is at least one difference between the role identification and the role authority, the role version information of the current role is not completely the same as the role version information of the reference role.

[0046] As an optional but non-limiting implementation, calling the preset access management service to detect whether the role version information of the current role of the current access object is the same as the role version information of the reference role may include the following steps A1-A2:

[0047] Step A1: Call the preset access management service to record the role version information of the current role and perform 0Red is cache.

[0048] Specifically, when calling the preset access management service for detection, it is necessary to first call the preset access management service to record the role version information of the current role and perform Redis caching. By performing Redis caching on the role version information, the data access speed of the preset access management service during the detection process can be improved, which facilitates the subsequent solution to quickly process and detect the data.

[0049] Step A2: The role version information of the current role of the current access object carried in the current resource access request is transparently transmitted to the preset access management service through the SaaS service, and the preset access management service is called to compare the role version information of the current role with the role version information of the reference role of the current access object to determine whether the role version information of the current role is completely identical to the role version information of the reference role.

[0050] Specifically, the role version information of the current role of the current access object carried in the current resource access request is transparently transmitted to the preset access management service through the SaaS service, and the preset access management service is called for detection. When the preset access management service performs detection, for the current access object, the role version information of the current role obtained will be compared with the role version information of the reference role stored in the corresponding database of the preset access management service to determine whether the role version information of the two roles is completely the same.

[0051] It should be noted that the database corresponding to the preset access management service has stored the role version information associated with different access objects. After determining the current access object, the stored role version information corresponding to the access object can be determined based on the identity information of the current access object, that is, the role version information of the reference role corresponding to the current access object can be determined.

[0052] S230: If the role version information of the current role is not completely identical to the role version information of the reference role, it is determined that the current role of the currently accessed object has changed relative to the reference role.

[0053] Specifically, if at least one of the role identifiers and role permissions of the current role and the reference role are different, the role version information of the current role is considered to be not completely the same as the role version information of the reference role. If the result is not completely the same, it is determined that the current role of the currently accessed object has changed relative to the reference role.

[0054] For example, let's take the above two roles of "Manager" and "Employee" as an example. In addition to the changes between role identities, the permissions corresponding to the role may also change. For example, for the "Manager" role, although the initial permission is to access all data resources in the department, it may also be adjusted with the actual situation. The "Manager" role can only access the key business data in the department, but not the data of other marginal businesses. In other words, the role permissions of the same role may also change. Therefore, it is necessary to compare the role identification and role permissions in the role version information.

[0055] As an optional but non-limiting implementation method, based on whether the current role associated with the current access object has changed relative to the reference role, the current resource access request of the current access object to the target database is authenticated, including: if it is detected that the current role has changed relative to the reference role, calling the preset access management service to create new role version information for the current role of the current access object, re-acquiring the new role version information corresponding to the current access object and the current role of the current access object from the reference database and caching it, and authenticating the new role version information corresponding to the current access object and the current role of the current access object.

[0056] The reference database is a database corresponding to the preset access management service, and the reference database stores the corresponding role version information of each different access object that has completed authentication.

[0057] Specifically, if it is detected that the current role has changed relative to the reference role, it means that there is no corresponding role version information in the current reference database. In this case, it is necessary to call the preset access management service to create new role version information for the current role of the current access object. The new role version information corresponds to the role version information of the current role. After the new role version information is created, it will be updated in the reference database. The new role version information will be used as the role version information corresponding to the new reference role in subsequent solutions for a new round of authentication.

[0058] After creating the new role version information, the preset access management service will continue to obtain the current access object and the current role of the current access object from the reference database and cache the new role version information. Then, a new round of authentication will be performed on the new role version information corresponding to the current access object and the current role of the current access object.

[0059] As an optional but non-limiting implementation, authenticating the creation of new role version information corresponding to the current access object and the current role of the current access object may include the following steps B1-B5:

[0060] Step B1: Check whether the current role of the current access object is in a valid state.

[0061] The valid state means that the permission corresponding to the current role is within the legal validity period. For example, the valid state can be marked by the key field content or by adding a validity period tag. Correspondingly, whether the current role of the current access object is in a valid state can be determined by detecting the field content or the tag content.

[0062] Step B2: If the current role of the current access object is not in a valid state, it is determined that the current resource access request of the current access object to the target database fails the authentication.

[0063] If the current role of the current access object is not in a valid state, it means that the current role does not have legal access rights at the current time, so the current access object cannot access related resources, and it is determined that the current resource access request of the current access object to the target database fails the authentication.

[0064] Step B3: If the current role of the current access object is in a valid state, then check whether the role version information corresponding to the current role of the current access object is associated with reference resource permissions, where the reference resource permissions are data resource access rights authorized to be used when accessing data resources on the target database.

[0065] If the current role of the current access object is in a valid state, although the validity of the permission is guaranteed, the associated permission content may also change. Therefore, it is necessary to further detect whether the role version information corresponding to the current role of the current access object is associated with the reference resource permission. The reference resource permission is the data resource access right that the access object is authorized to use when accessing the data resource of the target database. In essence, it is to determine whether the role permission in the role version information corresponding to the current role is consistent with the reference resource permission.

[0066] Step B4: If the role version information corresponding to the current role of the current access object is associated with the reference resource authority, it is determined that the current resource access request of the current access object to the target database is authenticated.

[0067] Specifically, if it is detected that the role version information corresponding to the current role of the current access object is associated with the reference resource permission, it means that the access permission of the current object is consistent and is also in a valid state, and it is determined that the current resource access request of the current access object to the target database is authenticated.

[0068] Step B5: If the role version information corresponding to the current role of the current access object is no longer associated with the reference resource authority, it is determined that the current resource access request of the current access object to the target database fails the authentication.

[0069] Specifically, if it is detected that the role version information corresponding to the current role of the current access object is no longer associated with the reference resource permission, it means that the current access object does not have the corresponding correct permission, then the current access object cannot be allowed to access the current resources of the target database, and it is determined that the current access object's current resource access request authentication for the target database has failed.

[0070] S240: If the role version information of the current role is the same as the role version information of the reference role, it is determined that the current role of the currently accessed object has not changed relative to the reference role.

[0071] Specifically, when the role identifiers and role permissions corresponding to the two role version information are the same, it means that the role version information of the current role is the same as the role version information of the reference role, and it is determined that the current role of the currently accessed object has not changed relative to the reference role.

[0072] S250: Authenticate the current resource access request of the current access object to the target database based on whether the current role associated with the current access object is changed relative to the reference role.

[0073] S260: Access data resources of the target database through the SaaS service based on the authentication result of the current resource access request of the current access object to the target database.

[0074] As an optional but non-limiting implementation, accessing data resources of a target database through a SaaS service based on the authentication result of a current resource access request of a current access object to the target database may include the following steps C1-C2:

[0075] Step C1: When the current resource access request is authenticated, the data resource in the target database is called through the SaaS service, and the data resource access result corresponding to the current resource access request is returned to the current access object.

[0076] Specifically, if the current resource access request is authenticated, it means that the permissions that the current access object wants to access are compliant. Then, the data resources in the target database can be called through the SaaS service, and the data resource access result corresponding to the current resource access request is returned to the current access object.

[0077] Step C2: When the current resource access request fails to be authenticated, the access call to the data resource in the target database is rejected through the SaaS service.

[0078] Specifically, when the authentication of the current resource access request fails, it means that the permission that the current access object wants to access is not compliant, and the access call to the data resource in the target database is rejected through the SaaS service.

[0079] The technical solution of the embodiment of the present invention is to receive a current resource access request initiated by a current access object to a target database through a SaaS service, and the target database adopts an independent database system with completely isolated data; in response to the current resource access request, detect through the SaaS service whether a current role associated with the current access object has changed relative to a reference role, the current role is a role associated with the current access object read from the received current resource access request, the reference role is a role that completes authentication and configuration association for the current access object before the current access object initiates the current resource access request to the target database, and the role that completes authentication and configuration association for the access object has the designated data resource access rights authorized to use when accessing data resources in the database; based on whether the current role associated with the current access object has changed relative to the reference role, authenticate the current resource access request of the current access object to the target database; and access the data resources of the target database through the SaaS service based on the authentication result of the current resource access request of the current access object to the target database. This solution determines whether the current access object can access the data resource based on the difference between the current role and the reference role associated with the current access object. This solution only relies on the difference in roles to make judgments, and does not need to frequently call complete user permission resources for verification, which reduces the pressure on backend services and databases, and can quickly detect access objects with high response speed. At the same time, the target database used in this solution adopts an independent database system with completely isolated data, which not only retains the independent tenant data of the SaaS system, realizes business data isolation, and effectively prevents data unauthorized access, but also helps the platform side to provide unified services and monitoring management for access objects.

[0080] Figure 3 This is a schematic diagram of the structure of a data resource processing device provided by an embodiment of the present invention. This embodiment is applicable to the case where data resources are processed through SaaS services. The data resource processing device can be implemented in the form of hardware and / or software, and the data resource processing device can be configured in any electronic device with network communication function. Figure 3 As shown, the device includes an access request receiving module 310, a role detection module 320, an access request authentication module 330 and a data resource access module 340, wherein:

[0081] The access request receiving module 310 is used to receive a current resource access request initiated by the current access object to the target database through the SaaS service, and the target database adopts an independent database system with completely isolated data;

[0082] The role detection module 320 is used to detect, in response to the current resource access request, whether the current role associated with the current access object has changed relative to the reference role through the SaaS service, wherein the current role is the role associated with the current access object read from the current resource access request received, and the reference role is the role that has been authenticated and configured for the current access object before the current access object initiates the current resource access request to the target database, and the role that has been authenticated and configured for the access object has the specified data resource access rights that are authorized to be used when accessing data resources on the database;

[0083] An access request authentication module 330, configured to authenticate a current resource access request of the current access object to the target database based on whether a current role associated with the current access object has changed relative to a reference role;

[0084] The data resource access module 340 is used to access the data resources of the target database through the SaaS service based on the authentication result of the current resource access request of the current access object to the target database.

[0085] As an optional but non-limiting implementation, the role detection module 320 includes:

[0086] A role detection unit, used to detect whether the current role of the currently accessed object has changed relative to the reference role;

[0087] The role detection unit is specifically used to call a preset access management service to detect whether the role version information of the current role of the current access object is completely identical to the role version information of the reference role, the role version information includes a role identifier and a role authority, and the role authority is used to indicate the data resource access rights that the role to which the role version information belongs is authorized to use when accessing data resources in the database; wherein the preset access management service is used to integrate and manage access objects corresponding to different databases; if the role version information of the current role is not completely identical to the role version information of the reference role, it is determined that the current role of the current access object has changed relative to the reference role; if the role version information of the current role is the same as the role version information of the reference role, it is determined that the current role of the current access object has not changed relative to the reference role.

[0088] As an optional but non-limiting implementation, the role detection unit includes:

[0089] A cache subunit, used for calling a preset access management service to record the role version information of the current role and perform Redis cache;

[0090] The comparison sub-unit is used to transparently transmit the role version information of the current role of the current access object carried in the current resource access request to the preset access management service through the SaaS service, and call the preset access management service to compare the role version information of the current role with the role version information of the reference role of the current access object to determine whether the role version information of the current role is completely identical to the role version information of the reference role.

[0091] As an optional but non-limiting implementation, the access request authentication module 330 includes:

[0092] The role version information creation and authentication unit is used to call the preset access management service to create new role version information for the current role of the current access object if it detects that the current role has changed relative to the reference role, re-acquire the current access object and the current role of the current access object from the reference database to create and cache the new role version information, and authenticate the new role version information corresponding to the current access object and the current role of the current access object.

[0093] As an optional but non-limiting implementation, the role version information creation and authentication unit is specifically used to:

[0094] Check whether the current role of the currently accessed object is in a valid state;

[0095] If the current role of the current access object is not in a valid state, determining that the current resource access request of the current access object to the target database fails authentication;

[0096] If the current role of the currently accessed object is in a valid state, detecting whether the role version information corresponding to the current role of the currently accessed object is associated with a reference resource authority, wherein the reference resource authority is a data resource access right authorized to be used when accessing data resources of the target database;

[0097] If the role version information corresponding to the current role of the current access object is associated with the reference resource authority, it is determined that the current resource access request of the current access object to the target database is authenticated;

[0098] If the role version information corresponding to the current role of the current access object is no longer associated with the reference resource authority, it is determined that the current resource access request authentication of the current access object to the target database fails.

[0099] As an optional but non-limiting implementation, the data resource access module 340 is specifically configured to:

[0100] In the case where the current resource access request is authenticated, the data resource in the target database is called through the SaaS service, and a data resource access result corresponding to the current resource access request is returned to the current access object;

[0101] In the case that the current resource access request fails to be authenticated, the SaaS service refuses to access the data resources in the target database.

[0102] The technical solution of the embodiment of the present invention is to receive a current resource access request initiated by a current access object to a target database through a SaaS service, and the target database adopts an independent database system with completely isolated data; in response to the current resource access request, detect through the SaaS service whether a current role associated with the current access object has changed relative to a reference role, the current role is a role associated with the current access object read from the received current resource access request, the reference role is a role that completes authentication and configuration association for the current access object before the current access object initiates the current resource access request to the target database, and the role that completes authentication and configuration association for the access object has the designated data resource access rights authorized to use when accessing data resources in the database; based on whether the current role associated with the current access object has changed relative to the reference role, authenticate the current resource access request of the current access object to the target database; and access the data resources of the target database through the SaaS service based on the authentication result of the current resource access request of the current access object to the target database. This solution determines whether the current access object can access the data resource based on the difference between the current role and the reference role associated with the current access object. This solution only relies on the difference in roles to make judgments, and does not need to frequently call complete user permission resources for verification, which reduces the pressure on backend services and databases, and can quickly detect access objects with high response speed. At the same time, the target database used in this solution adopts an independent database system with completely isolated data, which not only retains the independent tenant data of the SaaS system, realizes business data isolation, and effectively prevents data unauthorized access, but also helps the platform side to provide unified services and monitoring management for access objects.

[0103] The data resource processing device provided in the embodiment of the present invention can execute the data resource processing method provided in any embodiment of the present invention, and has the corresponding functions and beneficial effects of executing the data resource processing method. For detailed processes, please refer to the relevant operations in the aforementioned embodiments.

[0104] Figure 4A schematic diagram of the structure of an electronic device for implementing a data resource processing method provided in an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0105] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0106] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0107] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, for example, executes the data resource processing method provided in any embodiment of the present invention.

[0108] In some embodiments, the data resource processing method provided in any embodiment of the present invention may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps in the data resource processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the data resource processing method provided in any embodiment of the present invention in any other appropriate manner (for example, by means of firmware).

[0109] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs, which may be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general programmable processor, which may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0110] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0111] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0112] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0113] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0114] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0115] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0116] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data resource processing method, characterized in that: The method comprises: Receiving a current resource access request initiated by a current access object to a target database through a SaaS service, wherein the target database adopts an independent database system with completely isolated data; In response to the current resource access request, the SaaS service is used to detect whether the current role associated with the current access object has changed relative to the reference role, wherein the current role is the role associated with the current access object read from the current resource access request received, and the reference role is the role that has been authenticated and configured for the current access object before the current access object initiates the current resource access request to the target database, and the role that has been authenticated and configured for the access object has the specified data resource access rights that are authorized to be used when accessing data resources on the database; Authenticating a current resource access request of the current access object to the target database based on whether a current role associated with the current access object has changed relative to a reference role; Based on the authentication result of the current resource access request of the current access object to the target database, data resource access is performed on the target database through the SaaS service.

2. The method according to claim 1, characterized in that Detect whether the current role of the currently accessed object has changed relative to the reference role, including: Calling a preset access management service to detect whether the role version information of the current role of the current access object is the same as the role version information of the reference role, wherein the role version information includes a role identifier and a role authority, and the role authority is used to indicate the data resource access rights that the role to which the role version information belongs is authorized to use when accessing data resources in the database; wherein the preset access management service is used to integrate and manage access objects corresponding to different databases; If the role version information of the current role is not completely identical to the role version information of the reference role, then determining that the current role of the currently accessed object has changed relative to the reference role; If the role version information of the current role is the same as the role version information of the reference role, it is determined that the current role of the currently accessed object has not changed relative to the reference role.

3. The method according to claim 2, characterized in that Call the preset access management service to detect whether the role version information of the current role of the current access object is the same as the role version information of the reference role, including: Call the preset access management service to record the role version information of the current role and perform Redis cache; The role version information of the current role of the current access object carried in the current resource access request is transparently transmitted to the preset access management service through the SaaS service, and the preset access management service is called to compare the role version information of the current role with the role version information of the reference role of the current access object to determine whether the role version information of the current role is completely identical to the role version information of the reference role.

4. The method according to claim 2, characterized in that: Based on whether a current role associated with a current access object changes relative to a reference role, authenticating a current resource access request of the current access object to a target database includes: If it is detected that the current role has changed relative to the reference role, the preset access management service is called to create new role version information for the current role of the current access object, and the new role version information corresponding to the current access object and the current role of the current access object is obtained from the reference database again and cached, and the new role version information corresponding to the current access object and the current role of the current access object is authenticated.

5. The method according to claim 4, characterized in that Creating new role version information corresponding to the current access object and the current role of the current access object for authentication includes: Check whether the current role of the currently accessed object is in a valid state; If the current role of the current access object is not in a valid state, determining that the current resource access request of the current access object to the target database fails authentication; If the current role of the currently accessed object is in a valid state, detecting whether the role version information corresponding to the current role of the currently accessed object is associated with a reference resource authority, wherein the reference resource authority is a data resource access right authorized to be used when accessing data resources of the target database; If the role version information corresponding to the current role of the current access object is associated with the reference resource authority, it is determined that the current resource access request of the current access object to the target database is authenticated; If the role version information corresponding to the current role of the current access object is no longer associated with the reference resource authority, it is determined that the current resource access request authentication of the current access object to the target database fails.

6. The method according to claim 1, characterized in that Accessing data resources of the target database through the SaaS service based on the authentication result of the current resource access request of the current access object to the target database includes: In the case where the current resource access request is authenticated, the data resource in the target database is called through the SaaS service, and a data resource access result corresponding to the current resource access request is returned to the current access object; In the case that the current resource access request fails to be authenticated, the SaaS service refuses to access the data resources in the target database.

7. A data resource processing device, characterized in that: The device comprises: An access request receiving module, used to receive a current resource access request initiated by a current access object to a target database through a SaaS service, wherein the target database adopts an independent database system with completely isolated data; A role detection module is used to detect, in response to the current resource access request, whether the current role associated with the current access object has changed relative to the reference role through the SaaS service, wherein the current role is the role associated with the current access object read from the current resource access request received, and the reference role is the role that has been authenticated and configured for the current access object before the current access object initiates the current resource access request to the target database, and the role that has been authenticated and configured for the access object has the specified data resource access rights that are authorized to be used when accessing data resources on the database; An access request authentication module, used to authenticate a current resource access request of a current access object to a target database based on whether a current role associated with the current access object has changed relative to a reference role; The data resource access module is used to access the data resources of the target database through the SaaS service based on the authentication result of the current resource access request of the current access object to the target database.

8. The device according to claim 7, characterized in that The role detection module comprises: A role detection unit, used to detect whether the current role of the currently accessed object has changed relative to the reference role; The role detection unit is specifically used to call a preset access management service to detect whether the role version information of the current role of the current access object is completely identical to the role version information of the reference role, the role version information includes a role identifier and a role authority, and the role authority is used to indicate the data resource access rights that the role to which the role version information belongs is authorized to use when accessing data resources in the database; wherein the preset access management service is used to integrate and manage access objects corresponding to different databases; if the role version information of the current role is not completely identical to the role version information of the reference role, it is determined that the current role of the current access object has changed relative to the reference role; if the role version information of the current role is the same as the role version information of the reference role, it is determined that the current role of the current access object has not changed relative to the reference role.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data resource processing method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data resource processing method according to any one of claims 1 to 6 when executed.

Images