Data access method and device

Abstract

The invention provides a data access method and device.The method comprises the steps that in response to an obtained data operation request of a user, an authority information obtaining instruction is sent to target hardware equipment; wherein the target hardware equipment is used for storing database permission information; receiving first permission information sent by the target hardware equipment; authenticating the first permission information to determine whether the user has an operation permission; in response to the operation authority of the user, sending a data operation request to a server; and receiving a data operation result returned by the server. According to the method, the security of the authority information of the database is ensured in a physical isolation mode, and the data which can be operated and accessed by the user is controlled according to the authority information of the user, so that the security of data operation is ensured.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data access method and device. Background Art

[0002] Low-code platforms are digital tool platforms that use graphical interfaces and little or no code to quickly build applications. These platforms enable non-technical users and developers to quickly develop applications that meet business needs by providing visual development tools, pre-built components and modules, thereby significantly improving development efficiency and reducing development costs. Summary of the invention

[0003] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0004] To this end, the first purpose of this application is to propose a data access method that ensures the security of data authority information through physical isolation, and controls the operations that users can perform and the data they can access based on user authority information, thereby ensuring the security of data operations.

[0005] The second objective of the present application is to provide a data access device.

[0006] The third objective of the present application is to provide an electronic device.

[0007] A fourth objective of the present application is to provide a computer-readable storage medium.

[0008] A fifth object of the present application is to provide a computer program product.

[0009] To achieve the above-mentioned purpose, the first embodiment of the present application proposes a data access method, including:

[0010] In response to obtaining a user's data operation request, sending a permission information acquisition instruction to a target hardware device; wherein the target hardware device is used to store database permission information;

[0011] Receiving first permission information sent by the target hardware device;

[0012] Authenticating the first permission information to determine whether the user has operation authority;

[0013] In response to the user having the operation authority, sending the data operation request to the server;

[0014] Receive the data operation result returned by the server.

[0015] To achieve the above-mentioned purpose, a second aspect of the present application provides a data access device, including:

[0016] A sending module, configured to send a permission information acquisition instruction to a target hardware device in response to a data operation request obtained from a user; wherein the target hardware device is used to store database permission information;

[0017] A receiving module, used for receiving the first permission information sent by the target hardware device;

[0018] A first determination module, used to authenticate the first permission information to determine whether the user has operation permission;

[0019] The sending module is further used to send the data operation request to the server in response to the user having the operation authority;

[0020] The receiving module is also used to receive the data operation result returned by the server.

[0021] To achieve the above-mentioned purpose, the third aspect of the present application provides an electronic device, including:

[0022] A processor, and a memory communicatively connected to the processor;

[0023] The memory stores computer-executable instructions;

[0024] The processor executes the computer-executable instructions stored in the memory to implement the method described in the first aspect embodiment above.

[0025] To achieve the above-mentioned purpose, the fourth aspect embodiment of the present application proposes a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the method described in the first aspect embodiment above.

[0026] To achieve the above-mentioned purpose, the fifth aspect of the present application proposes a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0027] The data access method, device, electronic device and storage medium provided by the present application can store database permission information through the target hardware device, and can isolate the database permission information from the low-code platform, thereby isolating the database permission information from the outside world through physical isolation, thereby ensuring the security of the database permission information. In addition, the received permission information is authenticated to ensure that the user has the corresponding permission, so that the operations that the user can perform and the data that can be accessed can be controlled according to the user permission information, thereby ensuring the security of data operations.

[0028] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0030] Figure 1 A flowchart of a data access method provided in an embodiment of the present application;

[0031] Figure 2 A flowchart of another data access method provided in an embodiment of the present application;

[0032] Figure 3 A flowchart of another data access method provided in an embodiment of the present application;

[0033] Figure 4 A schematic diagram of a data access process provided by an embodiment of the present application;

[0034] Figure 5 A structural diagram of a data access device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0036] The data access method and device of the embodiments of the present application are described below with reference to the accompanying drawings.

[0037] Figure 1 A flowchart of a data access method provided in an embodiment of the present application. The data access method in an embodiment of the present application can be executed by a low-code platform.

[0038] In the related art, sensitive data such as database permission information in the low-code platform is usually stored in the same physical environment as the application server. Once the server is hacked, the data will face huge risks. Based on this, the embodiment of the present application provides a data access method.

[0039] like Figure 1 As shown, the data access method includes the following steps:

[0040] Step 101: in response to obtaining a data operation request from a user, sending a permission information obtaining instruction to a target hardware device.

[0041] Among them, the target hardware device can be a hardware device independent of the low-code platform, and the target hardware device can be used to store database permission information.

[0042] In this application, the database permission information can be stored in the target hardware device, that is, in a dedicated hardware device. The user can insert the target hardware device into the low-code platform and then perform database operations, such as query, insert, modify, delete, etc. If the user's data operation request is obtained, the low-code platform can send a permission information acquisition instruction to the target hardware device.

[0043] In this application, the low-code platform has corresponding interfaces that can be used to communicate with the target hardware device. When the user needs to perform data operations, the low-code platform sends permission information acquisition instructions to the target hardware device through these interfaces.

[0044] Step 102: Receive first permission information sent by the target hardware device.

[0045] As a possible implementation method, the permission information acquisition instruction may include the user's account information. The target hardware device can obtain database permission information matching the account information based on the user's account information, that is, the first permission information, and send the first permission information to the low-code platform.

[0046] As another possible implementation method, the first permission information may refer to all database permission information stored in the target hardware device. When the target hardware device receives the permission information acquisition instruction, the stored first permission information is sent to the low-code platform.

[0047] Step 103: Authenticate the first permission information to determine whether the user has the operation permission.

[0048] As a possible implementation, the first permission information may refer to the database permission information of the current user, and the first permission information may be matched with the permission information for executing the database operation, and whether the user has the operation permission is determined according to the matching result. If the first permission information matches any permission information for executing the database operation, it is determined that the user has the operation permission; if the first permission information does not match any permission information for executing the database operation, it is determined that the user does not have the operation permission.

[0049] For example, when a user performs a delete operation on a database, if the first permission information matches any permission information for performing the delete operation, it can be determined that the user has the permission to perform the delete operation.

[0050] As another possible implementation method, the first permission information may be all database permission information stored in the target hardware device. The low-code platform may authenticate the first permission information based on the user's account information to determine whether the user has the operation permission.

[0051] Step 104: In response to the user having the operation authority, a data operation request is sent to the server.

[0052] In this application, if it is determined that the user has the operation authority, a data operation request can be sent to the server, where the server can refer to a database server, which is a server specifically used to store, retrieve and manage large amounts of data and is responsible for processing database-related requests and operations.

[0053] Step 105: Receive the data operation result returned by the server.

[0054] In this application, after receiving the data operation request, the server can perform the corresponding operation and return the data operation result to the low-code platform.

[0055] Optionally, the low-code platform can perform security audits on user operations and record operation logs for subsequent tracking and analysis.

[0056] Optionally, the low-code platform can detect and handle abnormal operations in a timely manner to prevent security incidents. For example, when an abnormal operation is detected, a prompt message can be generated and notified to the management personnel so that the abnormal operation can be detected and handled in a timely manner.

[0057] In an embodiment of the present application, database permission information is stored in a target hardware device, so that the database permission information can be isolated from the low-code platform, thereby isolating the database permission information from the outside world through physical isolation, thereby ensuring the security of the database permission information. In addition, the received permission information is authenticated to ensure that the user has the corresponding authority, so that the operations that the user can perform and the data that can be accessed can be controlled based on the user permission information, thereby ensuring the security of data operations.

[0058] Figure 2 A flowchart of another data access method provided in an embodiment of the present application.

[0059] like Figure 2 As shown, the data access method may include the following steps:

[0060] Step 201: In response to obtaining a data operation request from a user, a permission information obtaining instruction is sent to a target hardware device.

[0061] In the present application, step 201 can be implemented in any of the embodiments of the present application, so it will not be described in detail here.

[0062] Due to different user roles, the user's operation permissions may be different. For example, in this application, the permission information acquisition instruction may carry the user's role information, and the target hardware platform may acquire permission information matching the user's role information based on the user's role information, that is, the first permission information may be permission information acquired by the target hardware device based on the role information and matching the role information. Thus, role-based access control to the database is implemented.

[0063] Step 202: Receive first permission information sent by the target hardware device.

[0064] The first permission information may be encrypted permission information.

[0065] In this application, after the target hardware device receives the permission information acquisition instruction, it can encrypt the database permission information through an encryption algorithm to obtain the first permission information, and then send the first permission information to the low-code platform, thereby encrypting and transmitting the permission information to ensure the security of the permission information during the transmission process.

[0066] Exemplarily, the target hardware device can encrypt and store the database permission information. Exemplarily, the target hardware device can segment the database permission information to obtain multiple first data slices and the first index of each first data slice, encrypt each first data slice separately to obtain the second data slice corresponding to each first data slice, encrypt the first index of each first data slice to obtain the second index of each first data slice, and then store the second data slice and the second index.

[0067] After the database permission information is divided into multiple data shards, in order to ensure that the logical relationship between the data shards cannot be easily discovered, the index of the data shards can be encrypted. In this way, even if an attacker can obtain a certain data shard, it is difficult to find other related data shards through the index.

[0068] Therefore, by performing data segmentation on the database permission information and encrypting and storing the segmented data fragments and indexes respectively, the security of the storage of the database permission information is improved.

[0069] Step 203: decrypt the first permission information to obtain second permission information.

[0070] In this application, the low-code platform can decrypt the first permission information through a corresponding decryption method to obtain the second permission information.

[0071] Step 204: authenticate the second permission information to determine whether the user has the operation permission.

[0072] In the present application, after the second permission information is obtained by decryption, the second permission information may be authenticated to determine whether the user has the operation permission.

[0073] Optionally, the process of transmission and authentication of the first authority information may be monitored for security, so as to timely discover and respond to potential security threats.

[0074] Step 205: In response to the user having the operation authority, a data operation request is sent to the server.

[0075] In the present application, step 205 can be implemented in any of the embodiments of the present application, so it will not be described in detail here.

[0076] Step 206: Receive the data operation result returned by the server.

[0077] In the present application, step 206 can be implemented in any of the embodiments of the present application, so it will not be described in detail here.

[0078] In an embodiment of the present application, the target hardware device can encrypt the permission information and then send it to the low-code platform, thereby encrypting and transmitting the permission information, converting the permission information into ciphertext form for transmission. Only the correct key can decrypt and obtain the original information, thereby ensuring the security of the permission information. In addition, the received first permission information is decrypted and authenticated to ensure that the user has the corresponding permission. The user performs data operations based on the second permission information. Therefore, during the entire process, the database permission information always remains encrypted, ensuring the security of data operations.

[0079] like Figure 3 As shown, the data access method may further include the following steps:

[0080] Step 301, in response to detecting a user's account login operation, obtaining the account information and the first dynamic password input by the user.

[0081] In this application, the user can log in before operating the database. When logging in, the user can enter the account information and the dynamic password on the hardware token, where the hardware token is a physical device used for identity authentication and authorization. Therefore, if the low-code platform detects the user's login operation, the account information and the first dynamic password entered by the user can be obtained.

[0082] Step 302: Generate a second dynamic key based on a dynamic key generation algorithm used by a hardware token bound to the account information.

[0083] In this application, an account can be bound to a hardware token, and the low-code platform can securely store this binding relationship. Optionally, encryption measures can be used to protect the binding relationship to ensure the accuracy and reliability of the user's identity.

[0084] In this application, the low-code platform can determine the hardware token bound to the account information based on the user's account information, and then generate a second dynamic key based on the dynamic key generation algorithm used by the hardware token bound to the account information.

[0085] Step 303: compare the first dynamic key with the second dynamic key.

[0086] In this application, the low-code platform can compare the first dynamic key entered by the user with the generated second dynamic key to determine whether the hardware token held by the user is valid.

[0087] Step 304: In response to the first dynamic key being consistent with the second dynamic key, determining that the user has passed preliminary identity authentication.

[0088] In the present application, if the first dynamic key is consistent with the second dynamic key, it means that the hardware token held by the user is valid, and it can be determined that the user has passed the preliminary identity verification.

[0089] For example, a low-code platform can adopt a zero-trust network, which is a network security model whose core concept is "never trust, always verify". After a user successfully logs in, the zero-trust network can require continuous verification and evaluation of the user's identity and behavior, such as continuous monitoring of user sessions, real-time detection and response to abnormal behavior, etc., to ensure the continuous security of the low-code platform and the compliance of user operations.

[0090] The low-code platform can also manage the issuance, use, loss reporting, cancellation and update of hardware tokens, thereby managing the entire life cycle of hardware tokens, ensuring the security and effectiveness of hardware tokens throughout their life cycle, while also ensuring the continued safe operation of the low-code platform. Therefore, the centralized authentication service and full-life cycle hardware token management of the low-code platform ensure security while also improving the convenience of data operations.

[0091] In order to ensure the normal use of the hardware token, the hardware token can optionally be detected for abnormalities. Exemplarily, the current running data of the hardware token can be obtained, and the current running data can be mapped to a decision tree, and the path length of the current running data isolated in the decision tree can be calculated, and the abnormality score can be determined based on the path length, and then based on the abnormality score, it can be determined whether the hardware token is abnormal. For example, if the abnormality score is greater than a threshold, it can be determined that the hardware token is abnormal, and if the abnormality score is less than the threshold, it can be determined that the hardware token is normal.

[0092] The current operation data may include but is not limited to the current usage time, usage frequency, geographic location, etc. of the hardware token.

[0093] Among them, the path length can be used to characterize the degree to which the current running data is isolated. The longer the path length, the higher the degree of isolation and the higher the anomaly score.

[0094] The decision tree may be constructed by unsupervised learning using an isolation forest algorithm. For example, multiple decision trees may be constructed to isolate abnormal points, which are more easily isolated because they deviate from the normal pattern. In the decision tree, the splitting of each node may be based on randomly selected features and split points.

[0095] Therefore, the hardware token can be detected for anomalies by using the decision tree, so that abnormal hardware tokens can be discovered in time to ensure the normal use of the hardware token.

[0096] Optionally, the remaining usage time of the hardware token can also be predicted so that the user can replace the hardware token in time. Exemplarily, the time series data of the hardware token can be obtained and the time series data can be processed using a long short-term memory network to predict the remaining usage time of the hardware token.

[0097] Among them, the time series data may include the operation data of the hardware token at each time point, and the operation data may include but is not limited to usage time, usage frequency, geographic location, etc.

[0098] Therefore, based on the operating data of the hardware token at each time point, the long short-term memory network can be used to predict the remaining usage time of the hardware token, thereby realizing the prediction of the remaining service life of the hardware token, so that the user can replace the hardware token in time according to the remaining service life.

[0099] Optionally, a proportional hazard model can be used to perform survival analysis on the hardware token to predict the failure time of the hardware token. Exemplarily, covariates that affect the failure time of the hardware token can be obtained, and based on the covariates, a proportional hazard model can be used to perform survival analysis on the hardware token to determine the risk rate of the hardware token at various future time points, and then the failure time of the hardware token is predicted based on the risk rate at various future time points.

[0100] The covariates may include but are not limited to the usage frequency of the hardware token, the token model, etc.

[0101] The risk rate can represent the instantaneous probability of a hardware token failing in the next instant if it is still alive at a given time point. The proportional risk model can be used to estimate the risk rate of the hardware token at different time points under given covariates.

[0102] Exemplarily, if the risk rate at a certain time point in the future is greater than a risk rate threshold, the time point can be predicted as the failure time of the hardware token.

[0103] Therefore, the proportional hazard model can be used to perform survival analysis on hardware tokens and predict the failure time of hardware tokens, thereby facilitating efficient management of hardware tokens.

[0104] In the embodiment of the present application, when a user logs into the low-code platform, a check of the hardware token uniquely bound to the user account will be automatically triggered, ensuring that each user is bound to a unique hardware token, thereby providing a security line for the low-code platform and ensuring that only users holding valid hardware tokens can pass the initial identity verification, effectively preventing unauthorized access and potential security threats. In addition, the binding of the hardware token to the user account provides a physical and logical dual authentication mechanism for user access to the low-code platform. Therefore, the use of a hardware-enhanced identity authentication mechanism, combined with the principle of zero-trust network, can achieve enhanced security for sensitive information in the low-code platform.

[0105] In addition, the target hardware device can send encrypted permission information to the low-code platform, thereby ensuring data security through physically isolated hardware tokens and encrypted transmission.

[0106] In order to facilitate understanding of the data access method of this application, Figure 4 To explain, Figure 4 A schematic diagram of a data access process provided in an embodiment of the present application.

[0107] like Figure 4 As shown, the data access process includes:

[0108] Step 401: The user initiates a data operation request to the low-code platform.

[0109] Step 402, the low-code platform sends instructions to the target hardware device.

[0110] Step 403: The target hardware device transmits encrypted permission information to the low-code platform.

[0111] In step 404, the low-code platform decrypts and authenticates the received permission information.

[0112] Step 405: The low-code platform sends a data operation request to the server.

[0113] Step 406, the server database performs corresponding operations and returns the data operation results to the low-code platform.

[0114] Step 407: The low-code platform returns the data operation results to the user.

[0115] The data access method of the embodiment of the present application ensures the security of sensitive information in the low-code platform through physical isolation and encrypted transmission. It uses special hardware devices to store and manage sensitive information such as server database permissions. When users perform data operations, they only need to insert the hardware device into the low-code platform to perform data operations through a secure interface. After receiving the permission information acquisition instruction from the low-code platform, the target hardware device can encrypt the database permission information and transmit it to the low-code platform. The low-code platform performs decryption and authentication to ensure that the user has the corresponding permissions. Throughout the process, sensitive information always remains encrypted to ensure the security of data operations. This can effectively solve the problems of sensitive information storage and permission management in the low-code platform and improve the security and convenience of data operations.

[0116] In order to implement the above embodiment, the present application also proposes a data access device.

[0117] Figure 5 A structural diagram of a data access device provided in an embodiment of the present application.

[0118] like Figure 5 As shown, the data access device 500 includes:

[0119] The sending module 510 is used to send a permission information acquisition instruction to a target hardware device in response to obtaining a data operation request from a user; wherein the target hardware device is used to store database permission information;

[0120] A receiving module 520, configured to receive first permission information sent by the target hardware device;

[0121] A first determination module 530, configured to authenticate the first permission information to determine whether the user has operation permission;

[0122] The sending module 510 is further configured to send the data operation request to the server in response to the user having the operation authority;

[0123] The receiving module 520 is further configured to receive the data operation result returned by the server.

[0124] Further, in a possible implementation manner of the embodiment of the present application, the first permission information is encrypted permission information, and the first determining module 530 is used to:

[0125] decrypting the first permission information to obtain second permission information;

[0126] The second permission information is authenticated to determine whether the user has the operation permission.

[0127] Furthermore, in a possible implementation of the embodiment of the present application, the target hardware device stores the database permission information in the following manner:

[0128] Segmenting the database permission information to obtain a plurality of first data shards and a first index of each of the first data shards;

[0129] Encrypt each of the first data slices separately to obtain a second data slice corresponding to each of the first data slices;

[0130] Encrypting the first index to obtain a second index;

[0131] The second data shard and the second index are stored.

[0132] Furthermore, in a possible implementation of an embodiment of the present application, the permission information acquisition instruction carries role information of the user, and the first permission information is permission information acquired by the target hardware device according to the role information and matches the role information.

[0133] Furthermore, in a possible implementation of the embodiment of the present application, the device may also include:

[0134] A first acquisition module, configured to acquire the account information and the first dynamic password input by the user in response to detecting an account login operation of the user;

[0135] A generation module, configured to generate a second dynamic key based on a dynamic key generation algorithm used by a hardware token bound to the account information;

[0136] A comparison module, used for comparing the first dynamic key with the second dynamic key;

[0137] The second determination module is configured to determine that the user has passed preliminary identity authentication in response to the first dynamic key being consistent with the second dynamic key.

[0138] Furthermore, in a possible implementation of the embodiment of the present application, the device may also include:

[0139] A second acquisition module, used to acquire current operation data of the hardware token;

[0140] A calculation module, used for mapping the current running data into a decision tree, and calculating the length of a path where the current running data is isolated in the decision tree;

[0141] A third determination module, configured to determine an anomaly score according to the path length;

[0142] The fourth determination module is used to determine whether the hardware token is abnormal according to the abnormality score.

[0143] Furthermore, in a possible implementation of the embodiment of the present application, the device may also include:

[0144] A third acquisition module is used to acquire time series data of the hardware token; wherein the time series data includes operation data of the hardware token at each time point;

[0145] The first prediction module is used to process the time series data using a long short-term memory network to predict the remaining usage time of the hardware token.

[0146] Furthermore, in a possible implementation of the embodiment of the present application, the device further includes:

[0147] A fourth acquisition module, used to acquire a covariate affecting the failure time of the hardware token;

[0148] a fifth determination module, configured to perform survival analysis on the hardware token using a proportional hazard model based on the covariate to determine the risk rate of the hardware token at various future time points;

[0149] The second prediction module is used to predict the failure time of the hardware token according to the risk rate at each future time point.

[0150] It should be noted that the above explanations of the data access method embodiment are also applicable to the data access device of this embodiment, and will not be repeated here.

[0151] In an embodiment of the present application, database permission information is stored in a target hardware device, so that the database permission information can be isolated from the low-code platform, thereby isolating the database permission information from the outside world through physical isolation, thereby ensuring the security of the database permission information. In addition, the received permission information is authenticated to ensure that the user has the corresponding authority, so that the operations that the user can perform and the data that can be accessed can be controlled based on the user permission information, thereby ensuring the security of data operations.

[0152] In order to implement the above embodiments, the present application also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided by the above embodiments.

[0153] In order to implement the above embodiments, the present application also proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.

[0154] In order to implement the above embodiments, the present application also proposes a computer program product, including a computer program, which implements the methods provided by the above embodiments when executed by a processor.

[0155] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with relevant laws and regulations and do not violate public order and good morals.

[0156] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0157] The present application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0158] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0159] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0160] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0161] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0162] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0163] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0164] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0165] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A data access method, characterized in that: The method is applied to a low-code platform and includes the following steps: In response to obtaining a user's data operation request, sending a permission information acquisition instruction to a target hardware device; wherein the target hardware device is used to store database permission information; Receiving first permission information sent by the target hardware device; Authenticating the first permission information to determine whether the user has operation authority; In response to the user having the operation authority, sending the data operation request to the server; Receive the data operation result returned by the server.

2. The method according to claim 1, characterized in that The first permission information is encrypted permission information, and the authenticating the first permission information to determine whether the user has the operation permission includes: decrypting the first permission information to obtain second permission information; The second permission information is authenticated to determine whether the user has the operation permission.

3. The method according to claim 1, characterized in that The target hardware device stores the database permission information in the following manner: Segmenting the database permission information to obtain a plurality of first data shards and a first index of each of the first data shards; Encrypt each of the first data slices separately to obtain a second data slice corresponding to each of the first data slices; Encrypting the first index to obtain a second index; The second data shard and the second index are stored.

4. The method according to claim 1, characterized in that: The permission information acquisition instruction carries the role information of the user, and the first permission information is permission information acquired by the target hardware device according to the role information and matching the role information.

5. The method according to any one of claims 1 to 4, characterized in that Also includes: In response to detecting an account login operation of the user, acquiring account information and a first dynamic password input by the user; Generate a second dynamic key based on a dynamic key generation algorithm used by a hardware token bound to the account information; comparing the first dynamic key with the second dynamic key; In response to the first dynamic key being consistent with the second dynamic key, it is determined that the user has passed preliminary identity authentication.

6. The method according to claim 5, characterized in that Also includes: Acquire current operation data of the hardware token; Mapping the current running data into a decision tree, and calculating the path length of the current running data isolated in the decision tree; determining an anomaly score based on the path length; According to the abnormality score, it is determined whether the hardware token is abnormal.

7. The method according to claim 5, characterized in that Also includes: Acquire time series data of the hardware token; wherein the time series data includes operation data of the hardware token at each time point; The time series data is processed using a long short-term memory network to predict the remaining usage time of the hardware token.

8. The method according to claim 5, characterized in that Also includes: Obtaining covariates that affect the failure time of the hardware token; Based on the covariate, performing survival analysis on the hardware token using a proportional hazard model to determine the hazard rate of the hardware token at various future time points; The failure time of the hardware token is predicted based on the risk rate at various time points in the future.

9. A data access device, characterized in that: include: A sending module, configured to send a permission information acquisition instruction to a target hardware device in response to a data operation request obtained from a user; wherein the target hardware device is used to store database permission information; A receiving module, used for receiving the first permission information sent by the target hardware device; A first determination module, used to authenticate the first permission information to determine whether the user has operation permission; The sending module is further used to send the data operation request to the server in response to the user having the operation authority; The receiving module is also used to receive the data operation result returned by the server.

10. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 8 when executed by a processor.

12. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 8 when being executed by a processor.

Images