Search platform object-level data authority management method oriented to non-uniform authority system and multi-source data

Abstract

The invention discloses a non-uniform permission system and multi-source data-oriented search platform object-level data permission management method, which sequentially comprises the following steps of: classifying multi-source data which can be acquired by a search platform, formulating a search platform permission data standard specification, analyzing a multi-source data permission requirement, and processing data source permission data. Processing target permission data of the search platform, collecting the target permission data by the search platform, producing knowledge of the search platform, configuring user permission of the search platform and authenticating personnel in a search request; according to the method, the problem that an RBAC-based permission model adopted in the prior art cannot adapt to object-level data permission management requirements in a non-uniform permission system and multi-data-source enterprise search platform is solved, and data permission management compatibility of different data sources, different permission systems and differentiated organizations is realized; and the data authority management granularity of the search platform reaches an object level.

Description

Technical Field

[0001] The present invention belongs to the technical field of data authority management, and in particular, relates to an object-level data authority management method for a search platform oriented to a non-uniform authority system and multi-source data. Background Art

[0002] Enterprise production and operation activities are often accompanied by strict data permission management. The search platform only manages object-level data permissions through roles, which will lead to an uncontrollable number of roles. It is difficult for system administrators to effectively manage a large number of roles generated by numerous data sources through manual or technical means. Different business systems will produce different permission systems in the actual business process. The same person has different responsibilities in different business systems and may exist in different organizations, which may be virtual organizations unique to a certain system. The original data and data permissions of the data source are constantly changing with the development of the business, which requires the search platform that collects these multi-source data to be able to synchronize these changes in a timely manner and respond to these changes with its own permission management capabilities, which also puts higher requirements on the permission management of the search platform. For permission management of multi-source data in a single search platform under a non-unified permission system, most existing technical solutions use a simple RBAC permission model to implement access control. This type of technology usually controls whether a certain type of user has access rights to a certain type of data based on roles, which has the following defects: 1. The granularity of traditional permission management on search platforms is relatively coarse, which is quite different from the actual permission management of data sources. This patent provides an object-level permission management capability, which can realize a one-stop enterprise unified search application to meet the refined permission requirements with an acceptable management workload, and achieve a permission experience that is basically consistent with the data source.

[0003] 2. It cannot support complex organizations with multiple data sources. The existing search platform permission system is based on a single organizational system. Special organizations under different data sources can easily lead to management confusion and high maintenance costs for the single organizational system. This patent can be compatible with the data permission management requirements of differentiated organizations with different data sources through automated scripts.

[0004] 3. Weak perception of data permission updates at the object level of the data source. The granularity and methods of permission management on existing search platforms differ to a certain extent from the actual data permissions of the data source, and the complexity of permission updates increases significantly with the number of data sources and the amount of data connected to the platform. This patent can achieve periodic updates of permission data by automatically collecting the latest permission data through periodic tasks.

[0005] Therefore, it is necessary to design an object-level data permission management method for search platforms with non-unified permission systems and multi-source data to solve the above problems. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide an object-level data permission management method for a search platform with non-uniform permission systems and multi-source data. The method aims to solve the problem that the RBAC-based permission model adopted in the prior art cannot adapt to the object-level data permission management requirements in an enterprise search platform with non-uniform permission systems and multi-source data.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is: A method for managing object-level data permissions on a search platform for non-uniform permission systems and multi-source data, comprising the following steps: S1, classification of multi-source data that can be collected by the search platform: Classify the multi-source data that can be collected by the search platform according to data characteristics and data association relationships, including non-association data and association data; non-association data includes structured data and unstructured data, and association data includes structured and unstructured association data, and unstructured and unstructured association data; S2, formulate standard specifications for search platform authority data: Formulate the object-level data permission standards for the search platform and the data source data permission logical relationship collection table; S3, analysis of multi-source data permission requirements: Analyze the data with search requirements and their original data permissions in the data source, and divide the business data scope of the data source to be connected to the search platform, as well as the data classification and knowledge definition corresponding to the business data, with reference to the data type of S1; For the business data to be connected to the search platform, refer to S2 and sort out the data source data authority logical relationship collection table according to the knowledge definition; S4, data source authority data processing: Based on the knowledge definitions sorted out in S3 and the data source data permission logical relationship collection table corresponding to the knowledge definitions, primary object-level permission data is periodically generated through data processing tools; S5, search platform target permission data processing: The primary object-level permission data of the data source formed in S4 is processed and integrated by the data processing component to form the target object-level permission data of the data source, and the target object-level permission data of the data source meets the object-level data permission standard of the search platform in S2; S6, search platform collects target permission data: Based on the knowledge definition formed by S3, the corresponding knowledge categories are configured on the search platform management side, and the corresponding periodic data collection tasks are configured for each knowledge category, so that the target permission data produced by the big data platform is regularly collected to the search platform; S7, search platform knowledge production; S8, search platform user authority configuration; S9, Personnel authentication in search request: The authentication process in the search request process is divided into two stages: query scope determination and object-level data permission determination.

[0008] Preferably, in step S1, the structured data includes transaction data, which is generated in the business and process, represents the record of business events, and is logically expressed and implemented in a two-dimensional table structure; Unstructured data refers to data that does not have a predefined model or is not organized in a predefined way. In the search platform, it mainly includes document data, image data, and video data. The main formats of document data are TXT, WORD, EXCEL, PDF, and PPT. The main formats of image data are JPG, PNG, PSD, AI, CRD, TIF, SVG, WEBP, and HEIC. The main formats of video data are MP4, FLV, AVI, and WMV. Association data refers to the relationship between a single data and its directly or indirectly related data, indicating the business logic connection between different data. In the search platform, association data mainly includes structured and unstructured association data, and unstructured and unstructured association data. A single data can be associated with one or more related data.

[0009] Preferably, in step S2, the search platform object-level permission standards include business data permission standards and personnel permission standards; The business data permission standard contains seven necessary fields, namely business primary key, knowledge code, permission scenario 1, permission scenario 2, permission scenario 3, permission scenario 4 and permission scenario 5; the personnel permission standard contains six necessary fields, namely user account, knowledge code, permission scenario 1, permission scenario 2, permission scenario 3 and permission scenario 4; The data source permission logical relationship collection table includes the personnel organization relationship table, data permission logical table and personnel permission logical table; the personnel organization relationship table includes the organization table and the user table; the organization includes physical organization and virtual organization, and the organization table includes the organization primary key, organization code, organization name, organization type and organization path; the user table includes the user account, organization code and organization path; The data permission logic table includes the business organization table and the business permission association table; the business organization table includes the business primary key, organization code and organization path; the business permission association table includes the business primary key, knowledge code, permission scenario 1, permission scenario 2, permission scenario 3, permission scenario 4 and permission scenario 5; The personnel authority logic table includes user account, knowledge code, authority scenario 1, authority scenario 2, authority scenario 3 and authority scenario 4.

[0010] Preferably, in step S3, the knowledge definition is configured according to the required attributes for the structured data, and the required attributes should include the attributes used to build the index and the attributes required for data display; each data source is sorted out according to the actual organizational structure in the system, and the organizational relationship table corresponding to the data source is sorted out; According to the knowledge definition, the data source data permission logical relationship collection table is sorted out respectively. Among them, the data permission logic table is sorted out, and the object-level data under the knowledge definition is used as the basic permission unit. Different association methods are selected according to needs, including: Method 1: associate the permission unit with one or more users or one or more organizations; Method 2: Associate the permission unit with one or more organizational paths and specify the direction of permission extension, including extension to the upper-level node, extension to the lower-level node, and extension to the same-level node. For the user permission logic table sorting, the sorting work is divided into two stages, taking the user as the basic permission unit: In the first stage, we sort out whether the user has the data permission for the specified knowledge definition; In the second stage, users with the authority to define specified knowledge data can select different association methods according to their needs. The association methods include: Method 1: Associate users with one or more organizations; Method 2: Associate the user with one or more organizational paths and specify the direction of permission extension, which includes extension to the upper-level node, extension to the lower-level node, and extension to the same-level node.

[0011] Preferably, in step S4, for each data source, referring to the personnel organization relationship table sorted out in S3, the source database or the data processing component of the big data platform is used to periodically generate the corresponding detailed organization data and detailed personnel data of the data source in the form of SQL or SPARK_SQL scripts; For each type of knowledge definition sorted out in S3 of each data source, the content of the data source data permission logical relationship collection table corresponding to the knowledge is used, and through the source database or big data platform data processing component, SQL or SPARK_SQL scripts are used to periodically generate business organization tables, business permission association tables and personnel permission logic tables containing object-level detailed permission data; during the data processing process, the coding and primary keys of organizations, businesses, personnel and knowledge are standardized and uniquely processed.

[0012] Preferably, in step S5, according to the search platform target permission data standard of S2, a SPARK_SQL script is compiled through the big data platform to complete permission scenario data generation, business permission data integration, personnel permission data integration and data quality verification, and the script configuration operation rules are combined to periodically generate data source target object level permission data; In the business authority data integration, for each knowledge definition, the business detail data and business authority data are integrated at the object level, and the business data update time and the authority data update time are recorded respectively through two timestamp fields; In the personnel authority data integration, the personnel authority data of various types of knowledge from various data sources are integrated into a unique data table; Redundant data is filtered out through data quality verification to ensure that object-level business and permission data can be generated normally.

[0013] Preferably, in step S6, for unstructured data, the update of the unstructured data is decoupled from the update of its corresponding permission data to improve the update efficiency of the permission data; when the search platform collection task determines that only the permission data is updated, a separate permission data update task is triggered.

[0014] Preferably, in step S7, the specific method of searching for platform knowledge production is: According to the knowledge categories configured in S6, the corresponding streaming knowledge production tasks are configured on the search platform to process the periodically collected target permission data into the platform knowledge base.

[0015] Preferably, in step S8, the specific method for configuring the search platform user rights is: For each data source, configure the corresponding role on the search platform, associate the role with the corresponding organization or person based on the system-level permission range formed by S3, and activate the role status.

[0016] Preferably, in step S9, when the user initiates a search request, first, according to the authority granted in S8, the scope of the data source that the user can access is framed, and then the scope of the knowledge definition under the data source is framed according to the personnel authority table, and finally the authority field in the personnel table is matched with the authority field in the data table. When any pair of fields has matching data, the user has the authority to access the corresponding object-level data; The retrieval of the search content and the object-level permission determination are performed simultaneously. When the row of data satisfies the conditions of both authentication and content retrieval, the object-level data is returned as the search result.

[0017] Furthermore, the permission fields in the above-mentioned personnel table include permission scenario 1, permission scenario 2, permission scenario 3, permission scenario 4 and user account; the permission fields in the data table include permission scenario 1, permission scenario 2, permission scenario 3, permission scenario 4 and permission scenario 5.

[0018] The beneficial effects of the present invention are as follows: 1. In this method, the data permission management granularity of the search platform reaches the object level and is compatible with different data sources, different permission systems and differentiated organizational structures. It can meet the requirements of fine permission management of data source data after entering the search platform, and realize that the search recall results of different users under the same data source and the same search query are not completely consistent and are consistent with the data permissions of the data source.

[0019] 2. In this method, data permissions can be updated periodically. Through automated data processing and data collection tools, data permissions can be updated periodically to ensure that after the permissions of the data source data are changed, they can still be synchronized to the search platform, so that the data permissions of each data source in the search platform are always consistent with the data source end.

[0020] 3. In this method, the operation and maintenance workload of object-level data permission management is controllable. On the basis of realizing object-level permission control compatible with multiple data sources, the operation and maintenance workload of system administrators is greatly alleviated through program automation. With the increase of platform operation and maintenance time, number of data sources, and data volume, the operation and maintenance workload of system administrators has no obvious increase and is always in a controllable and operable state. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic diagram of the process of the present invention; Figure 2 This is a schematic diagram of the search platform authority structure in the present invention. DETAILED DESCRIPTION

[0022] Embodiment 1: like Figure 1 As shown, a method for object-level data authority management of a search platform for non-uniform authority systems and multi-source data includes the following steps: S1, classification of multi-source data that can be collected by the search platform: Classify the multi-source data that can be collected by the search platform according to data characteristics and data association relationships, including non-association data and association data; non-association data includes structured data and unstructured data, and association data includes structured and unstructured association data, and unstructured and unstructured association data; S2, formulate standard specifications for search platform authority data: Formulate the object-level data permission standards for the search platform and the data source data permission logical relationship collection table; S3, analysis of multi-source data permission requirements: Analyze the data with search requirements and their original data permissions in the data source, and divide the business data scope of the data source to be connected to the search platform, as well as the data classification and knowledge definition corresponding to the business data, with reference to the data type of S1; For the business data to be connected to the search platform, refer to S2 and sort out the data source data authority logical relationship collection table according to the knowledge definition; S4, data source authority data processing: Based on the knowledge definitions sorted out in S3 and the data source data permission logical relationship collection table corresponding to the knowledge definitions, primary object-level permission data is periodically generated through data processing tools; S5, search platform target permission data processing: The primary object-level permission data of the data source formed in S4 is processed and integrated by the data processing component to form the target object-level permission data of the data source, and the target object-level permission data of the data source meets the object-level data permission standard of the search platform in S2; S6, search platform collects target permission data: Based on the knowledge definition formed by S3, the corresponding knowledge categories are configured on the search platform management side, and the corresponding periodic data collection tasks are configured for each knowledge category, so that the target permission data produced by the big data platform is regularly collected to the search platform; S7, search platform knowledge production; S8, search platform user authority configuration; S9, Personnel authentication in search request: The authentication process in the search request process is divided into two stages: query scope determination and object-level data permission determination.

[0023] Preferably, in step S1, the structured data includes transaction data, which is generated in the business and process, represents the record of business events, and is logically expressed and implemented in a two-dimensional table structure; Unstructured data refers to data that does not have a predefined model or is not organized in a predefined way. In the search platform, it mainly includes document data, image data, and video data. The main formats of document data are TXT, WORD, EXCEL, PDF, and PPT. The main formats of image data are JPG, PNG, PSD, AI, CRD, TIF, SVG, WEBP, and HEIC. The main formats of video data are MP4, FLV, AVI, and WMV. Association data refers to the relationship between a single data and its directly or indirectly related data, indicating the business logic connection between different data. In the search platform, association data mainly includes structured and unstructured association data, and unstructured and unstructured association data. A single data can be associated with one or more related data.

[0024] Preferably, in step S2, the search platform object-level permission standards include business data permission standards and personnel permission standards; The business data permission standard contains seven necessary fields, namely business primary key, knowledge code, permission scenario 1, permission scenario 2, permission scenario 3, permission scenario 4 and permission scenario 5; the personnel permission standard contains six necessary fields, namely user account, knowledge code, permission scenario 1, permission scenario 2, permission scenario 3 and permission scenario 4; The data source permission logical relationship collection table includes the personnel organization relationship table, data permission logical table and personnel permission logical table; the personnel organization relationship table includes the organization table and the user table; the organization includes physical organization and virtual organization, and the organization table includes the organization primary key, organization code, organization name, organization type and organization path; the user table includes the user account, organization code and organization path; The data permission logic table includes the business organization table and the business permission association table; the business organization table includes the business primary key, organization code and organization path; the business permission association table includes the business primary key, knowledge code, permission scenario 1, permission scenario 2, permission scenario 3, permission scenario 4 and permission scenario 5; The personnel authority logic table includes user account, knowledge code, authority scenario 1, authority scenario 2, authority scenario 3 and authority scenario 4.

[0025] Preferably, in step S3, the knowledge definition is configured according to the required attributes for the structured data, and the required attributes should include the attributes used to build the index and the attributes required for data display; each data source is sorted out according to the actual organizational structure in the system, and the organizational relationship table corresponding to the data source is sorted out; According to the knowledge definition, the data source data permission logical relationship collection table is sorted out respectively. Among them, the data permission logic table is sorted out, and the object-level data under the knowledge definition is used as the basic permission unit. Different association methods are selected according to needs, including: Method 1: associate the permission unit with one or more users or one or more organizations; Method 2: Associate the permission unit with one or more organizational paths and specify the direction of permission extension, including extension to the upper-level node, extension to the lower-level node, and extension to the same-level node. For the user permission logic table sorting, the sorting work is divided into two stages, taking the user as the basic permission unit: In the first stage, we sort out whether the user has the data permission for the specified knowledge definition; In the second stage, users with the authority to define specified knowledge data can select different association methods according to their needs. The association methods include: Method 1: Associate users with one or more organizations; Method 2: Associate the user with one or more organizational paths and specify the direction of permission extension, which includes extension to the upper-level node, extension to the lower-level node, and extension to the same-level node.

[0026] Preferably, in step S4, for each data source, referring to the personnel organization relationship table sorted out in S3, the source database or the data processing component of the big data platform is used to periodically generate the corresponding detailed organization data and detailed personnel data of the data source in the form of SQL or SPARK_SQL scripts; For each type of knowledge definition sorted out in S3 of each data source, the content of the data source data permission logical relationship collection table corresponding to the knowledge is used, and through the source database or big data platform data processing component, SQL or SPARK_SQL scripts are used to periodically generate business organization tables, business permission association tables and personnel permission logic tables containing object-level detailed permission data; during the data processing process, the coding and primary keys of organizations, businesses, personnel and knowledge are standardized and uniquely processed.

[0027] Preferably, in step S5, according to the search platform target permission data standard of S2, a SPARK_SQL script is compiled through the big data platform to complete permission scenario data generation, business permission data integration, personnel permission data integration and data quality verification, and the script configuration operation rules are combined to periodically generate data source target object level permission data; In the business authority data integration, for each knowledge definition, the business detail data and business authority data are integrated at the object level, and the business data update time and the authority data update time are recorded respectively through two timestamp fields; In the personnel authority data integration, the personnel authority data of various types of knowledge from various data sources are integrated into a unique data table; Redundant data is filtered out through data quality verification to ensure that object-level business and permission data can be generated normally.

[0028] Preferably, in step S6, for unstructured data, the update of the unstructured data is decoupled from its corresponding permission data; when the search platform acquisition task determines that only the permission data is updated, a separate permission data update task is triggered.

[0029] Preferably, in step S7, the specific method of searching for platform knowledge production is: According to the knowledge categories configured in S6, the corresponding streaming knowledge production tasks are configured on the search platform to process the periodically collected target permission data into the platform knowledge base.

[0030] Embodiment 2: like Figure 2 As shown, in step S8, the specific method for configuring the search platform user rights is: For each data source, configure the corresponding role on the search platform, associate the role with the corresponding organization or person based on the system-level permission range formed by S3, and activate the role status.

[0031] Preferably, in step S9, when the user initiates a search request, first, according to the authority granted in S8, the scope of the data source that the user can access is framed, and then the scope of the knowledge definition under the data source is framed according to the personnel authority table, and finally the authority field in the personnel table is matched with the authority field in the data table. When any pair of fields has matching data, the user has the authority to access the corresponding object-level data; The retrieval of the search content and the object-level authority determination are performed simultaneously. When the object-level data satisfies the conditions of both authentication and content retrieval, the object-level data is returned as the search result.

[0032] Furthermore, the permission fields in the above-mentioned personnel table include permission scenario 1, permission scenario 2, permission scenario 3, permission scenario 4 and user account; the permission fields in the data table include permission scenario 1, permission scenario 2, permission scenario 3, permission scenario 4 and permission scenario 5.

Claims

1. A method for object-level data authority management in a search platform for non-uniform authority systems and multi-source data, characterized in that: The following steps are involved: S1, classification of multi-source data that can be collected by the search platform: Classify the multi-source data that can be collected by the search platform according to data characteristics and data association relationships, including non-association data and association data; non-association data includes structured data and unstructured data, and association data includes structured and unstructured association data, and unstructured and unstructured association data; S2, formulate standard specifications for search platform authority data: Formulate the object-level data permission standards for the search platform and the data source data permission logical relationship collection table; S3, analysis of multi-source data permission requirements: Analyze the data with search requirements and their original data permissions in the data source, and divide the business data scope of the data source to be connected to the search platform, as well as the data classification and knowledge definition corresponding to the business data, with reference to the data type of S1; For the business data to be connected to the search platform, refer to S2 and sort out the data source data authority logical relationship collection table according to the knowledge definition; S4, data source authority data processing: Based on the knowledge definitions sorted out in S3 and the data source data permission logical relationship collection table corresponding to the knowledge definitions, primary object-level permission data is periodically generated through data processing tools; S5, search platform target permission data processing: The primary object-level permission data of the data source formed in S4 is processed and integrated by the data processing component to form the target object-level permission data of the data source, and the target object-level permission data of the data source meets the object-level data permission standard of the search platform in S2; S6, search platform collects target permission data: Based on the knowledge definition formed by S3, the corresponding knowledge categories are configured on the search platform management side, and the corresponding periodic data collection tasks are configured for each knowledge category, so that the target permission data produced by the big data platform is regularly collected to the search platform; S7, search platform knowledge production; S8, search platform user authority configuration; S9, Personnel authentication in search request: The authentication process in the search request process is divided into two stages: query scope determination and object-level data permission determination.

2. According to claim 1, a method for managing object-level data permissions in a search platform for non-uniform permission systems and multi-source data, characterized in that: In step S1, the structured data includes transaction data, which is generated in business and processes, represents a record of business events, and is logically expressed and implemented in a two-dimensional table structure; Unstructured data refers to data that does not have a predefined model or is not organized in a predefined way. In the search platform, it mainly includes document data, image data, and video data. Association data refers to the relationship between a single data and its directly or indirectly related data, indicating the business logic connection between different data.

3. According to claim 1, a method for managing object-level data permissions in a search platform for non-uniform permission systems and multi-source data, characterized in that: In step S2, the object-level permission standards of the search platform include business data permission standards and personnel permission standards; The business data permission standard contains seven necessary fields, namely business primary key, knowledge code, permission scenario 1, permission scenario 2, permission scenario 3, permission scenario 4 and permission scenario 5; the personnel permission standard contains six necessary fields, namely user account, knowledge code, permission scenario 1, permission scenario 2, permission scenario 3 and permission scenario 4; The data source permission logic relationship collection table includes the personnel organization relationship table, the data permission logic table and the personnel permission logic table; The personnel organization relationship table includes the organization table and the user table; the organization includes physical organization and virtual organization, the organization table includes the organization primary key, organization code, organization name, organization type and organization path; the user table includes the user account, organization code and organization path; The data permission logic table includes the business organization table and the business permission association table; the business organization table includes the business primary key, organization code and organization path; the business permission association table includes the business primary key, knowledge code, permission scenario 1, permission scenario 2, permission scenario 3, permission scenario 4 and permission scenario 5; The personnel authority logic table includes user account, knowledge code, authority scenario 1, authority scenario 2, authority scenario 3 and authority scenario 4.

4. According to claim 1, a method for managing object-level data permissions in a search platform for non-uniform permission systems and multi-source data, characterized in that: In step S3, for structured data, knowledge definition is configured according to required attributes. The required attributes should include attributes used to build indexes and attributes required for data display. Each data source is sorted out according to the actual organizational structure in the system, and the organizational relationship table corresponding to the data source is sorted out; According to the knowledge definition, the data source data permission logical relationship collection table is sorted out respectively. Among them, the data permission logic table is sorted out, and the object-level data under the knowledge definition is used as the basic permission unit. Different association methods are selected according to needs, including: Method 1: associate the permission unit with one or more users or one or more organizations; Method 2: Associate the permission unit with one or more organizational paths and specify the direction of permission extension, including extension to the upper-level node, extension to the lower-level node, and extension to the same-level node. For the user permission logic table sorting, the user is used as the basic permission unit and the sorting work is divided into two stages: In the first stage, we sort out whether the user has the data permission for the specified knowledge definition; In the second stage, users with the authority to define specified knowledge data can select different association methods according to their needs. The association methods include: Method 1: Associate the user with one or more organizations; Method 2: Associate the user with one or more organizational paths and specify the direction of permission extension, which includes extension to the upper-level node, extension to the lower-level node, and extension to the same-level node.

5. According to claim 1, a method for managing object-level data permissions in a search platform for non-uniform permission systems and multi-source data, characterized in that: In step S4, for each data source, refer to the personnel organization relationship table sorted out in S3, and use the source database or big data platform data processing component to periodically generate the corresponding detailed organization data and detailed personnel data of the data source using SQL or SPARK_SQL scripts; For each type of knowledge definition sorted out in S3 of each data source, the content of the data source data permission logical relationship collection table corresponding to the knowledge is used, and through the source database or big data platform data processing component, SQL or SPARK_SQL scripts are used to periodically generate business organization tables, business permission association tables and personnel permission logic tables containing object-level detailed permission data; during the data processing process, the coding and primary keys of organizations, businesses, personnel and knowledge are standardized and uniquely processed.

6. The object-level data authority management method for a search platform for non-uniform authority systems and multi-source data according to claim 1 is characterized in that: In step S5, according to the search platform target permission data standard of S2, a SPARK_SQL script is compiled through the big data platform to complete permission scenario data generation, business permission data integration, personnel permission data integration and data quality verification, and the script configuration operation rules are combined to periodically generate data source target object-level permission data; In the business authority data integration, for each knowledge definition, the business detail data and business authority data are integrated at the object level, and the business data update time and the authority data update time are recorded respectively through two timestamp fields; In the personnel authority data integration, the personnel authority data of various types of knowledge from various data sources are integrated into a unique data table; Filter out redundant data through data quality verification.

7. According to claim 1, a method for managing object-level data permissions in a search platform for non-uniform permission systems and multi-source data, characterized in that: In step S6, for unstructured data, the update of the unstructured data is decoupled from its corresponding permission data; when the search platform collection task determines that only the permission data is updated, a separate permission data update task is triggered.

8. The object-level data authority management method for a search platform for non-uniform authority systems and multi-source data according to claim 7, characterized in that: In step S7, the specific method of searching for platform knowledge production is: According to the knowledge categories configured in S6, the corresponding streaming knowledge production tasks are configured on the search platform to process the periodically collected target permission data into the platform knowledge base.

9. The object-level data authority management method for a search platform for non-uniform authority systems and multi-source data according to claim 1, characterized in that: In step S8, the specific method for configuring the search platform user rights is: For each data source, configure the corresponding role on the search platform, associate the role with the corresponding organization or person based on the system-level permission range formed by S3, and activate the role status.

10. The object-level data authority management method for a search platform for non-uniform authority systems and multi-source data according to claim 9, characterized in that: In step S9, when the user initiates a search request, first, the scope of the data source that the user can access is framed according to the permissions granted in S8, and then the scope of the knowledge definition under the data source is framed according to the personnel permission table. Finally, the permission field in the personnel table is matched with the permission field in the data table. When any pair of fields has matching data, the user has the permission to access the corresponding object-level data; The retrieval of the search content and the object-level authority determination are performed simultaneously. When the object-level data satisfies the conditions of both authentication and content retrieval, the object-level data is returned as the search result.

Images