Database data processing method and device, computer equipment, storage medium and computer program product

Abstract

The invention relates to a database data processing method and device, computer equipment, a storage medium and a computer program product. The method comprises the steps that under the condition that a database data processing request for a target database is obtained, a database statement of the database data processing request is extracted; searching a permission policy grammar corresponding to the database processing request; generating a public table expression of the access permission corresponding to the request based on the permission policy grammar; integrating the public table expression and the database statement to obtain an authority control statement; and executing database data processing to obtain a data processing result. According to the method, the public table expression of the access permission corresponding to the database data processing request is generated, then the public table expression for controlling the access permission and the database statement are integrated, and then the corresponding database processing operation is executed, so that database views corresponding to user permissions at all levels do not need to be pre-created in the target database; the database management efficiency can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a database data processing method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the development of data technology, the demand for data permission control in databases is also growing. Database permission management refers to the process of access control and permission allocation for data in a database. Database permission management can be divided into row-level data permission control and column-level data permission control. Row-level data permission control generally refers to the system's ability to control which rows of data in a database table a user / service can access. For example, employees can only access the data of their own department, not data from other departments. Column-level data permission refers to the system's ability to control which columns of data in a database table a user / service can access, such as ordinary users can only query non-sensitive data such as user names, but not sensitive data such as user contact information. Through database permission management, it can be ensured that only authorized users can access specific databases or tables, and can only perform their authorized operations, thereby protecting sensitive data in the database from being accessed or tampered with by unauthorized personnel.

[0003] However, currently, the corresponding database view is generally created in the database root for data isolation, and the corresponding database view is created for the row permissions that each user or user role should have. However, this permission control method requires that each user or user role must create a corresponding database view, which has a small scope of application and will cause abuse of database views, making database management and maintenance difficult and affecting database management efficiency. Summary of the invention

[0004] Based on this, it is necessary to provide a database data processing method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve database management efficiency in response to the above technical problems.

[0005] In a first aspect, the present application provides a database data processing method, comprising:

[0006] When a database data processing request for a target database is obtained, extracting a database statement of the database data processing request;

[0007] Find the permission policy syntax corresponding to the database processing request;

[0008] Based on the permission policy grammar, a common table expression corresponding to the access permission of the database data processing request is generated;

[0009] Integrate the common table expression and the database statement to obtain an authority control statement;

[0010] Database data processing is performed based on the authority control statement to obtain a data processing result.

[0011] In a second aspect, the present application also provides a database data processing device, including:

[0012] A statement extraction module is used to extract the database statement of the database data processing request when a database data processing request for a target database is obtained;

[0013] A grammar search module, used to search for the authority policy grammar corresponding to the database processing request;

[0014] An expression generation module, used to generate a common table expression for the access rights corresponding to the database data processing request based on the permission policy grammar;

[0015] A statement integration module, used to integrate the common table expression and the database statement to obtain an authority control statement;

[0016] The data processing module is used to execute database data processing based on the permission control statement to obtain data processing results.

[0017] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0018] When a database data processing request for a target database is obtained, extracting a database statement of the database data processing request;

[0019] Find the permission policy syntax corresponding to the database processing request;

[0020] Based on the permission policy grammar, a common table expression corresponding to the access permission of the database data processing request is generated;

[0021] Integrate the common table expression and the database statement to obtain an authority control statement;

[0022] Database data processing is performed based on the authority control statement to obtain a data processing result.

[0023] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0024] When a database data processing request for a target database is obtained, extracting a database statement of the database data processing request;

[0025] Find the permission policy syntax corresponding to the database processing request;

[0026] Based on the permission policy grammar, a common table expression corresponding to the access permission of the database data processing request is generated;

[0027] Integrate the common table expression and the database statement to obtain an authority control statement;

[0028] Database data processing is performed based on the authority control statement to obtain a data processing result.

[0029] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0030] When a database data processing request for a target database is obtained, extracting a database statement of the database data processing request;

[0031] Find the permission policy syntax corresponding to the database processing request;

[0032] Based on the permission policy grammar, a common table expression corresponding to the access permission of the database data processing request is generated;

[0033] Integrate the common table expression and the database statement to obtain an authority control statement;

[0034] Database data processing is performed based on the authority control statement to obtain a data processing result.

[0035] The above-mentioned database data processing method, device, computer equipment, storage medium and computer program product extract the database statement of the database data processing request when the database data processing request for the target database is obtained. When the data processing request is received, the database statement in which the database is operated is first obtained. Then the permission policy syntax corresponding to the database processing request is searched; based on the permission policy syntax, a common table expression corresponding to the access right of the database data processing request is generated. By searching the permission policy syntax, a common table expression is generated to control the access right of the database access process. Finally, the common table expression and the database statement are integrated to obtain the permission control statement; database data processing is performed based on the permission control statement to obtain the data processing result, and the database data processing operation under the corresponding access right is realized. The present application generates a common table expression corresponding to the access right of the database data processing request, and then after integrating the common table expression and the database statement that control the access right, the corresponding database processing operation is performed, so that when processing the database data processing request, the target database is directly accessed through the permission control statement, and the data processing result under the corresponding access right is obtained. Without pre-creating database views corresponding to user rights at all levels in the target database, the efficiency of database management can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 An application environment diagram of a database data processing method in an embodiment;

[0038] Figure 2 A schematic diagram of a flow chart of a method for processing database data in one embodiment;

[0039] Figure 3 A schematic diagram of the permission policy syntax in one embodiment;

[0040] Figure 4 A schematic diagram of a permission policy syntax integration process in one embodiment;

[0041] Figure 5 A schematic diagram of a rights policy engine in one embodiment;

[0042] Figure 6 A schematic diagram of the permission policy syntax in another embodiment;

[0043] Figure 7 A schematic diagram of a flow chart of a database data processing system in one embodiment;

[0044] Figure 8 A flowchart of a method for processing database data using an application rights policy engine in one embodiment;

[0045] Fig. 9 is a structural block diagram of a database data processing device in one embodiment;

[0046] Fig.10 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] The database data processing method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The target database 106 can store the data that the server 104 needs to process. The target database 106 can be integrated on the server 104, or it can be placed on the cloud or other network servers. When the user wants to operate the data in the target database, such as realizing data query, data addition, data deletion and other processing, the corresponding database data processing request can be sent to the server 104 of the database access abstraction layer through the terminal 102. When the server 104 obtains the database data processing request for the target database 106, it extracts the database statement of the database data processing request; searches for the permission policy syntax corresponding to the database processing request; based on the permission policy syntax, generates the public table expression of the access rights corresponding to the database data processing request; integrates the public table expression and the database statement to obtain the permission control statement; executes the database data processing based on the permission control statement to obtain the data processing result. Finally, the data processing result is fed back to the terminal 102. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0049] In an exemplary embodiment, Figure 2As shown, a database data processing method is provided, which is applied to Figure 1 The server 104 in the example is used as an example to illustrate the method, which includes the following steps 201 to 209. Among them:

[0050] Step 201 : when a database data processing request for a target database is obtained, a database statement of the database data processing request is extracted.

[0051] The target database refers to the database that needs to be operated for the current database data processing. The user of the terminal 102 can generate a database data processing request by operating the terminal 102, so as to operate and process the data stored in the target database. The database data processing request is the request data for requesting to perform the corresponding database processing operation. The database processing request may contain the identity information of the user of the terminal 102 and the database statement used to perform the database processing operation. Database statements are programming languages ​​used to operate and manage databases. They are used to perform various tasks, such as querying data, inserting new data, updating data, and deleting data. The main types of database statements are: query statements (SELECT), insert statements (INSERT), update statements (UPDATE), delete statements (DELETE), and other DDL (Data Definition Language) statements (such as CREATE, ALTER, and DROP). Among them, the query statement (SELECT) is the most commonly used, and it is used to retrieve data from the database. The query statement can be used with various conditional clauses to accurately specify which data to return. For example, you can use the WHERE clause to filter the results, the JOIN clause to retrieve data from multiple tables, or the GROUP BY clause to group the results.

[0052] Exemplarily, the database data processing method of the present application is mainly used for the authority management of the database access process. First, when the user of the terminal 102 wants to operate the data in the database, he can send a corresponding database data processing request to the server 104, and attach the identity information of the requester as the credential of the operation in the request, and attach the database statement used to perform the data processing operation, and specify the target database of the operation. After receiving the database data processing request, the server 104 first determines the target database pointed to by the database data processing request, and extracts the database statement therein as the basic data for data processing. In one embodiment, the target database of the present application can be a SQL (Structured Query Language) database, and the database statement is an SQL statement. The server 104 of the present application accesses the database system as the database access abstraction layer of the target database, thereby realizing the database authority management during the access process without changing the view of the database of the present application.

[0053] Step 203, searching the database for the authority policy syntax corresponding to the processing request.

[0054] Among them, the permission policy syntax refers to the operation statement configured locally (or in the cloud) for permission management. The permission policy syntax can contain information such as impact, operation, resource, and constraint conditions. Impact is used to implement row and column level syntax control. It contains two values, one is the default "allow access (allow)", which is used with constraints to implement data row level permission control. The other value is "deny (deny / desensitized access)", which means masking and desensitizing the field columns in the resource field value, thus implementing data column level permission control. Operation refers to the type of database operation pointed to by the permission policy syntax, such as read operation or write operation. Resource refers to the range of data tables controlled by the permission policy syntax, for example, all data tables in the system can be specified, or part of the data tables in the database can be specified. Constraints refer to the permission conditions constrained by the current permission policy syntax.

[0055] For example, after receiving a database processing request, different users have different database access permissions. Database permission control is to control the permissions of the visitor during the database access process. Therefore, it is necessary to find the permission policy syntax corresponding to the database processing request. For example, the permission policy syntax can be found through the object identity information corresponding to the database data processing request, and the permission policy syntax can be used as the basis for data processing. In one embodiment, the configured permission policy syntax can be specifically referred to Figure 3As shown, it is a permission policy syntax written in JSON (JavaScript Object Notation) syntax. The meaning of this permission policy is that there is a constraint condition for reading all data tables in the system: the user field value to which the data belongs = the user account. Under this policy, the user can only view his own data. In another embodiment, the permission policy syntax can be expressed not only in JSON data format, but also in other data formats, such as Extensible Markup Language (XML).

[0056] Step 205: Generate a common table expression corresponding to the access rights of the database data processing request based on the permission policy grammar.

[0057] Exemplarily, Common Table Expressions (CTE) is a method of defining a temporary result set in a database that can be referenced during the execution of a single query. Common table expressions improve the readability and structure of queries, and are particularly suitable for complex subqueries and recursive queries. In the scheme of the present application, common table expressions are mainly used to implement permission management in the database data processing process. Common table expressions are constructed using permission policy syntax, and the constructed common table expressions correspond to the access permissions of database data processing requests. In other words, it is equivalent to defining and generating a temporary common table through common table expressions. All data in the table are table data that the user’s data permissions should have, and do not contain other data for which any user or user role does not have data permissions. The execution data scope of the database data processing request is narrowed from the entire table to the data table scope of the user’s data permissions, thereby implementing non-isolated row and column level data permission control. In one of the embodiments, for Figure 3 The listed permission policy syntax, after being converted into a common table expression, corresponds to "WITH project table_CTE AS (SELECT* FROM project table WHERE data owner = current access user account)". Through the common table expression, the data scope of the original database data processing request query can be narrowed from the entire table range to the range that only includes the user's own data.

[0058] Step 207, integrating the common table expression and the database statement to obtain the permission control statement;

[0059] Step 209, executing database data processing based on the authority control statement to obtain a data processing result.

[0060] Among them, the permission control statement refers to a new database statement obtained by integrating the public table expression and the database statement. In the permission control statement, the public table expression can specify the data range that can be operated under the user's access rights, and the database statement performs the corresponding database operation within the data range indicated by the public table expression.

[0061] Exemplarily, after obtaining a common table expression, the common table expression can define and generate a temporary common table when executed, and all the data in the table are table data that the user's data authority should have. The database statement is used to indicate a specific processing operation, so the common table expression and the database statement can be integrated to obtain a permission control statement. Based on the permission control statement, database data processing is performed to obtain a data processing result. Thus, in the temporary common table defined and generated by the common table expression, corresponding database data processing is performed, such as for data query processing, reading corresponding data from the temporary common table as the data processing result. For data query processing, the corresponding data is deleted from the temporary common table, and then synchronized to the original data table as the final data processing result.

[0062] In the above database data processing method, when a database data processing request for a target database is obtained, a database statement of the database data processing request is extracted. When a data processing request is received, the database statement for operating the database is first obtained. Then the permission policy syntax corresponding to the database processing request is searched; based on the permission policy syntax, a common table expression corresponding to the access right of the database data processing request is generated. By searching the permission policy syntax, a common table expression is generated to control the access right of the database access process. Finally, the common table expression and the database statement are integrated to obtain the permission control statement; database data processing is performed based on the permission control statement to obtain the data processing result, and the database data processing operation under the corresponding access right is realized. The present application generates a common table expression corresponding to the access right of the database data processing request, and then after integrating the common table expression and the database statement for controlling the access right, the corresponding database processing operation is performed, so that when processing the database data processing request, the target database is directly accessed through the permission control statement, and the data processing result under the corresponding access right is obtained. Without pre-creating database views corresponding to user rights at all levels in the target database, the efficiency of database management can be effectively improved.

[0063] In an exemplary embodiment, step 203 includes: extracting the request object identity information contained in the database data processing request; performing permission policy lookup processing based on the request object identity information to obtain the permission policy syntax corresponding to the request object identity information.

[0064] The request object identity information refers to the information attached to the database data processing request, which is used to indicate the identity of the object submitting the request. The request object identity information may include the user identity code (identity ID), the user request address (address IP), the user's region, etc. The request object identity information and the saved permission policy syntax can be used to perform policy lookup based on the request object identity information to determine the permission policy syntax corresponding to the request object identity information.

[0065] Exemplarily, the access rights set by the permission policy grammar need to match the database processing request. Therefore, it is necessary to extract the request object identity information contained in the database data processing request, and then find the corresponding permission policy grammar based on the request object identity information. For example, in a specific embodiment, different levels of permissions are set for different users accessing the database, and the database data that can be accessed by each permission is different, and the corresponding permission policy grammar is also different. At this time, after obtaining the request object identity information, the user permission level corresponding to the request object identity information can be identified, and then the permission policy grammar of the permission level can be found. In addition, in another embodiment, different levels of permission policy grammars can be set for users in different regions accessing the database. At this time, after obtaining the request object identity information, the region to which the request object identity information identifies the user can be identified, and then the permission policy grammar matching the region can be found. These permission policies are defined by the business party using them according to the needs of the specific database business. The policies can be stored in cloud platforms, local files, databases, etc. When a database data processing request is received, the permission policy grammar corresponding to the request object identity information can be found from the policy storage location. In this embodiment, the corresponding permission policy syntax is searched by requesting the object identity information, thereby achieving a high degree of match between the permission policy syntax and the user access rights, ensuring the efficiency and accuracy of the data access processing process, and reducing the risk of unauthorized access to data.

[0066] In one embodiment, the method further includes: obtaining a permission policy grammar loading request for a target database; extracting the original permission policy grammar in the permission policy grammar loading request; and classifying and merging the original permission policy grammar based on the existing permission policy grammar of the target database.

[0067] For example, the original permission policy syntax refers to the permission policy syntax written by the user and imported into the system through the permission policy syntax loading request. These original permission policy syntaxes are imported one after another. For some large databases, there may be hundreds or thousands of permission policy syntaxes imported, and some of them may have the problem of repeated permission settings. Therefore, it is necessary to implement the following Figure 4The policy grammar integration process shown includes processes such as loading policy grammar, deleting policy grammar, and updating policy grammar. For example, permissions are divided into C, B, and A from bottom to top, and then in an original permission policy grammar set earlier, users with permissions of A can refer to the data in Table 1 and Table 2, and in another original permission policy grammar set later, it is described that users with permissions of B or above can access Table 1 and Table 2. At this time, there are duplicates in the two original permission policy grammars. Therefore, in the import scenario of the original permission policy grammar, a classification and merging process can be performed based on the existing permission policy grammar of the target database to achieve de-duplication and integration of the permission policy grammar, and the final permission policy grammar is obtained by de-duplication and integration of the original permission policy grammar submitted by the user before and after. In this embodiment, the number of permission policy grammars can be reduced by de-duplication and integration of the original permission policy grammar, thereby improving the efficiency and accuracy of the subsequent generation of common table expressions.

[0068] In a further embodiment, based on the permission policy grammar of the target database, the original permission policy grammar is classified and merged, including: extracting the classification field value in the original permission policy grammar; classifying the original permission policy grammar based on the classification field value to determine the classification result of the original permission policy grammar; obtaining the constraint field value of the original permission policy grammar and the existing permission policy grammar in each classification result; and merging the permission policy grammar in the classification result based on the constraint field value.

[0069] Exemplarily, in the process of classification and merging, classification and merging can be performed based on the field values ​​in the permission policy syntax. Field values ​​may include classification field values ​​and constraint field values, wherein the classification field values ​​are used to implement classification processing, and the constraint field values ​​are used to implement merging processing. The permission policy syntax may contain field information such as impact, operation, resource, and constraint conditions, and the classification field values ​​may specifically include impact fields, operation fields, and resource fields, while the constraint field refers to the field information of the constraint conditions. In the classification process, the classification field values ​​in the syntax can be extracted, and then the classification process can be performed based on the classification field values, and the original permission policy syntax can be classified together with the existing permission policy syntax containing the same classification field values. In a specific embodiment, the classification process can be hierarchically classified based on the impact field, the operation field, and the resource field. In the first step, the permission policies with the same value (allow-column level or deny-row level) of the impact field are first classified. Further, the permission policies whose operation fields have the same value or the value is included (SELECT, INSERT, etc.) are classified. For example, if the operation field value of permission policy A is: ["SELECT", "INSERT"], and the operation field value of permission policy B is ["SELECT"], then permission policy B will also be classified together with permission policy A. Finally, the permission policies whose resource fields have the same value or the value is included are classified. For example, if the resource field value of permission policy A is: ["Project table 1 / all fields", "Project table 2 / all fields"], and the operation field value of permission policy B is ["Project table 1 / field a", "Project table 1 / field b", "Project table 2 / field a"], then permission policy B will also be classified together with permission policy A. Through hierarchical classification processing, the original permission policy syntax can be effectively assigned to the category of the existing permission policy syntax that is closest to it, thereby improving the accuracy of the merge processing.

[0070] Furthermore, for the merging process, the merging is specifically performed based on the constraint field values ​​in the classification results. The constraint field values ​​of the original permission policy syntax and the existing permission policy syntax in each classification result can be obtained first; and the permission policy syntax in the classification results can be merged based on the constraint field values. That is, the permission policies under each classification whose constraint conditions have the same value or whose values ​​are included are merged.

[0071] There are inclusion and intersection relationships between constraints. When the constraint field value represents the inclusion relationship between the permission policy grammars in the classification result, the permission policy grammar included in the classification result is deleted to obtain the permission policy grammar after the merge process. For example, in a specific embodiment, the constraint field value of permission policy A is: ["management level>=10"], and the operation field value of permission policy B is ["management level=11", "management level=21", "management level=31"], then permission policy B is merged into permission policy A, that is, A includes B. Permission policy B is directly deleted, and only permission policy A is retained to complete the merging process.

[0072] In the case where the constraint field value represents that there is an intersection relationship between the permission policy grammars in the classification result, the permission policy grammars with the intersection relationship in the classification result are subjected to a union process to obtain the permission policy grammar after the merger process. If there is an intersection relationship, it means that there is a certain overlap in the permission policy grammars in the classification result. In order to obtain a new permission policy that can integrate all constraint conditions, the permission policy grammars with the intersection relationship can be subjected to a union process. The union here refers to the union of the constraint relationship of two permission policy grammars. For example, in a specific embodiment, the constraint field value of permission policy A is: ["management level>=10"], and the operation field value of permission policy B is ["management level=8", "management level=21", "management level=31"], then permission policy B will be merged with permission policy A, that is, the union of A and B is taken, that is, permission policies A and B are deleted, and a new permission policy C is generated, whose constraint field value is: ["management level>=10"] || ["management level=8"]. In this embodiment, the permission policy grammars in the classification results are merged according to the relationship between the constraint conditions of the permission policy grammars, thereby reducing the number of permission policy grammars, effectively improving the processing efficiency while ensuring the processing accuracy.

[0073] In an exemplary embodiment, step 203 includes: searching for all target permission policy grammars corresponding to the database processing request; obtaining the execution priority of each target permission policy grammar; and determining the target permission policy grammar with the highest execution priority as the permission policy grammar corresponding to the database processing request.

[0074] Exemplarily, different permission policy grammars can be set with different execution priorities. When a database processing request is received, a database processing request may correspond to multiple permission policy grammars. At this time, these permission policy grammars can be completed according to the execution priority, and the final permission policy grammar can be screened out as the basis for the database processing operation. The execution priority is a hidden field of the permission policy grammar. When multiple policies conflict, the one with a high priority is executed, and the one with a low priority is not executed. In a specific embodiment, the execution priority can be set in different ways: one is active setting: directly specify the priority (0-100) of the permission policy in the permission policy grammar, and the larger the value, the higher the priority (if the priority is the same, the permission policy loaded later is executed). The second is passive setting, that is, during the loading process of the permission policy, the permission policy engine will set the priority of the conflicting permission policies according to the order in which the permission policies are loaded, and the later the permission policies loaded are, the higher the priority. By setting the execution priority, when the permission policy grammar conflicts, the conflict can be effectively overcome, and a suitable permission policy can be screened out for execution to ensure the execution effect of the permission policy.

[0075] In an exemplary embodiment, step 205 includes: identifying the logical relationship between the calculation type, operator and constraint conditions of the permission policy grammar corresponding to each permission policy grammar; performing statement generation processing based on the calculation type, operator and logical relationship to obtain a common table expression of the access rights corresponding to the permission policy grammar.

[0076] Exemplarily, the calculation type of the permission policy syntax refers to the data type involved in the permission policy syntax, such as array data, integer data, etc. The operator is an operator such as greater than or less than, and the logical relationship between the constraints specifically includes an OR relationship between different constraints, or an AND relationship between different constraints. The generation process of the common table expression can be implemented by a dedicated syntax translator. In one embodiment, Figure 5 As shown, the present application can implement permission policy management through the permission policy engine. After completing the policy grammar integration processing, the SQL query request initiated by the user can be processed through the integrated permission policy grammar. The public table expression is obtained by combining the grammar logic calculation with the grammar translator and the user's access rights. Figure 3The listed permission policy syntax can be converted into a SQL common table expression "WITH project table_CTE AS (SELECT * FROM project table WHERE data owner = current access user account)", where project table_CTE is the common table obtained by narrowing the scope from the project table. In this embodiment, the permission policy syntax is converted into a common table expression through calculation type, operator and logical relationship, which can effectively improve the efficiency and accuracy of implementing permission control based on the common table expression.

[0077] In an exemplary embodiment, statement generation processing is performed based on calculation types, operators, and logical relationships to obtain a common table expression of access rights corresponding to the permission policy syntax, including: based on the calculation type and operator, creating sub-computation units of different calculation types corresponding to the permission policy syntax through factory class methods; performing syntax translation processing on the sub-computation units of different calculation types to obtain syntax translation results of each sub-computation unit; integrating the syntax translation results based on logical relationships to obtain syntax integration results; obtaining table name data and field name data corresponding to resource fields in the permission policy syntax; and converting the syntax integration results into a common table expression of access rights corresponding to the permission policy syntax based on the table name data and field name data.

[0078] Exemplarily, for the factory class method, the factory class method is a creational design pattern, which provides a method for creating an object in the parent class, allowing the subclass to determine the type of instantiated object. In the scheme of the present application, for the process of translating the permission policy grammar into a common expression, it is mainly divided into calculation types, operators and logical relationships, and then processed separately. For the calculation type and operator, the sub-calculation units of different calculation types corresponding to the permission policy grammar are created through the factory class method. For example, a permission policy grammar contains two calculation types, namely string type and number type, then a sub-calculation unit can be generated for each of these two types, and the operator of each sub-calculation unit can be set. For different sub-calculation units, the grammar translation can be processed separately. The translation specifically refers to taking the corresponding value of the calculation unit from the context, and then filling it into the calculation unit to obtain the converted grammar translation result. The translation of all sub-calculation units is combined and integrated together, which is the grammar integration result. After the grammar integration is completed, it is also necessary to convert the integrated grammar into a data public table expression that can be used to operate the database. At this time, you can obtain the table name data and field name data corresponding to the resource field in the permission policy syntax; based on the table name data and field name data, convert the syntax integration result into a public table expression corresponding to the access rights of the permission policy syntax. This process mainly converts the corresponding content in the syntax integration result into specific table names and field names. By embedding the table name and field name into the integrated syntax, the final public table expression can be converted.

[0079] In a specific embodiment, the process of syntax translation specifically includes:

[0080] (1) Take out the permission policy with the highest priority under the same resource, operation type, and impact (allow, deny) in the current request as the basic data for generating the common table expression. The syntax of the permission policy used in this embodiment can specifically refer to Figure 6 as shown.

[0081] (2) For the above permission policy syntax, two sub-computation units X and Y are generated by the permission policy matching engine through the factory class method. Among them, the computation type of sub-computation unit X is string type, the operator is equal, and the computation type of Y is numeric type, and the operator is greater_than.

[0082] (3) There are 1 smallest computation units x1 and x2 in the X computation unit. Among them, the field name of x1 is field a, corresponding to field a in the data table, the field value is $staff_name (here the $ sign represents a variable, and the engine will take out the corresponding value from the context, such as "Zhang San"), and the operator is =. The field name of x2 is field b, corresponding to field b in the data table, and the field value is $city_name (here the $ sign represents a variable, and the engine will take out the corresponding value from the context, such as "Place A").

[0083] (4) The Y computation unit has a smallest computation unit y. The field name of y is field c, corresponding to field c in the data table, the field value is 10, and the operator is > (here there can also be multiple smallest computation units y1, y2, y3... etc. in the Y computation unit).

[0084] (5) At this time, the syntax translator starts to work. Starting from the smallest computation unit x1, the smallest computation unit x1 outputs 'field a = "Zhang San"', and the smallest computation unit x2 outputs 'field b = "Place A". The computation unit X integrates x1 and x2 and outputs '(field a = "Zhang San" and field b = "Place A")'.

[0085] (6) Since Y has only one smallest computation unit y, it outputs field c > 10.

[0086] (7) At this time, the computation module will integrate the syntax outputs of the sub-computation units X and Y according to the logical relationship of the syntax, and finally will output: (field a = "Zhang San" and field b = "Place A") and field c > 10.

[0087] (8) The syntax translator obtains the table name of the requested query SQL: t_project and the corresponding field names a, b, c, d according to the resource field in the permission policy syntax, and starts to generate the corresponding CTE based on the output of the calculation module. The generation formula is: WITH {table name}_CTEAS(SELECT {field} FROM {table name} WHERE {limitation condition output by the calculation module}).

[0088] Furthermore, the process of finally generating a common expression specifically includes: generating a table name prefix of the common table expression based on the table name data; converting the syntax integration result into the database processing statement and processing restriction condition of the common table expression based on the table name data and the field name data; splicing the table name prefix, the database processing statement and the processing restriction condition to obtain the common table expression of the access rights corresponding to the permission policy syntax. The statement and condition are converted through the table name and field name, and then spliced ​​and combined to obtain the final common table expression. For the above Figure 6 The common table expression generation process of the corresponding embodiment first generates a fixed CTE definition prefix according to the table name: WITH t_project_CTE AS, and then generates a standard query statement SELECT field name a, field b, field c, field d FROM t_project according to the table name and field name, and then generates an SQL restriction condition WHERE (field a="Zhang San and field b="Adi") and field c > 10 according to the output of the calculation module. The final generated CTE is: WITH t_project_CTE AS (SELECT field name a, field b, field c, field d FROM t_project WHERE (field a="Zhang San and field b="Adi") and field c > 10). In this embodiment, the calculation type, operator and logical relationship are combined to achieve accurate translation of the permission policy syntax, and the obtained common table expression can meet the access permission setting requested by the user, thereby ensuring the efficiency and accuracy of database data processing request processing.

[0089] In an exemplary embodiment, step 207 includes: identifying the common table name in the common table expression and the operation table name in the database statement; replacing the operation table name in the database statement with the common table name to obtain a table name replacement statement; splicing the common table expression and the table name replacement statement to obtain a permission control statement.

[0090] Exemplarily, the public table name refers to the table name of the data table constructed by the public table expression. The public table expression is a method for defining a temporary result set in the database. The result set can be referenced during the execution of a single query. In the scheme of the present application, the temporary result set defined is the public table, and the table name of the temporary result set is the public table name. The operation table name in the database statement refers to the table name of the data table that the original database statement needs to operate. After identifying and extracting the two table names, the operation table name in the original database statement can be replaced with the public table name, so that the operation object of the database statement is replaced with the public table constructed by the public table expression, and the public table is all data extracted based on user access rights. Then the public table expression and the table name replacement statement are spliced ​​to obtain the permission control statement. In this way, after executing the public table expression to extract the public table, the data statement after the table name is replaced is executed. The operation object of the database statement is switched to the public table. All the data in the public table are table data that the user's data authority should have, and do not contain any other data that any user or user role does not have data authority, thereby effectively realizing the database processing operation under permission control. In one embodiment, the original database statement is "SELECT * FROM project table where data belongs to user = $input_user group by project level having project level > 2 order byid desc limit 0,1". Figure 3 After the permission policy syntax is processed, the corresponding common table expression is "WITH project table_CTE AS (SELECT * FROM project table WHERE data belongs to user = current access user account)". After replacing the operation table name in the statement with the common surface and splicing, the obtained permission control statement is "WITH project table_CTE AS (SELECT * FROM project table WHERE data belongs to user = current access user account) SELECT *FROM project table_CTE where data belongs to user = $input_user group by project level having project level> 2 order by id desc limit 0,1".

[0091] As for the process of executing the database data processing operation, the target database can obtain the corresponding database processing operation by executing the database statement on the data table of the common table name. In a specific embodiment, the access rights can be specifically divided into row-level rights and column-level access rights. The row-level data permission control generally refers to which row data in the database table the system can control the user / service to access. Column-level data permission refers to which column data in the database table the system can control the user / service to access. The present application specifically implements the control processing of row and column-level access rights when applied. At this time, for the common table expression, the data table of the common table name extracted is constructed by executing the common table expression by the target database, and extracting the row data or column data in the data table of the operation table name. When the permission policy syntax is used to implement the row-level data permission control, the common table expression is used to extract the row data in the data table of the operation table name to construct the common table. When the permission policy syntax is used to implement the column-level data permission control, the common table expression is used to extract the column data in the data table of the operation table name to construct the common table. In this embodiment, the permission control statement is obtained by replacing the operation table name and concatenating the statements, and the obtained permission control statement can effectively execute the database processing corresponding to the access rights in the target database, and realize efficient database access rights management. This solution does not require rewriting the original database statement, avoiding complex judgment scenarios such as many keywords and subqueries in the original database statement. The logic is clear and simple, there will be no missed judgment, and the reliability is high. In addition, this solution is implemented in the database access abstraction layer, without changing the application layer code, and has strong versatility, solving the problems of poor reliability, weak versatility, and high maintenance cost of existing data permission control solutions.

[0092] In an exemplary embodiment, the database data processing request includes a database data query request. Step 209 includes: initiating a data query request to a target database based on the authority control statement, and obtaining a data processing result of the target database executing the data query request.

[0093] For example, a database data processing request can be specifically used to request to query data in a target database. At this time, for the database processing request, the database query statement contained in it can be converted into a permission control statement corresponding to the access permission. The permission control statement can extract the query result from the data it can access. By outputting the modified permission control statement to the target database to initiate a data query request to the target database, the data processing result of the target database executing the data query request can be obtained, and finally the data query result is returned. At this time, the overall scheme of this application can refer to Figure 7As shown. In other embodiments, the present application can also be applied to data addition processing, data modification processing or data deletion processing. For data addition processing, after obtaining the corresponding permission control statement, for data addition processing, the newly added data can be inserted into the data table of the access permission. For data modification processing, the original data can be inserted and modified in the data table of the access permission. For data deletion processing, the original data can be inserted and deleted in the data table of the access permission. These operations all involve the data corresponding to the access permission, and have no effect on the data outside the access permission. The present application uses common table expressions to implement permission control processing for various types of database processing operations, which can effectively improve database management efficiency.

[0094] The application also provides an application scenario, which applies the above-mentioned database data processing method. Specifically, the application of the database data processing method in this application scenario is as follows:

[0095] The user currently operates a system A. It is expected that the users of the system can only view their own data and cannot view the data of other users. However, there is a horizontal unauthorized vulnerability in the system interface, which allows the user to unauthorizedly view the data of other users of the system. The database data processing method of this application can now be used to converge permissions.

[0096] Regarding system vulnerabilities, the system currently has an interface "api-1" that has a horizontal privilege escalation vulnerability. The interface accepts an input parameter "$input_user": user account, and then executes SQL queries based on the input parameter. The original SQL is: "SELECT * FROM project table where data belongs to user = $input_user group by project level having project level > 2 order by id desc limit 0,1", and queries the project table data whose user is $input_user. Since external input parameters are uncontrollable, external attackers can change $input_user to the user account of other users to achieve unauthorized access to other users' data. The database data processing method of the present application constructs permission access statements based on common table expressions for database access, which can effectively avoid the above-mentioned horizontal privilege escalation vulnerability.

[0097] This application is specifically deployed in the data access abstraction layer, and is implemented by introducing the permission policy engine and the data access abstraction layer SDK plug-in into the code to avoid the above-mentioned horizontal unauthorized access vulnerability. Figure 3The permission policy shown in the figure imposes constraints on the reading of all data in the database system: the value of the user field to which the data belongs = the user account, so that users can only view their own data. Then, the permission policy syntax is loaded into the permission policy engine. When the user initiates a query request for the project table in the database through an SQL query statement, the permission policy engine can Figure 3 The user's permission policy is converted into a common table expression "WITH project table_CTE AS (SELECT * FROM project table WHERE data belongs to user = current access user account)". The conversion process includes: based on the calculation type and operator, create sub-calculation units of different calculation types corresponding to the permission policy syntax through the factory class method; perform syntax translation processing on the sub-calculation units of different calculation types to obtain the syntax translation results of each sub-calculation unit; integrate the syntax translation results based on logical relationships to obtain the syntax integration results; obtain the table name data and field name data corresponding to the resource field in the permission policy syntax; based on the table name data, generate the table name prefix of the common table expression; based on the table name data and field name data, convert the syntax integration results into the database processing statement and processing restriction conditions of the common table expression; splice the table name prefix, database processing statement and processing restriction conditions to obtain the common table expression of the access rights corresponding to the permission policy syntax. Through the common table expression, the data range of the user's original SQL query is narrowed from the entire table range to the range that only includes the user's own data. After that, the data access abstraction layer integrates the original SQL query statement of the interface with the common table expression. First, the common table expression CTE will be added to the front of the original SQL to obtain "WITH project table_CTE AS (SELECT * FROM project table WHERE data belongs to user = current access user account) SELECT * FROM project table where data belongs to user = $input_user group by project level having project level> 2 order by id desclimit 0,1", and then the table name of the original SQL query statement: "project table" is changed to the common table after the data range is narrowed: "project table", thereby completing the narrowing of the SQL query data range without changing the restriction conditions of the original SQL. Finally, the integrated SQL initiates a request to the database service and returns the result. The result only contains the data of the current access user account, completing the authority convergence of all interfaces with horizontal unauthorized access risks in the system. Through the database data processing of this application, the risk of data unauthorized access is effectively reduced, and there is no need to create new views related to various rights in the database, effectively ensuring the efficiency of database data processing.

[0098] In addition, users can import new permission policy grammars through permission policy grammar loading requests to adapt to changes in the database. At this time, after obtaining the permission policy grammar loading request for the target database; extract the original permission policy grammar in the permission policy grammar loading request; extract the classification field value in the original permission policy grammar; classify the original permission policy grammar based on the classification field value to determine the classification result of the original permission policy grammar; obtain the constraint field value of the original permission policy grammar and the existing permission policy grammar in each classification result; when the constraint field value represents that there is an inclusion relationship between the permission policy grammars in the classification result, delete the permission policy grammar included in the classification result to obtain the merged permission policy grammar; when the constraint field value represents that there is an intersection relationship between the permission policy grammars in the classification result, perform union processing on the permission policy grammars with the intersection relationship in the classification result to obtain the merged permission policy grammar.

[0099] In another embodiment, the present application is used to control the user to read only the data in his own area. In this case, the complete flowchart can be referred to Figure 8 As shown. First, you need to introduce the permission policy engine and load the corresponding permission policy. Then, for the imported permission policy syntax, you can use the syntax conversion translator to convert it into a CTE common table expression. At the same time, for the database data processing request entered by the user, you can use the SDK deployed in the data access abstraction layer to parse the database statement SQL, and then integrate the CTE common table expression and the database statement SQL, and then query in the database, so that you can get all the data in the user's region that meets the user's access rights.

[0100] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0101] Based on the same inventive concept, the embodiment of the present application also provides a database data processing device for implementing the database data processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more database data processing device embodiments provided below can refer to the limitations on the database data processing method above, and will not be repeated here.

[0102] In an exemplary embodiment, Fig. 9 As shown, a database data processing device is provided, comprising:

[0103] The statement extraction module 902 is used to extract the database statement of the database data processing request when a database data processing request for the target database is obtained.

[0104] The grammar search module 904 is used to search for the authority policy grammar corresponding to the database processing request.

[0105] The expression generation module 906 is used to generate a common table expression corresponding to the access rights of the database data processing request based on the permission policy grammar.

[0106] The statement integration module 908 is used to integrate the common table expressions and database statements to obtain permission control statements.

[0107] The data processing module 910 is used to perform database data processing based on the authority control statement to obtain data processing results.

[0108] The above-mentioned database data processing device extracts the database statement of the database data processing request when the database data processing request for the target database is obtained. When the data processing request is received, the database statement for operating the database is first obtained. Then the permission policy syntax corresponding to the database processing request is searched; based on the permission policy syntax, a common table expression corresponding to the access right of the database data processing request is generated. By searching the permission policy syntax, a common table expression is generated to control the access right of the database access process. Finally, the common table expression and the database statement are integrated to obtain the permission control statement; database data processing is performed based on the permission control statement to obtain the data processing result, and the database data processing operation under the corresponding access right is realized. The present application generates a common table expression corresponding to the access right of the database data processing request, and then after integrating the common table expression and the database statement that control the access right, the corresponding database processing operation is performed, so that when processing the database data processing request, the target database is directly accessed through the permission control statement, and the data processing result under the corresponding access right is obtained. Without pre-creating database views corresponding to user rights at all levels in the target database, the efficiency of database management can be effectively improved.

[0109] In one embodiment, a classification and merging module is also included, which is used to: obtain a permission policy grammar loading request for a target database; extract the original permission policy grammar in the permission policy grammar loading request; and classify and merge the original permission policy grammar based on the existing permission policy grammar of the target database.

[0110] In one embodiment, the classification merging module is specifically used to: extract the classification field value in the original permission policy syntax; classify the original permission policy syntax based on the classification field value to determine the classification result of the original permission policy syntax; obtain the constraint field value of the original permission policy syntax and the existing permission policy syntax in each classification result; merge the permission policy syntax in the classification result based on the constraint field value.

[0111] In one embodiment, the classification merging module is specifically used to: when there is an inclusion relationship between the permission policy grammars in the classification results represented by the constraint field values, delete the permission policy grammars included in the classification results to obtain the merged permission policy grammar; when there is an intersection relationship between the permission policy grammars in the classification results represented by the constraint field values, perform union processing on the permission policy grammars with the intersection relationship in the classification results to obtain the merged permission policy grammar.

[0112] In one embodiment, the grammar search module 904 is specifically used to: search for all target permission policy grammars corresponding to the database processing request; obtain the execution priority of each target permission policy grammar; and determine the target permission policy grammar with the highest execution priority as the permission policy grammar corresponding to the database processing request.

[0113] In one embodiment, the expression generation module 906 is specifically used to: identify the calculation type of the permission policy grammar, the logical relationship between the operator and the constraint conditions of the permission policy grammar; perform statement generation processing based on the calculation type, operator and logical relationship to obtain a common table expression of the access rights corresponding to the permission policy grammar.

[0114] In one embodiment, the expression generation module 906 is specifically used to: create sub-computation units of different calculation types corresponding to the permission policy syntax through factory class methods based on the calculation type and operator; perform syntax translation on the sub-computation units of different calculation types to obtain syntax translation results of each sub-computation unit; integrate the syntax translation results based on logical relationships to obtain syntax integration results; obtain table name data and field name data corresponding to resource fields in the permission policy syntax; based on the table name data and field name data, convert the syntax integration results into a common table expression of the access rights corresponding to the permission policy syntax.

[0115] In one embodiment, the expression generation module 906 is specifically used to: generate a table name prefix of a common table expression based on table name data; convert the syntax integration result into a database processing statement and processing restriction conditions of the common table expression based on table name data and field name data; and concatenate the table name prefix, database processing statement and processing restriction conditions to obtain a common table expression of access rights corresponding to the permission policy syntax.

[0116] In one embodiment, the statement integration module 908 is specifically used to: identify the common table name in the common table expression and the operation table name in the database statement; replace the operation table name in the database statement with the common table name to obtain a table name replacement statement; splice the common table expression and the table name replacement statement to obtain a permission control statement.

[0117] In one embodiment, the database data processing request includes a database data query request. The data processing module 910 is specifically used to: initiate a data query request to the target database based on the authority control statement, and obtain a data processing result of the target database executing the data query request.

[0118] Each module in the above database data processing device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0119] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig.10 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store various types of data involved in the database data processing process. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a database data processing method is implemented.

[0120] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0121] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0122] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0123] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in the above-mentioned method embodiments.

[0124] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0125] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0126] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0127] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A database data processing method, characterized in that: The method comprises: When a database data processing request for a target database is obtained, extracting a database statement of the database data processing request; Find the permission policy syntax corresponding to the database processing request; Based on the permission policy grammar, a common table expression corresponding to the access permission of the database data processing request is generated; Integrate the common table expression and the database statement to obtain an authority control statement; Database data processing is performed based on the authority control statement to obtain a data processing result.

2. The method according to claim 1, characterized in that The method further comprises: Obtaining a permission policy syntax loading request for the target database; Extracting the original permission policy syntax in the permission policy syntax loading request; Based on the existing permission policy syntax of the target database, the original permission policy syntax is classified and merged.

3. The method according to claim 2, characterized in that The classifying and merging the original permission policy syntax based on the permission policy syntax of the target database includes: Extracting the classification field value in the original permission policy syntax; Classify the original rights policy grammar based on the classification field value to determine the classification result of the original rights policy grammar; Obtain the constraint field values ​​of the original permission policy syntax and the existing permission policy syntax described in each classification result; The permission policy syntax in the classification result is merged based on the constraint field value.

4. The method according to claim 3, characterized in that The merging process of the permission policy syntax in the classification result based on the constraint field value includes: In the case where the constraint field value represents an inclusion relationship between the rights policy grammars in the classification result, deleting the rights policy grammars included in the classification result to obtain a merged rights policy grammar; In the case where the constraint field value represents that there is an intersection relationship between the rights policy grammars in the classification result, a union process is performed on the rights policy grammars in the classification result that have an intersection relationship to obtain a merged rights policy grammar.

5. The method according to claim 1, characterized in that The syntax of searching for the authority policy corresponding to the database processing request includes: Find all target permission policy syntaxes corresponding to the database processing request; Get the execution priority of each target permission policy syntax; Determine the target permission policy grammar with the highest execution priority as the permission policy grammar corresponding to the database processing request.

6. The method according to claim 1, characterized in that The generating, based on the permission policy grammar, a common table expression corresponding to the access permission of the database data processing request comprises: Identify the logical relationship between the calculation type, operator and constraint conditions of the permission policy grammar; A statement generation process is performed based on the calculation type, the operator, and the logical relationship to obtain a common table expression of the access rights corresponding to the permission policy syntax.

7. The method according to claim 6, characterized in that The statement generation process is performed based on the calculation type, the operator and the logical relationship to obtain the common table expression of the access rights corresponding to the permission policy syntax, including: Based on the calculation type and operator, create sub-calculation units of different calculation types corresponding to the permission policy syntax through a factory class method; Performing grammar translation processing on the sub-computing units of different computing types to obtain grammar translation results of each sub-computing unit; Integrate the grammar translation results based on the logical relationship to obtain a grammar integration result; Obtain table name data and field name data corresponding to the resource field in the permission policy syntax; Based on the table name data and the field name data, the grammar integration result is converted into a common table expression of the access rights corresponding to the permission policy grammar.

8. The method according to claim 7, characterized in that The converting the grammar integration result into a common table expression of the access rights corresponding to the permission policy grammar based on the table name data and the field name data comprises: Based on the table name data, generate a table name prefix of a common table expression; Based on the table name data and the field name data, converting the grammar integration result into a database processing statement and a processing restriction condition of the common table expression; The table name prefix, the database processing statement and the processing restriction condition are concatenated to obtain a common table expression of the access rights corresponding to the permission policy syntax.

9. The method according to claim 1, characterized in that: The integrating the common table expression and the database statement to obtain the permission control statement comprises: Identify the common table name in the common table expression and the operation table name in the database statement; Replace the operation table name in the database statement with the public table name to obtain a table name replacement statement; The common table expression and the table name replacement statement are concatenated to obtain a permission control statement.

10. The method according to claims 1 to 9, characterized in that The database data processing request includes a database data query request; The performing of database data processing based on the authority control statement to obtain the data processing result includes: A data query request is initiated to a target database based on the authority control statement, and a data processing result of the target database executing the data query request is obtained.

11. A database data processing device, characterized in that: The device comprises: A statement extraction module is used to extract the database statement of the database data processing request when a database data processing request for a target database is obtained; A grammar search module, used to search for the authority policy grammar corresponding to the database processing request; An expression generation module, used to generate a common table expression for the access rights corresponding to the database data processing request based on the permission policy grammar; A statement integration module, used to integrate the common table expression and the database statement to obtain an authority control statement; The data processing module is used to execute database data processing based on the permission control statement to obtain data processing results.

12. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images