Expression-based data permission configuration method
By adopting expression-based data permission configuration methods in the water conservancy industry, the problem that traditional permission management methods are difficult to meet dynamic changes and real-time requirements is solved, and more efficient, flexible and secure data permission management is achieved.
Patent Information
- Application Number
- CN202411533871.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-31
- Publication Date
- 2025-02-25
AI Technical Summary
Data access permission management in the water conservancy industry is complex, and traditional hard-coded codes are difficult to meet the needs of dynamic changes. The lack of unified permission management pages makes it difficult to ensure data security and real-time.
The data permission configuration method based on expression is adopted, and the permission configuration platform is configured through the permission configuration platform, and the Aviator expression is generated on the business service side for data permission filtering.
It improves the compatibility, flexibility and scalability of business access, simplifies the permission management process, improves operation and maintenance efficiency, and ensures data security and real-timeness.
Smart Images
Figure CN119513856A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of data processing, and in particular to an expression-based data authority configuration method. Background Art
[0002] With the continuous development of information technology, the water conservancy industry is gradually transforming towards intelligence and information technology. Against the background of rapid growth in the water conservancy industry and the continuous deepening of information construction, various types of water conservancy data are showing an explosive growth trend. These data not only cover hydrological monitoring, water resources management, flood control and drought relief, water conservancy project construction and other aspects, but also involve a large user group and complex business processes. Faced with such a large and diverse data resource, how to effectively manage data access rights and ensure data security and compliance has become an important challenge in the information construction of the water conservancy industry. The current pain points are mainly reflected in the following aspects:
[0003] 1. Increased business complexity: With the continuous expansion and deepening of the water conservancy industry, data access needs are becoming increasingly complex. Different users, departments, projects, and business scenarios have different data needs, and often need to be adjusted according to actual conditions. The traditional hard-coding method can no longer meet such dynamically changing needs and is very difficult to manage. The permission code is written in each business scenario, which cannot be globally coordinated and there is no unified permission management page.
[0004] 2. Business requirements for real-time performance: In the water conservancy industry, environmental and business conditions may change rapidly, such as flood warnings or drought conditions. The real-time nature of permission configuration ensures that in these cases, relevant data can be authorized to the individuals or teams in need in a timely manner, and the authorization can take effect immediately.
[0005] 3. Business requirements for flexibility: Business requirements may change at any time. Flexible permission configuration can quickly adapt to these changes without complex system modifications. Users can also customize permission rules based on specific business needs, such as setting data access permissions based on user roles, geographic locations, or access times.
[0006] 4. Data security issues: In existing data management systems, the control of data permissions is often not detailed enough, resulting in sensitive data being accessed by unauthorized users, or anomalies in hard coding that are not easy to detect. Summary of the invention
[0007] In order to solve the above problems, the present invention provides an expression-based data permission configuration method, which can improve the compatibility, flexibility and scalability of business access, improve the operation and maintenance efficiency of operation and maintenance personnel, lower the operation and maintenance threshold, and adapt to future business growth.
[0008] In order to achieve the above object, the technical solution adopted by the present invention is:
[0009] A data permission configuration method based on an expression comprises the following steps:
[0010] S1. According to the needs of the business scenario, configure the corresponding scenario code in the permission configuration platform side, the scenario code is used to identify the service of the data query of the business service; configure the permission rules, dynamic conditions, and dynamic data permissions of each business scenario, and write the configuration data of the business scenario to the record database;
[0011] S2. When a write request is made on the business service side, the authentication attribute corresponding to the write request is injected according to the default authentication information, and the authentication attribute is written to the record database;
[0012] S3. When a query request is made on the business service side, an Aviator expression is generated according to the permission rule, and data permissions are filtered to obtain a permission range set for the data;
[0013] S4. When the limited range set contains a custom data permission range, the corresponding result set is obtained by calling the RPC interface, HTTP interface or local interface through reflection according to the custom permission rules to obtain the final permission query range; when the permission range set does not contain a custom data permission range, the permission range set is the final permission query range;
[0014] S5. The final authority query range is filtered by allowing priority or denying priority, and query data results are obtained according to the conditions of the query request and the filtered final authority query range.
[0015] Further, in step S1, the authority rules include the authority rules for querying the personnel information in the organization and the authority rules for querying the on-duty personnel information in different business scenarios for each position in each organization; the dynamic conditions are configured dynamically for the authority rules of personnel in different business scenarios through the RPC interface or the HTTP interface request path configured through the standard specification; the dynamic data permissions are configured dynamically for the authority rules of personnel in different business scenarios through the RPC interface or the HTTP interface request path configured through the standard specification;
[0016] Further, in step S2, when the injected content is the default authentication related content, the authentication attribute is written into the record database according to the write request content; when the injected content is the non-default authentication related content, the write request is written into the record database.
[0017] Furthermore, in step S3, when a query request is made on the business service side, query parameters required by the business itself for the query scope are generated according to the query request, content corresponding to data permissions is injected into the query parameters, and the RPC interface on the permission configuration platform side is called to obtain the permission rules for the business scenario.
[0018] Furthermore, whether real-time dynamic business parameters are required is determined according to the permission rules. When real-time dynamic business parameters are not required, Aviator expressions are generated according to the permission rules. When real-time dynamic business parameters are required, an RPC interface, HTTP interface or local interface is called according to the configuration data, and an Aviator expression is generated through the interface return. Permission filtering parameters are generated according to the Aviator expression, user information and calling parameters.
[0019] Furthermore, the input parameter is calculated as a Map through the Aviator expression and parsed to obtain a parsing result. The parsing result is written into the Map as the key and value respectively according to the rule parameter name, so as to be used for the data permission filtering and verification.
[0020] Further, in step S4, when there is a custom data permission range in the limited range set, the permission range result set of each configuration data is a configuration, and the configuration of the set is mapped to the final permission range result of the result set to obtain the final permission query range, where the key of the Map is the configuration number and the value of the Map is the corresponding result range.
[0021] Furthermore, in step S5, the conditions of the query request are concatenated with the filtered final permission query range to generate SQL for obtaining the final query, and a database call is made through the SQL to return the query data results to the user.
[0022] The beneficial effects of the present invention are:
[0023] Through the unified permission configuration on the permission configuration platform, the permission management process is simplified, making permission changes and audits more efficient. In addition, an intuitive and easy-to-navigate user interface is designed so that even users with non-technical backgrounds can easily manage and configure data permissions, achieving unified configuration. At the same time, the permission configuration platform provides an intuitive management interface so that users with non-technical backgrounds can easily manage and configure data permissions, improving user experience. At the same time, all permission configurations are performed on one platform, simplifying the permission management process and making permission changes and audits more efficient. The configuration of scenario coding, permission rules, dynamic conditions, and dynamic data permissions adopts detailed access standards and provides predefined configuration templates. Business systems can quickly access and configure permissions based on these templates, achieving access configuration standardization. Using configured permission configuration, you can perform visual configuration permission filtering and permission scope at a glance to ensure data security. By using an expression evaluation engine, an efficient, flexible, and easily extensible data permission filtering system is implemented. The expression introduces Aviator expressions, which support complex logic customization, allowing users to define personalized data access rules according to actual business needs. At the same time, Aviator provides a simple API, so that the system can be easily integrated into existing Java applications, whether it is a single application or a microservice architecture, it can be seamlessly integrated. And by providing a unified data permission control system, the cost of independently developing and maintaining data permission control logic for multiple systems is reduced. Business systems can quickly access the data permission control system through standardized access processes, shortening the development cycle and accelerating the speed of business launch. In query requests on the business service side, dynamic real-time calculation of permission judgment conditions and results can automatically modify permissions in emergency scenarios, ensuring that on-duty personnel can notify upper-level leaders of emergency events. It supports the ability to add and delete dynamic data permissions, ensures rapid access and efficient implementation of complex scenarios, and overcomes the disadvantages of hard coding that cannot be flexibly accessed and quickly responded to. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] Figure 1 It is a flowchart of an expression-based data permission configuration method according to a preferred embodiment of the present invention.
[0025] Figure 2 It is a data flow diagram of an expression-based data permission configuration method according to a preferred embodiment of the present invention. DETAILED DESCRIPTION
[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0027] It should be noted that when a component is referred to as being "fixed to" another component, it may be directly on the other component or there may also be a component centered. When a component is considered to be "connected to" another component, it may be directly connected to the other component or there may also be a component centered. When a component is considered to be "set on" another component, it may be directly set on the other component or there may also be a component centered. The terms "vertical", "horizontal", "left", "right" and similar expressions used herein are for illustrative purposes only.
[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.
[0029] Please also see Figure 1 and Figure 2 A preferred embodiment of the present invention is an expression-based data permission configuration method, comprising the following steps:
[0030] S1. According to the needs of the business scenario, configure the corresponding scenario code on the permission configuration platform side. The scenario code is used to identify the Service for data query of the business service; configure the permission rules, dynamic conditions, and dynamic data permissions of each business scenario, and write the configuration data of the business scenario into the record database.
[0031] In step S1, due to the complexity of business scenarios, the business party needs to configure the corresponding scenario code on the permission configuration platform before using the data permission tool. Usually, the scenario is used to identify the service of data query of a business service.
[0032] In step S1, the authority rules include the authority rules for querying the personnel information in each position in each organization and the authority rules for querying the on-duty personnel information in different business scenarios. For example, when a user whose organization is A and whose position is b triggers a flood warning in the area to which the user belongs, he can see the information data of all members under organization A and the contact information of the current on-duty personnel of the reservoir.
[0033] Dynamic conditions are used to dynamically configure personnel's permission rules in different business scenarios through RPC interfaces or HTTP interface request paths configured according to standard specifications. For example, configure RPC to call the flood warning service interface "obtain the current flood warning level of the managed reservoir based on the current user ID".
[0034] Dynamic data permissions are configured through RPC interfaces or HTTP interface request paths configured according to standard specifications to dynamically configure personnel's permission rules in different business scenarios. For example, configure RPC to call the reservoir duty service interface "obtain the user ID of the reservoir duty personnel according to the reservoir ID". You can configure the relevant RPC interface or the HTTP request path configured according to standard specifications.
[0035] After writing is completed, the administrator can view and manage business-related data permissions according to the scenario.
[0036] S2. When a write request is made on the business service side, the authentication attribute corresponding to the write request is injected according to the default authentication information, and the authentication attribute is written into the record database.
[0037] In step S2, when the injected content is the default authentication related content, the authentication attribute is written into the record database according to the write request content; when the injected content is the non-default authentication related content, the write request is written into the record database.
[0038] S3. When a query request is made on the business service side, an Aviator expression is generated according to the permission rules, and data permissions are filtered to obtain a set of data permission ranges. The Aviator expression engine provides efficient computing capabilities by compiling expressions into bytecodes and executing them by the JVM. When processing complex data permission rules, the system can also maintain a fast response, thereby improving overall performance.
[0039] In step S3, when a query request is made on the business service side, the query parameters required by the business itself for this query scope are generated according to the query request, the content corresponding to the data permissions is injected into the query parameters, and the RPC interface on the permission configuration platform side is called to obtain the permission rules for the business scenario.
[0040] Determine whether real-time dynamic business parameters are required based on permission rules. When real-time dynamic business parameters are not required, generate Aviator expressions based on permission rules. When real-time dynamic business parameters are required, call the RPC interface, HTTP interface or local interface based on the configuration data, and generate Aviator expressions through the interface returns. Generate permission filtering parameters based on Aviator expressions, user information and calling parameters.
[0041] The input parameter of Aviator expression calculation is a Map for parsing to obtain the parsing result. The parsing result is written into the Map as the key and value respectively according to the rule parameter name for data permission filtering verification. In this embodiment, the input parameter of Aviator expression is a key / value Map. Dynamic parameters and static parameters of the business itself are combined with the configured parameter name into a key and value structure and put into the Map for permission configuration hit result filtering.
[0042] Determine whether real-time dynamic business parameters are required based on the permission rules. If real-time dynamic business parameters are not required, generate Aviator expressions based on the permission rules, and generate permission filtering parameters based on the user information corresponding to the query request and the call parameters;
[0043] When real-time dynamic business parameters are needed, the RPC interface, HTTP interface or local interface is called according to the configuration data. After the RPC interface returns the result, the Aviator expression calculation input is a Map to obtain the parsing result; after the HTTP interface or local interface returns the result, the returned result is parsed according to the standard specification configuration to obtain the parsing result; the obtained parsing result is written into the Map as the key and value according to the rule parameter name for data permission filtering verification.
[0044] The dynamic data permissions in this embodiment can respond to real-time changing user or environmental characteristics, and obtain the currently required permission attributes through RPC ports, HTTP ports or local calculations. Dynamic data permissions are called through RPC ports, such as the user-managed reservoir flood warning level interface in the flood warning service; dynamic data permissions are called through RPC ports, HTTP ports or local calculations, such as other user portrait related services.
[0045] In emergency scenarios, the data query authority of the on-duty personnel needs to be temporarily increased. For example, if the rainfall is too heavy, the on-duty personnel need to notify the direct superior in time, but the direct superior is temporarily unable to respond for some reason. Through the dynamic data permissions of this embodiment, after 15 minutes of no response, the current on-duty personnel have the authority to read the contact information of the direct person in charge of the project or the superior leader. In the face of emergency scenarios, hard coding cannot be flexibly accessed and responded quickly, and this embodiment supports the ability to add and delete dynamic data permissions, which can ensure rapid access and efficient implementation of complex scenarios.
[0046] S4. When a custom data permission scope exists in the limited range set, the corresponding result set is obtained by calling the RPC interface, HTTP interface or local interface through reflection according to the custom permission rules to obtain the final permission query scope; when a custom data permission scope does not exist in the permission scope set, the permission scope set is the final permission query scope.
[0047] In step S4, when there is a custom data permission range in the limited range set, the permission range result set of each configuration data is a configuration, and the configuration of the set is mapped to the final permission range result of the result set to obtain the final permission query range, where the key of the Map is the configuration number and the value of the Map is the corresponding result range. For example, the result set of this embodiment uses the reservoir ID with flood warning as an input parameter to call the reservoir duty service to obtain the ID of the current reservoir duty personnel.
[0048] In this embodiment, the customized data permission range can be obtained through the RPC interface, HTTP interface, and local calculation to cope with the changes in real-time data and return specific data based on the current features.
[0049] S5. The final permission query range is filtered by allowing priority or denying priority, and the query data result is obtained according to the conditions of the query request and the filtered final permission query range.
[0050] In this embodiment, the default is to allow priority, and the permission configuration can also be modified to deny priority. The specific scenario is as follows. The scenario has multiple permission configurations, such as configuration a, b, and c. The result is that a can view the data created by the current user, b can view the data of the current user's affiliated organization, and c is no permission. If it is configured to allow priority, the permission scope of this request query is that both the data created by the current user and the data of the current user's affiliated organization can be viewed; if it is configured to deny priority, the permission scope of this request is no permission.
[0051] In step S5, the query request conditions are concatenated with the filtered final permission query range to generate the final query SQL, and the database is called through the SQL to return the query data results to the user.
[0052] Nouns of this embodiment are introduced as follows:
[0053] Business scenario: The scenario corresponding to the service of a business request. There may be multiple configurations in a scenario, and the relationship between configurations is OR. That is, the data permissions that a user has in a business scenario are the union of configuration A, configuration B, and configuration X.
[0054] Configuration: A set of filtering rules in a scenario. The relationship between the conditions in the configuration is AND.
[0055] Condition: Each rule filtering condition in a configuration.
Claims
1. A data permission configuration method based on expression, characterized in that: The steps include: S1. According to the needs of the business scenario, configure the corresponding scenario code in the permission configuration platform side, the scenario code is used to identify the service of the data query of the business service; configure the permission rules, dynamic conditions, and dynamic data permissions of each business scenario, and write the configuration data of the business scenario to the record database; S2. When a write request is made on the business service side, the authentication attribute corresponding to the write request is injected according to the default authentication information, and the authentication attribute is written to the record database; S3. When a query request is made on the business service side, an Aviator expression is generated according to the permission rule, and data permissions are filtered to obtain a permission range set for the data; S4. When the limited range set has a custom data permission range, the corresponding result set is obtained by calling the RPC interface, HTTP interface or local interface through reflection according to the custom permission rules to obtain the final permission query range; When the permission range set does not contain a custom data permission range, the permission range set is the final permission query range; S5. The final authority query range is filtered by allowing priority or denying priority, and query data results are obtained according to the conditions of the query request and the filtered final authority query range.
2. The method for configuring data permissions based on expressions according to claim 1, characterized in that: In step S1, the authority rules include the authority rules for querying personnel information in each organization and the authority rules for querying on-duty personnel information in different business scenarios and for each position in each organization; the dynamic conditions are configured dynamically for personnel authority rules in different business scenarios through an RPC interface or an HTTP interface request path configured according to standard specifications; the dynamic data permissions are configured dynamically for personnel authority rules in different business scenarios through an RPC interface or an HTTP interface request path configured according to standard specifications.
3. The method for configuring data permissions based on expressions according to claim 1, characterized in that: In step S2, when the injected content is the default authentication related content, the authentication attribute is written into the record database according to the write request content; when the injected content is the non-default authentication related content, the write request is written into the record database.
4. The method for configuring data permissions based on expressions according to claim 2, characterized in that: In step S3, when a query request is made on the business service side, the query parameters required by the business itself for the query scope are generated according to the query request, the content corresponding to the data permissions is injected into the query parameters, and the RPC interface on the permission configuration platform side is called to obtain the permission rules for the business scenario.
5. The method for configuring data permissions based on expressions according to claim 4, characterized in that: Determining whether real-time dynamic business parameters are required according to the authority rules, and when real-time dynamic business parameters are not required, generating an Aviator expression according to the authority rules; When real-time dynamic business parameters are needed, the RPC interface, HTTP interface or local interface is called according to the configuration data, and the Aviator expression is generated through the interface return; Generate permission filtering parameters based on Aviator expression, user information and call parameters.
6. The method for configuring data permissions based on expressions according to claim 5, characterized in that: The input parameter of the Aviator expression calculation is parsed as a Map to obtain a parsing result. The parsing result is written into the Map as the key and value respectively according to the rule parameter name, so as to be used for the data permission filtering and verification.
7. The method for configuring data permissions based on expressions according to claim 1, characterized in that: In step S4, when there is a custom data permission range in the limited range set, the permission range result set of each configuration data is a configuration, and the configuration of the set is mapped to the final permission range result of the result set to obtain the final permission query range, where the key of the Map is the configuration number and the value of the Map is the corresponding result range.
8. The method for configuring data permissions based on expressions according to claim 1, characterized in that: In step S5, the query request conditions are concatenated with the filtered final permission query range to generate a SQL for the final query, and a database call is made through the SQL to return the query data results to the user.