Access permission management method and system, electronic equipment and computer storage medium

Abstract

The invention provides an access permission management method and system, electronic equipment and a computer storage medium, and the method comprises the steps: pulling user information from a metadata cluster of a cloud data warehouse through a Ranger UserSync component, and synchronizing the user information to a Ranger Admin component; the metadata synchronization component pulls metadata information from a metadata cluster of the cloud data warehouse, and synchronizes the metadata information to the Ranger Admin component; and the Ranger Admin component carries out persistence on the user information and the metadata information to a database. The management of the access authority of the cloud data warehouse is realized through Ranger; and a Ranger and cloud data warehouse metadata synchronization component MetaDataSync component is added, so that fine-grained control and flexible management and control of the access authority of the cloud database are realized.

Description

Technical Field

[0001] The present application relates to the technical field of data authority management, and in particular to a method, system, electronic device and computer storage medium for managing access rights. Background Art

[0002] Cloud data warehouse is a new generation of data warehouse deployed and operated in cloud environment. Cloud data warehouse can be divided into three-layer architecture: management layer, computing layer and storage layer. The management layer provides tenant access portal, resource management, metadata management, transaction management, parsing and execution scheduling services; the computing layer provides and manages computing resources of different specifications and provides cache acceleration support; the storage layer provides object storage service and supports the persistence of result set cache.

[0003] After customers subscribe to database services as tenants, in order to manage and control the access rights of different types of users and different types of databases within the tenant, the main method of autonomous access control is adopted, which allows the administrator to authorize the subject to be the owner of the specified data resource. The owner has more complete operation rights over the data he owns and can assign the object operation rights he owns to related subjects.

[0004] However, the data structures and access methods of different types of databases vary greatly, and the logic of controlling the permissions of various types of users within a tenant is relatively complex. At the same time, users' requirements for security control of data at different levels and dimensions within cloud databases are gradually increasing.

[0005] In existing technologies, the complexity and flexibility of permission management may lead to configuration errors or omissions, resulting in security vulnerabilities. In addition, the segmentation of roles and the allocation of permissions may also face challenges, requiring careful design and adjustment based on specific business needs. The implementation of the authentication process is relatively complex, making it difficult to achieve fine-grained control and flexible management of access rights. Summary of the invention

[0006] In view of this, the present application provides a method, system, electronic device and computer storage medium for managing access rights to achieve fine-grained control and flexible management of access rights to a cloud database.

[0007] The first aspect of the present application provides a management system for access rights, including:

[0008] RangerAdmin component, RangerUserSync component and metadata synchronization component;

[0009] The Ranger UserSync component is used to pull user information from the metadata cluster of the cloud data warehouse and synchronize the user information to the RangerAdmin component;

[0010] The metadata synchronization component is used to pull metadata information from the metadata cluster of the cloud data warehouse and synchronize the metadata information to the RangerAdmin component;

[0011] The Ranger Admin component is used to persist the user information and the metadata information to a database.

[0012] Optionally, the access rights management system further includes:

[0013] The Ranger Admin component is also used to persist the created services and configured policies to the database; wherein the created services and configured policies are cloud data warehouse services and configured user access permission policy information created by users through Web UI or Rest API.

[0014] Optionally, the access rights management system further includes:

[0015] Ranger Plugin component; the Ranger Plugin component is deployed in the management node of the cloud data warehouse;

[0016] The RangerPlugin component is used to periodically synchronize policy information from the RangerAdmin; the Ranger Admin obtains policy information from the database and returns it to the RangerPlugin component.

[0017] Optionally, the access rights management system further includes:

[0018] When an application accesses the cloud data warehouse, the management node of the cloud data warehouse performs permission verification through RangerPlugin and obtains a verification result; wherein, the management node of the cloud data warehouse determines whether to intercept based on the verification result.

[0019] A second aspect of the present application provides a method for managing access rights, including:

[0020] The RangerUserSync component pulls user information from the metadata cluster of the cloud data warehouse and synchronizes the user information to the RangerAdmin component;

[0021] The metadata synchronization component pulls metadata information from the metadata cluster of the cloud data warehouse and synchronizes the metadata information to the RangerAdmin component;

[0022] The RangerAdmin component persists the user information and the metadata information to a database.

[0023] Optionally, the access rights management method further includes:

[0024] The RangerAdmin component persists the created services and configured policies to the database; wherein the created services and configured policies are the cloud data warehouse services and configured user access rights policy information created by the user through the Web UI or RestAPI.

[0025] Optionally, the access rights management method further includes:

[0026] The Ranger Plugin component periodically synchronizes policy information from the Ranger Admin; the Ranger Admin obtains policy information from the database and returns it to the RangerPlugin component; the RangerPlugin component is deployed in the management node of the cloud data warehouse.

[0027] Optionally, the access rights management method further includes:

[0028] When an application accesses the cloud data warehouse, the management node of the cloud data warehouse performs permission verification through RangerPlugin and obtains a verification result; wherein, the management node of the cloud data warehouse determines whether to intercept based on the verification result.

[0029] A third aspect of the present application provides an electronic device, including:

[0030] one or more processors;

[0031] a storage device having one or more programs stored thereon;

[0032] When the one or more programs are executed by the one or more processors, the one or more processors implement the access rights management method as described in any one of the second aspects.

[0033] A fourth aspect of the present application provides a storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for managing access rights as described in any one of the second aspects is implemented.

[0034] As can be seen from the above scheme, the present application provides a method, system, electronic device and computer storage medium for managing access rights. The Ranger UserSync component pulls user information from the metadata cluster of the cloud data warehouse and synchronizes the user information to the Ranger Admin component; the metadata synchronization component pulls metadata information from the metadata cluster of the cloud data warehouse and synchronizes the metadata information to the RangerAdmin component; the RangerAdmin component persists the user information and the metadata information to the database. The management of cloud data warehouse access rights is achieved through Ranger; and a MetaDataSync component, which synchronizes Ranger with the cloud data warehouse metadata, is added to achieve fine-grained control and flexible management of cloud database access rights. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0036] Figure 1 A schematic diagram of a management system for access rights adopted by an embodiment of the present application;

[0037] Figure 2 A schematic diagram of a management system for access rights adopted by another embodiment of the present application;

[0038] Figure 3 A schematic diagram of a method for managing access rights adopted in another embodiment of the present application;

[0039] Figure 4 A specific flow chart of a method for managing access rights adopted in another embodiment of the present application;

[0040] Figure 5 A schematic diagram of an electronic device for implementing a method for managing access rights according to another embodiment of the present application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0042] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0043] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0044] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0045] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0046] First of all, it should be noted that the permission control of cloud-native data warehouses is usually managed based on roles and access policies. The specific implementation method may vary depending on the service provider, but generally involves the following aspects:

[0047] 1. Role management: Cloud-native data warehouses usually support the creation of different roles, such as administrators, developers, analysts, etc. Each role can be granted a specific set of permissions to control its access to and operations on the data warehouse.

[0048] 2. Access policy: Access policies define which roles can access specific data warehouse resources and the operations that can be performed. Access policies can provide fine-grained control based on resources, operations, and conditions.

[0049] 3. Data permissions: Cloud-native data warehouses usually support permission control at the data table and column level. You can ensure data security and privacy by authorizing specific roles or users to access specific tables or columns.

[0050] 4. Audit log: Another important aspect of permission control is to record and monitor user access activities. Audit logs can help identify potential security issues and abnormal behavior.

[0051] Although the permission control mechanism of cloud-native data warehouses is relatively complete, there may still be some problems. For example, the complexity and flexibility of permission management may lead to configuration errors or omissions, resulting in security vulnerabilities. In addition, the segmentation of roles and the allocation of permissions may also face challenges, requiring careful design and adjustment according to specific business needs. The implementation of the authentication process is relatively complex, and it is difficult to achieve fine-grained control and flexible management of access rights. Therefore, the embodiment of the present application provides a management system for access rights, such as Figure 1 As shown, including:

[0052] RangerAdmin component 10 , RangerUserSync component 20 and metadata synchronization component 30 .

[0053] The Ranger UserSync component 20 is used to pull user information from the metadata cluster of the cloud data warehouse and synchronize the user information to the RangerAdmin10 component.

[0054] The metadata synchronization component 30 is used to pull metadata information from the metadata cluster of the cloud data warehouse and synchronize the metadata information to the RangerAdmin10 component.

[0055] The RangerAdmin10 component is used to persist user information and metadata information to the database.

[0056] Ranger is a centralized security management framework in the big data field that implements centralized security management of Hadoop ecosystem components. Users can use Ranger to achieve secure access to data in the cluster.

[0057] Ranger Usersync is a management module provided by Ranger, which is mainly used to synchronize user and group information on Linux machines to the Ranger Admin database for management. The main functions of Ranger Usersync include synchronizing user and group information on Linux machines to the Ranger database for centralized management and permission control.

[0058] RangerAdmin is a core component of Ranger, which provides a web user interface and RESful interface for centralized management of users, user groups, services, policies and audit management. It is responsible for the centralized storage and management of data, allowing administrators to easily configure different users or user groups to access various components in the Hadoop ecosystem (such as HDFS, Yam, Hive, Base, etc.) through configuration policies.

[0059] In the specific implementation process of the present application, the metadata synchronization component 30 may be but is not limited to MetaDataSync, which is not limited here.

[0060] Optionally, in another embodiment of the present application, an implementation of the access rights management system further includes:

[0061] The RangerAdmin component 10 is also used to persist the created services and configured policies to the database.

[0062] The created services and configured policies are the cloud data warehouse services created by users through the Web UI or RestAPI and the configured user access permission policy information.

[0063] Optionally, in another embodiment of the present application, an implementation of the access rights management system is as follows: Figure 2 As shown, it also includes:

[0064] RangerPlugin component 40.

[0065] The Ranger Plugin component refers to a plug-in component, and the Ranger Plugin component is deployed in the management node of the cloud data warehouse.

[0066] The RangerPlugin component 40 is used to periodically synchronize policy information from the RangerAdmin.

[0067] Among them, RangerAdmin obtains policy information from the database and returns it to the RangerPlugin component 40.

[0068] Optionally, in another embodiment of the present application, an implementation of the access rights management system further includes:

[0069] When an application accesses the cloud data warehouse, the management node of the cloud data warehouse performs permission verification through RangerPlugin and obtains the verification result.

[0070] Among them, the management node of the cloud data warehouse determines whether to intercept based on the verification results.

[0071] like Figure 3As shown, this is a schematic diagram of the actual application of this application. The RangerPlugin component is deployed in the management node of the cloud data warehouse, and regularly synchronizes policy information from RangerAdmin. Ranger Admin obtains policy information from the database and returns it to the RangerPlugin component. Users can create cloud data warehouse services and configure user access permission policy information through the Web UI or Rest API. The Ranger Admin component persists the created services and configured policies to the database. The Ranger UserSync component 20 is used to pull user information from the metadata cluster of the cloud data warehouse and synchronize the user information to the RangerAdmin10 component. The metadata synchronization component (MetaDataSync) pulls metadata information from the metadata cluster of the cloud data warehouse and synchronizes the metadata information to the Ranger Admin10 component. The Ranger Admin10 component persists user information and metadata information to the database.

[0072] From the above scheme, it can be seen that this application provides a management system for access rights. The Ranger UserSync component pulls user information from the metadata cluster of the cloud data warehouse and synchronizes the user information to the Ranger Admin component; the metadata synchronization component pulls metadata information from the metadata cluster of the cloud data warehouse and synchronizes the metadata information to the RangerAdmin component; the RangerAdmin component persists the user information and metadata information to the database. The management of cloud data warehouse access rights is achieved through Ranger; and a MetaDataSync component, which synchronizes the metadata between Ranger and the cloud data warehouse, is added to achieve fine-grained control and flexible management of cloud database access rights.

[0073] The present application embodiment provides a method for managing access rights, such as Figure 4 As shown, specifically including:

[0074] S401, the RangerUserSync component pulls user information from the metadata cluster of the cloud data warehouse and synchronizes the user information to the RangerAdmin component.

[0075] S402, the metadata synchronization component pulls metadata information from the metadata cluster of the cloud data warehouse and synchronizes the metadata information to the RangerAdmin component.

[0076] S403, the RangerAdmin component persists the user information and metadata information to the database.

[0077] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding system embodiment content, such as Figure 1 As shown, no further description is given here.

[0078] Optionally, in another embodiment of the present application, an implementation of the access rights management method further includes:

[0079] The RangerAdmin component persists the created services and configured policies to the database.

[0080] The created services and configured policies are the cloud data warehouse services created by users through the Web UI or RestAPI and the configured user access permission policy information.

[0081] The specific working process of the units disclosed in the above embodiments of the present application can be found in the corresponding system embodiment content, which will not be repeated here.

[0082] Optionally, in another embodiment of the present application, an implementation of the access rights management method further includes:

[0083] The RangerPlugin component periodically synchronizes policy information from RangerAdmin.

[0084] Among them, RangerAdmin obtains policy information from the database and returns it to the RangerPlugin component; the RangerPlugin component is deployed in the management node of the cloud data warehouse.

[0085] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding system embodiment content, such as Figure 2 As shown, no further description is given here.

[0086] Optionally, in another embodiment of the present application, an implementation of the access rights management method further includes:

[0087] When an application accesses the cloud data warehouse, the management node of the cloud data warehouse performs permission verification through RangerPlugin and obtains the verification result.

[0088] Among them, the management node of the cloud data warehouse determines whether to intercept based on the verification results.

[0089] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding system embodiment content, such as Figure 2 , I will not go into details here.

[0090] From the above scheme, it can be seen that this application provides a method for managing access rights. The Ranger UserSync component pulls user information from the metadata cluster of the cloud data warehouse and synchronizes the user information to the Ranger Admin component; the metadata synchronization component pulls metadata information from the metadata cluster of the cloud data warehouse and synchronizes the metadata information to the RangerAdmin component; the RangerAdmin component persists the user information and metadata information to the database. The management of cloud data warehouse access rights is achieved through Ranger; and a MetaDataSync component, which synchronizes the metadata between Ranger and the cloud data warehouse, is added to achieve fine-grained control and flexible management of cloud database access rights.

[0091] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0092] Another embodiment of the present application provides an electronic device, such as Figure 5 As shown, including:

[0093] One or more processors 501 .

[0094] The storage device 502 stores one or more programs.

[0095] When the one or more programs are executed by the one or more processors 501, the one or more processors 501 implement the access authority management method as described in any one of the above embodiments.

[0096] Another embodiment of the present application provides a computer storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the method for managing access rights as described in any one of the above embodiments is implemented.

[0097] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0098] It should be noted that the computer-readable medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0099] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0100] Another embodiment of the present application provides a computer program product. When the computer program product is executed, it is used to execute the above-mentioned access rights management method.

[0101] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0102] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in this application is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing this application.

[0103] Although several specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present application. Certain features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0104] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above application concept. For example, the above features are replaced with (but not limited to) technical features with similar functions applied in the present application.

Claims

1. A management system for access rights, characterized in that: include: RangerAdmin component, RangerUserSync component and metadata synchronization component; The RangerUserSync component is used to pull user information from the metadata cluster of the cloud data warehouse and synchronize the user information to the RangerAdmin component; The metadata synchronization component is used to pull metadata information from the metadata cluster of the cloud data warehouse and synchronize the metadata information to the RangerAdmin component; The RangerAdmin component is used to persist the user information and the metadata information to a database.

2. The access rights management system according to claim 1, characterized in that: Also includes: The Ranger Admin component is also used to persist the created services and configured policies to the database; wherein the created services and configured policies are cloud data warehouse services and configured user access permission policy information created by users through Web UI or Rest API.

3. The access rights management system according to claim 2, characterized in that: Also includes: Ranger Plugin component; the Ranger Plugin component is deployed in the management node of the cloud data warehouse; The RangerPlugin component is used to periodically synchronize policy information from the RangerAdmin; the Ranger Admin obtains policy information from the database and returns it to the RangerPlugin component.

4. The access rights management system according to claim 3, characterized in that: Also includes: When an application accesses the cloud data warehouse, the management node of the cloud data warehouse performs permission verification through RangerPlugin and obtains a verification result; wherein, the management node of the cloud data warehouse determines whether to intercept based on the verification result.

5. A method for managing access rights, characterized in that: include: The RangerUserSync component pulls user information from the metadata cluster of the cloud data warehouse and synchronizes the user information to the RangerAdmin component; The metadata synchronization component pulls metadata information from the metadata cluster of the cloud data warehouse and synchronizes the metadata information to the RangerAdmin component; The RangerAdmin component persists the user information and the metadata information to a database.

6. The method for managing access rights according to claim 5, characterized in that: Also includes: The RangerAdmin component persists the created services and configured policies to the database; wherein the created services and configured policies are the cloud data warehouse services and configured user access rights policy information created by the user through the Web UI or RestAPI.

7. The method for managing access rights according to claim 6, characterized in that: Also includes: The Ranger Plugin component periodically synchronizes policy information from the Ranger Admin; the Ranger Admin obtains policy information from the database and returns it to the RangerPlugin component; the RangerPlugin component is deployed in the management node of the cloud data warehouse.

8. The method for managing access rights according to claim 7, characterized in that: Also includes: When an application accesses the cloud data warehouse, the management node of the cloud data warehouse performs permission verification through RangerPlugin and obtains a verification result; wherein, the management node of the cloud data warehouse determines whether to intercept based on the verification result.

9. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the access authority management method as claimed in any one of claims 5 to 8.

10. A computer storage medium, characterized in that: A computer program is stored thereon, wherein when the computer program is executed by a processor, the method for managing access rights as claimed in any one of claims 5 to 8 is implemented.

Images