Data access method and device, electronic equipment and storage medium

Abstract

The invention discloses a data access method and device, electronic equipment and a storage medium. The method comprises the following steps: receiving a data access request of a target user for a target access item, and generating at least one data access statement; under the condition that the data access interface is a permission limitation interface, determining an access permission type based on the user attribute information, the access item identifier and the interface identifier; under the condition that the access permission type is a target permission type, determining an access filtering condition according to the user attribute information, the access item identifier and the filtering condition configuration information, and generating a target access statement based on the data access statement and the access filtering condition; and based on the at least one target access statement and the at least one data access statement, determining target access data corresponding to the data access request. According to the technical scheme, on the basis of reducing the difficulty of the data access permission configuration process, the effect of enhancing the data permission control fineness is achieved, and the flexibility of data access permission control is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data access method, device, electronic equipment and storage medium. Background Art

[0002] Currently, when performing authenticated data access, authentication filtering based on user permissions is usually implemented through hard-coded permission control.

[0003] However, when configuring permissions based on the above method, users need to modify the source code every time they change data permissions, which is not flexible and difficult to maintain. In addition, when the permission rules are modified, the permission control hard code needs to be modified, which is difficult to modify and more invasive to the code. Summary of the invention

[0004] The present invention provides a data access method, device, electronic device and storage medium, so as to enhance the precision of data permission management and control on the basis of reducing the difficulty of data access permission configuration process, improve the flexibility of data access permission control, and further realize the effect of dynamic and refined management and control of data access permissions during the data access process.

[0005] According to one aspect of the present invention, a data access method is provided, the method comprising:

[0006] receiving a data access request from a target user for a target access item, and generating a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request;

[0007] For at least one of the data access interfaces, when the data access interface is a permission-restricted interface, the type of access permission of the target user to the permission-restricted interface is determined based on the user attribute information corresponding to the target user, the access item identifier corresponding to the target access item, and the interface identifier corresponding to the permission-restricted interface; wherein the permission-restricted interface is a data access interface that requires permission control;

[0008] In the case where the access permission type is a target permission type, the access filtering condition corresponding to the target user is determined according to the user attribute information, the access item identifier and the preset filtering condition configuration information, and based on the data access statement corresponding to the permission restriction interface and the access filtering condition, a target access statement corresponding to the permission restriction interface is generated; wherein the filtering condition configuration information is used to indicate the mapping relationship between the user attribute information, the access item identifier and the access filtering condition;

[0009] Based on a target access statement corresponding to at least one of the permission restriction interfaces and a data access statement corresponding to other data access interfaces in at least one of the data access interfaces except the permission restriction interface, target access data corresponding to the data access request is determined.

[0010] According to another aspect of the present invention, there is provided a data access device, the device comprising:

[0011] A request receiving module, configured to receive a data access request from a target user for a target access item, and generate a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request;

[0012] a permission type determination module for determining, for at least one of the data access interfaces, the type of access permission for the target user to the permission-restricted interface based on the user attribute information corresponding to the target user, the access item identifier corresponding to the target access item, and the interface identifier corresponding to the permission-restricted interface;

[0013] An access statement generation module, used to determine the access filtering condition corresponding to the target user according to the user attribute information, the access item identifier and the preset filtering condition configuration information when the access permission type is the target permission type, and generate a target access statement corresponding to the permission restriction interface based on the data access statement corresponding to the permission restriction interface and the access filtering condition; wherein the filtering condition configuration information is used to indicate the mapping relationship between the user attribute information, the access item identifier and the access filtering condition;

[0014] An access data determination module is used to determine the target access data corresponding to the data access request based on a target access statement corresponding to at least one of the permission restriction interfaces and a data access statement corresponding to other data access interfaces in at least one of the data access interfaces except the permission restriction interface.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data access method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data access method described in any embodiment of the present invention when executed.

[0020] The technical solution of this embodiment receives a data access request from a target user for a target access item, and generates a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request; further, for at least one data access interface, in the case where the data access interface is a permission restriction interface, the type of access permission for the target user to the permission restriction interface is determined based on user attribute information corresponding to the target user, an access item identifier corresponding to the target access item, and an interface identifier corresponding to the permission restriction interface; further, in the case where the access permission type is the target permission type, the access filtering condition corresponding to the target user is determined based on the user attribute information, the access item identifier, and the preset filtering condition configuration information, and based on the permission restriction interface, the access filtering condition corresponding to the target user is determined. The target access statement corresponding to the permission restriction interface is generated based on the data access statement and access filtering conditions corresponding to the permission restriction interface; further, the target access data corresponding to the data access request is determined based on the target access statement corresponding to at least one permission restriction interface and the data access statements corresponding to other data access interfaces in at least one data access interface except the permission restriction interface, thereby solving the problems of low flexibility, difficult maintenance and cumbersome operation of the permission configuration method in the related technology, and achieving the effect of enhancing the precision of data permission management and control on the basis of reducing the difficulty of the data access permission configuration process, improving the flexibility of data access permission control, and further achieving the effect of dynamic and refined management and control of data access permissions during the data access process.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of a data access method provided according to Embodiment 1 of the present invention;

[0024] Figure 2is a flow chart of a data access method provided according to Embodiment 2 of the present invention;

[0025] Figure 3 is a structural diagram of a data access device provided according to Embodiment 3 of the present invention;

[0026] Figure 4 It is a structural schematic diagram of an electronic device for implementing the data access method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 1 is a flow chart of a data access method provided by the first embodiment of the present invention. This embodiment is applicable to the case of performing data access on a target access item. The method can be executed by a data access device. The data access device can be implemented in the form of hardware and / or software. The data access device can be configured in a terminal and / or a server. Figure 1 As shown, the method includes:

[0031] S110: Receive a data access request from a target user for a target access item, and generate a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request.

[0032] Among them, the target user can be an object that is currently accessing the target access item. The target access item can be understood as an access item that integrates at least one data access interface to be accessed. Exemplarily, the target access item can be "query supplier user". The data access request can be a pre-written program code, which is used to implement the data access function. The target access item can include at least one data access interface associated with it. The data access interface refers to the connection part between the application and the database. It can be understood that the data access interface enables the application to access and operate the data in the database. Different data access interfaces can be used to access different databases. Exemplarily, the data access interface can be an application programming interface (Application Programming Interface, API). Generally, when accessing the target access item, the corresponding database can be accessed based on at least one data access interface associated with the target access item to obtain the required access data. The data access statement refers to an instruction or command for accessing and operating the data in the database. Through the data access statement, the application can interact with the database to perform operations such as data query, insertion, update and deletion. The data access statement can be a statement written by any programming statement, and optionally, it is an SQL statement.

[0033] In this embodiment, when it is detected that a data access request for a target access item is generated, the generated data access request can be sent to the server, so that the server can access the target access item based on the data access request. There are multiple ways to generate a data access request. Optionally, when it is detected that the target user triggers an access control corresponding to the target access item, a data access request corresponding to the target access item can be generated; or, when it is detected that the received audio information includes a trigger word associated with accessing the target access item, a data access request corresponding to the target access item can be generated; or, when a preset data access instruction is received, a data access request corresponding to the target access item can be generated. The data access instruction can be a string consisting of at least one character and / or a key combination consisting of at least one key, etc.

[0034] As an optional implementation of this embodiment, at least one access item can be predetermined, and access controls corresponding to each access item can be set. Furthermore, when a trigger operation of an access control for a target access item by a target user is detected, a data access request corresponding to the target access item can be generated, and the generated data access request can be sent to a server capable of executing data access. Furthermore, when a data access request for a target access item by a target user is received, at least one data access interface associated with the target access item can be determined, and a data access statement corresponding to the at least one data access interface can be generated based on the data access request.

[0035] S120. For at least one data access interface, when the data access interface is a permission-restricted interface, determine the access permission type of the target user to the permission-restricted interface based on the user attribute information corresponding to the target user, the access item identifier corresponding to the target access item, and the interface identifier corresponding to the permission-restricted interface.

[0036] Among them, the permission restriction interface can be understood as an interface that requires access permission control. The permission restriction interface is a data access interface that requires permission control. That is to say, when accessing this type of data access interface, it is necessary to first determine whether the target user has the interface access permission to access the data access interface. If the target user has the interface access permission to the data access interface, the data access interface can be accessed. If the target user does not have the interface access permission to the data interface, the data access interface cannot be accessed. User attribute information can be understood as information associated with the user. User attribute information can refer to personal related information filled in by the user when registering or using Internet services or automatically collected by the system. User attribute information can be used to characterize the user's identity information. User attribute information can include multiple pieces of information associated with the user, optionally including a user identifier, an organization identifier to which the user belongs, a user role identifier, a user's historical access data, etc. The access item identifier can be information used to identify the access item. The access item identifier can be any form of identification information, optionally, a string consisting of at least one character, and the character can be at least one of text, numbers or English. Exemplarily, assuming that the target access item is access item A, the access item identifier of the target access item is MenuA. The interface identifier can be information used to identify the data access interface. The interface identifier can be any form of identification information, and optionally, it can be a string consisting of at least one character, and the character can be at least one of text, numbers or English. Exemplarily, continuing to refer to the above example, the data access interfaces associated with access item A include three, namely interface A, interface B and interface C. Furthermore, the interface identifier corresponding to interface A is IntfA; the interface identifier corresponding to interface B is IntfB; and the interface identifier corresponding to interface C is IntfC. The access permission type can be understood as a pre-set permission type for users to access business data through the data access interface. The access permission type determines the data scope of the user's access to the data. By configuring the access permission type, the data scope that the relevant user can access to the interface related to the access item is limited. Exemplarily, the access permission type can include access permission type A, access permission type B, access permission type C, access permission type D and access permission type Z. Among them, the permission scope corresponding to access permission type A is personal data, indicating that the user can only access data related to himself; the permission scope corresponding to access permission type B is all department data, indicating that the user can access data related to the department; the permission scope corresponding to access permission type C is all data, indicating that the user can access all data; the permission scope corresponding to access permission type D is custom permission, and the data scope that the user can access can be determined based on the user's user attribute information; the permission scope corresponding to access permission type Z is default permission. When the system cannot determine the user's access permission type, the access permission type can be matched for the user.

[0037] In this embodiment, among at least one data access interface associated with the target access item, there may be data access interfaces that require permission control and / or data access interfaces that do not require permission control. For data access interfaces that do not require permission control, the associated business data can be accessed directly through the data access interface. For data access interfaces that require permission control, the type of access permission for the target user to the data access interface can be determined, and then, based on the type of access permission, the business data within the corresponding permission range can be accessed through the data access interface.

[0038] In this embodiment, for at least one data access interface associated with the target access item, it is possible to determine whether the data access interface is a permission-restricted interface based on the interface attribute information corresponding to the data access interface. Furthermore, in the case where the data access interface is a permission-restricted interface, the user attribute information of the target user, the access item identifier corresponding to the target access item, and the interface identifier corresponding to the permission-restricted interface can be obtained. Furthermore, the type of access permission of the target user to the permission-restricted interface can be determined based on the user attribute information, the access item identifier, and the interface identifier.

[0039] As an optional implementation of this embodiment, at least one access permission type may be predetermined, and the access permission type may be associated with a user role, an access item, and a data access interface. That is, the access permission type is configured for each data access interface associated with the access item for the user role. Furthermore, for at least one data access interface, in the case where the data access interface is a permission-restricted interface, the user attribute information of the target user may be obtained, and the role identifier corresponding to the role to which the target user belongs may be determined based on the user attribute information. Furthermore, the access permission type of the target user for the permission-restricted interface may be determined based on the association between the role identifier, the access item identifier, the interface identifier, and the access permission type.

[0040] As another implementation of this embodiment, at least one access permission type may be predetermined, and the access permission type may be associated with a user, an access item, and a data access interface. That is, an access permission type is configured for each user for each data access interface associated with an access item. Furthermore, for at least one data access interface, in the case where the data access interface is a permission-restricted interface, user attribute information of the target user may be obtained, and a user identifier corresponding to the target user may be determined based on the user attribute information. Furthermore, the access permission type of the target user for the permission-restricted interface may be determined based on the association between the user identifier, the access item identifier, the interface identifier, and the access permission type.

[0041] In this embodiment, in order to realize dynamic data permission management during the data access process, the data access interfaces that need to be managed can be determined in advance, and these data access interfaces can be annotated and marked so that the permission restriction interface can be quickly determined based on the interface mark during the data access process.

[0042] Optionally, on the basis of the above-mentioned technical solutions, it also includes: for at least one data access interface, when the data access interface is an interface that requires permission management and control, the data access interface is annotated and marked according to at least one preset permission marking field and the field value corresponding to the permission marking field, and the marked data access interface is used as a permission restriction interface.

[0043] It is understandable that when access to certain data access interfaces needs to be controlled by specific permissions, developers can mark these interfaces by adding custom annotations to the interface definitions so that the system can identify and apply the corresponding permission check logic. Annotations can provide additional metadata information for the interface without modifying the code logic. This metadata information can be used for a variety of purposes such as permission checking, logging, and API document generation.

[0044] Among them, the permission tag field can be a pre-set field used to represent the corresponding permission. Optionally, the permission tag field may include fields such as table, field, and value. The table field is used to mark the name of the table to be managed; when the table field is the default value (empty string), SQL statements for all tables are intercepted by default. The field field is used to control the fields returned after the execution of the original SQL statement; when the field field is the default value, all field information of the interface is returned by default. The value field is used to represent the filtering conditions after the original SQL is nested and spliced, and is generally filtered through limiting conditions with placeholders. It should be noted that different permission tag fields can be used to control different permission check items.

[0045] As an optional implementation mode of this embodiment, for at least one data access interface, when the data access interface is an interface that requires permission control, the permission restriction items that require permission control for the data access interface can be determined. Furthermore, the corresponding permission tag field and the field value corresponding to the permission tag field can be determined based on the determined permission restriction items. Furthermore, the data access interface can be annotated and marked based on at least one permission tag resource and the field value corresponding to each permission tag field, and the marked data access interface can be used as a permission restriction interface. Among them, the permission restriction items may include table access restriction items, access feedback restriction items, and access restriction items, etc.

[0046] S130. When the access permission type is a target permission type, determine the access filtering conditions corresponding to the target user according to the user attribute information, the access item identifier, and the preset filtering condition configuration information, and generate the target access statement corresponding to the permission restriction interface based on the data access statement and the access filtering conditions corresponding to the permission restriction interface.

[0047] Among them, the target permission type can be an access permission type in the pre-set access permission type that needs to determine the access filtering condition based on the user attribute information. The target permission type can be any access permission type among at least one preset access permission type. Exemplarily, the target access permission type can be a custom permission type. The filtering condition configuration information can be understood as information used to configure the access filtering condition associated with the user. The filtering condition configuration information is used to indicate the mapping relationship between the user attribute information, the access item identifier and the access filtering condition. The access filtering condition can be understood as a condition or rule used to limit the scope of data access results. In the case of data access based on the access filtering condition, the data in the database can be filtered according to the access filtering condition so as to return only data records that meet specific requirements. The target access statement can be the access execution statement applied to the final execution of data access.

[0048] In this embodiment, when the target user's access permission type for the permission restriction interface is determined, it can be determined whether the access permission type is the target permission type. Further, when the access permission type is the target permission type, a query can be performed in the preset filtering condition configuration information according to the user attribute information and the access item identifier to obtain the access filtering condition corresponding to the target user.

[0049] In this embodiment, in order to accurately determine the access filtering conditions corresponding to the target user based on the filtering condition configuration information, an association relationship between the user identifier, access item identifier, filtering identifier and access filtering conditions can be established in advance, and the filtering condition configuration information can be determined based on the association relationship.

[0050] Optionally, user attribute information is used to determine a filtering identifier; the user attribute information includes a user identifier; based on the user attribute information, the access item identifier and preset filtering condition configuration information, determining the access filtering condition corresponding to the target user, including: determining the access item identifier corresponding to the target access item; parsing the user attribute information to obtain the filtering identifier corresponding to the target user, and determining the user identifier corresponding to the target user based on the user attribute information; querying in the preset filtering condition configuration information based on the access item identifier, the filtering identifier and the user identifier to determine the access filtering condition corresponding to the target user.

[0051] The filter identifier may be used to identify the information of the data filtering range. The user identifier may be information used to identify the user. The user identifier may be any form of identification information, and may be a string consisting of at least one character, and the character may be at least one of text, numbers or English.

[0052] As an optional implementation of this embodiment, when the target user's access permission type for the permission restriction interface is the target permission type, the access item identifier corresponding to the target access item can be determined, and the user attribute information corresponding to the target user can be parsed to obtain the filter identifier corresponding to the target user, and the user identifier of the target user can be obtained based on the user attribute information. Further, a query can be performed in the preset filter condition configuration information based on the access item identifier, the filter identifier and the user identifier to obtain the access filter condition corresponding to the target user.

[0053] It should be noted that when the access permission type is a target permission type, dynamically configuring access filtering conditions corresponding to the target user based on user attribute information can achieve flexible data permission control and personalized permission control for different users.

[0054] Exemplarily, assuming that the target user is user D, the user identifier is UserD, the access item identifier is Menu_QryProvider, and the filter identifier is QryProvider_Org, then according to the filter condition configuration information (as shown in Table 1), it can be determined that the access filter condition corresponding to the target user is org_id in ({#orgId}).

[0055] Table 1 Filter condition configuration information

[0056]

[0057] In this embodiment, when the access permission type is a non-target permission type, a filtering condition template corresponding to the access permission type can be determined from preset filtering condition templates, and then the filtering condition template can be directly applied to determine the access filtering condition corresponding to the target user.

[0058] Optionally, on the basis of the above-mentioned technical solutions, it also includes: when the access permission type is a non-target permission type, determining the filtering condition template corresponding to the access permission type according to the preset filtering condition mapping information; processing the filtering condition template based on user attribute information to obtain the access filtering condition corresponding to the permission restriction interface.

[0059] Among them, the non-target permission type may be other access permission types other than the target access type in at least one preset access permission type. Exemplarily, the non-target permission types may include personal data access permission, department data access permission, all data access permission and default access permission, etc. The filtering condition mapping information is used to indicate the association relationship between at least one non-target permission type and the filtering condition template. In this embodiment, at least one access permission type may be predetermined, and the non-target permission type may be determined from at least one access permission type. Furthermore, the filtering condition template corresponding to each non-target permission type may be determined based on the permission range corresponding to each non-target permission type, a mapping relationship between the non-target permission type and the filtering condition template may be established, and the filtering condition mapping information may be constructed based on the mapping relationship.

[0060] Exemplarily, Table 2 is a schematic table showing the effects of the filtering condition mapping information provided in this embodiment. As shown in Table 2, authTypeA corresponds to personal data access rights; authTypeB corresponds to department data access rights; authTypeC corresponds to all data access rights; and authTypeZ corresponds to default access rights. It should be noted that the benefit of the default access rights having a scope of personal data is that, when the target user's access right type cannot be determined, the target user is configured with a default access right so that the target user can only access business data related to the target user, thereby improving data security.

[0061] Table 2 Filter condition mapping information

[0062]

[0063] As an optional implementation of this embodiment, when the access permission type is a non-target permission type, a query can be made in the preset filter condition mapping information according to the access permission type to obtain a filter condition template corresponding to the access permission type. Further, the information to be filled in the filter condition template can be determined, and the corresponding information can be obtained from the user attribute information, and the obtained information can be filled into the filter condition template to obtain an access filter condition corresponding to the permission restriction interface. Optionally, the information to be filled in the filter condition template can include the user ID and / or the department ID of the department to which the user belongs.

[0064] In this embodiment, the generated data access statement corresponding to the permission restriction interface is an access statement without setting an access filter condition. In order to obtain the required access data based on the access filter condition, when the access filter condition corresponding to the target user is determined, the data access statement and the access filter condition corresponding to the permission restriction interface can be processed according to a preset statement splicing method to generate a target access statement for the permission restriction interface. The statement splicing method can be any method that can splice at least two statements into one statement, and optionally, a nested splicing method.

[0065] Optionally, based on the data access statements and access filtering conditions corresponding to the permission restriction interface, a target access statement corresponding to the permission restriction interface is generated, including: generating a filtering condition clause based on the access filtering condition; nesting and splicing the data access statements based on the filtering condition clauses, and using the statement obtained after splicing as the target access statement corresponding to the permission restriction interface.

[0066] As an optional implementation of this embodiment, when the access filtering condition is obtained, a filtering condition clause can be generated based on the access filtering condition. Further, the filtering condition clause can be nested and spliced ​​in the outer layer of the data access statement, and the statement obtained after splicing is used as the target access statement corresponding to the permission restriction interface.

[0067] S140. Determine target access data corresponding to the data access request based on a target access statement corresponding to at least one permission restriction interface and a data access statement corresponding to other data access interfaces in at least one data access interface except the permission restriction interface.

[0068] The target access data may be data associated with the target access item that can be accessed within the scope of the target user's access rights.

[0069] In this embodiment, for at least one data access interface associated with the target access item, for the permission restriction interface, the target access statement corresponding to the permission restriction interface can be determined; for other access interfaces except the permission restriction interface, the data access statement corresponding to the data access interface can be directly applied. Furthermore, the target access statement corresponding to at least one permission restriction interface and the data access statements corresponding to other access interfaces except the permission restriction interface in at least one data access interface can be executed, and the access data corresponding to each data access interface can be obtained. Furthermore, the access data corresponding to each data access interface can be used as the target access data corresponding to the data access request.

[0070] In this embodiment, in order to facilitate users to browse the target access data more clearly and intuitively, after determining the target access data corresponding to the data access request, it also includes: feeding back the target access data to a user terminal associated with the target user, and displaying the target access data based on the user terminal.

[0071] The user terminal may be a terminal device that supports receiving user operations and / or displaying relevant data. The user terminal may be a user terminal that issues a data access request. Optionally, the user terminal may be a mobile terminal and / or a fixed terminal.

[0072] As an optional implementation of this embodiment, when the target access data corresponding to the data access request is obtained, the target access data can be fed back to the user terminal associated with the target user. Further, the target access data can be displayed on the display interface of the user terminal.

[0073] The technical solution of this embodiment receives a data access request from a target user for a target access item, and generates a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request; further, for at least one data access interface, in the case where the data access interface is a permission restriction interface, the type of access permission for the target user to the permission restriction interface is determined based on user attribute information corresponding to the target user, an access item identifier corresponding to the target access item, and an interface identifier corresponding to the permission restriction interface; further, in the case where the access permission type is the target permission type, the access filtering condition corresponding to the target user is determined based on the user attribute information, the access item identifier, and the preset filtering condition configuration information, and based on the permission restriction interface, the access filtering condition corresponding to the target user is determined. The target access statement corresponding to the permission restriction interface is generated based on the data access statement and access filtering conditions corresponding to the permission restriction interface; further, the target access data corresponding to the data access request is determined based on the target access statement corresponding to at least one permission restriction interface and the data access statements corresponding to other data access interfaces in at least one data access interface except the permission restriction interface, thereby solving the problems of low flexibility, difficult maintenance and cumbersome operation of the permission configuration method in the related technology, and achieving the effect of enhancing the precision of data permission management and control on the basis of reducing the difficulty of the data access permission configuration process, improving the flexibility of data access permission control, and further achieving the effect of dynamic and refined management and control of data access permissions during the data access process.

[0074] Embodiment 2

[0075] Figure 2It is a flow chart of a data access method provided by the second embodiment of the present invention. On the basis of the above-mentioned embodiment, the user attribute information includes a user role identifier; based on the user attribute information corresponding to the target user, the access item identifier corresponding to the target access item and the interface identifier corresponding to the permission restriction interface, the access permission type of the target user to the permission restriction interface is determined, including: obtaining the user attribute information corresponding to the target user, and determining the user role identifier corresponding to the target user based on the user attribute information; determining the access item identifier corresponding to the target access item and the interface identifier corresponding to the permission restriction interface; querying the preset permission type association information according to the user role identifier, access item identifier and interface identifier to obtain the access permission type of the target user to the permission restriction interface. The specific implementation method can refer to the technical solution of this embodiment. Among them, the technical terms that are the same as or corresponding to the above-mentioned embodiments are not repeated here.

[0076] like Figure 2 As shown, the method includes:

[0077] S210: Receive a data access request from a target user for a target access item, and generate a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request.

[0078] S220. For at least one data access interface, when the data access interface is a permission-restricted interface, obtain user attribute information corresponding to a target user, and determine a user role identifier corresponding to the target user based on the user attribute information.

[0079] The user role identifier may be information used to identify the user role. It is understood that a user role is a set of permissions and responsibilities defined in a system or application, which is used to describe the operations that different types of users can perform and the resources they can access. Optionally, user roles may include administrators, ordinary users, visitors, auditors, and developers. The user role identifier may be any form of identification information, and may optionally be a string consisting of at least one character, and the character may be at least one of text, numbers, or English.

[0080] In this embodiment, for at least one data access interface, when the data access interface is a permission-restricted interface, in order to determine the type of access rights of the target user to the permission-restricted interface, user attribute information corresponding to the target user can be obtained. Further, a user role identifier corresponding to the target user can be obtained from the user attribute information.

[0081] S230: Determine an access item identifier corresponding to the target access item and an interface identifier corresponding to the permission restriction interface.

[0082] In this embodiment, the access item identifier corresponding to the target access item and the interface identifier corresponding to the permission restriction interface may be determined.

[0083] S240: query the preset permission type association information according to the user role identifier, the access item identifier and the interface identifier to obtain the access permission type of the target user to the permission restriction interface.

[0084] The permission type association information can be understood as information used to characterize the association between user roles, access items, data access interfaces and access permission types. The permission type association information is used to indicate the mapping relationship between user role identifiers, access item identifiers, interface identifiers and access permission types.

[0085] As an optional implementation of this embodiment, at least one access permission type can be predetermined, and the access permission type can be associated with the user role, access item, and data access interface. That is, the access permission type is configured for each data access interface associated with the access item for the user role, and the permission type association information is constructed based on the determined association relationship. Furthermore, when the user role identifier corresponding to the target user, the access item identifier corresponding to the target access item, and the interface identifier corresponding to the permission restriction interface are obtained, a query can be performed in the preset permission type association information based on the user role identifier, the access item identifier, and the interface identifier, and the access permission type obtained by the query is used as the access permission type of the target user for the permission restriction interface.

[0086] It should be noted that the access permission type for each role for a certain access item can be set. Each role can individually configure the role's access permission to the data access interface associated with the access item. When the program is running, it dynamically uses different access permission types to execute the data access interface corresponding to the access item according to the user's role, thereby achieving refined configuration.

[0087] S250. When the access permission type is a target permission type, determine the access filtering conditions corresponding to the target user according to the user attribute information, the access item identifier, and the preset filtering condition configuration information, and generate the target access statement corresponding to the permission restriction interface based on the data access statement and the access filtering conditions corresponding to the permission restriction interface.

[0088] S260. Determine the target access data corresponding to the data access request based on the target access statement corresponding to at least one of the permission restriction interfaces and the data access statements corresponding to other data access interfaces in at least one of the data access interfaces except the permission restriction interface.

[0089] The technical solution of this embodiment receives a data access request from a target user for a target access item, and generates a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request; further, for at least one data access interface, in the case where the data access interface is a permission restriction interface, the type of access permission for the target user to the permission restriction interface is determined based on user attribute information corresponding to the target user, an access item identifier corresponding to the target access item, and an interface identifier corresponding to the permission restriction interface; further, in the case where the access permission type is the target permission type, the access filtering condition corresponding to the target user is determined based on the user attribute information, the access item identifier, and the preset filtering condition configuration information, and based on the permission restriction interface, the access filtering condition corresponding to the target user is determined. The target access statement corresponding to the permission restriction interface is generated based on the data access statement and access filtering conditions corresponding to the permission restriction interface; further, the target access data corresponding to the data access request is determined based on the target access statement corresponding to at least one permission restriction interface and the data access statements corresponding to other data access interfaces in at least one data access interface except the permission restriction interface, thereby solving the problems of low flexibility, difficult maintenance and cumbersome operation of the permission configuration method in the related technology, and achieving the effect of enhancing the precision of data permission management and control on the basis of reducing the difficulty of the data access permission configuration process, improving the flexibility of data access permission control, and further achieving the effect of dynamic and refined management and control of data access permissions during the data access process.

[0090] Embodiment 3

[0091] Figure 3 Schematic diagram of the structure of a data access device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a request receiving module 310, a permission type determining module 320, an access statement generating module 330 and an access data determining module 340.

[0092] Among them, the request receiving module 310 is used to receive a data access request of a target user for a target access item, and generate a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request; the permission type determining module 320 is used to determine the access permission type of the target user for the permission-restricted interface based on the user attribute information corresponding to the target user, the access item identifier corresponding to the target access item, and the interface identifier corresponding to the permission-restricted interface for at least one of the data access interfaces, when the data access interface is a permission-restricted interface; the access statement generating module 330 is used to determine the access permission type of the target user for the permission-restricted interface based on the user attribute information corresponding to the target user, the access item identifier corresponding to the target access item, and the interface identifier corresponding to the permission-restricted interface when the access permission type is the target permission type. The information, the access item identifier and the preset filtering condition configuration information are used to determine the access filtering condition corresponding to the target user, and based on the data access statement corresponding to the permission restriction interface and the access filtering condition, a target access statement corresponding to the permission restriction interface is generated; wherein the filtering condition configuration information is used to indicate the mapping relationship between the user attribute information, the access item identifier and the access filtering condition; an access data determination module 340 is used to determine the target access data corresponding to the data access request based on the target access statement corresponding to at least one of the permission restriction interfaces and the data access statements corresponding to other data access interfaces in at least one of the data access interfaces except the permission restriction interface.

[0093] The technical solution of this embodiment receives a data access request from a target user for a target access item, and generates a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request; further, for at least one data access interface, in the case where the data access interface is a permission restriction interface, the type of access permission for the target user to the permission restriction interface is determined based on user attribute information corresponding to the target user, an access item identifier corresponding to the target access item, and an interface identifier corresponding to the permission restriction interface; further, in the case where the access permission type is the target permission type, the access filtering condition corresponding to the target user is determined based on the user attribute information, the access item identifier, and the preset filtering condition configuration information, and based on the permission restriction interface, the access filtering condition corresponding to the target user is determined. The target access statement corresponding to the permission restriction interface is generated based on the data access statement and access filtering conditions corresponding to the permission restriction interface; further, the target access data corresponding to the data access request is determined based on the target access statement corresponding to at least one permission restriction interface and the data access statements corresponding to other data access interfaces in at least one data access interface except the permission restriction interface, thereby solving the problems of low flexibility, difficult maintenance and cumbersome operation of the permission configuration method in the related technology, and achieving the effect of enhancing the precision of data permission management and control on the basis of reducing the difficulty of the data access permission configuration process, improving the flexibility of data access permission control, and further achieving the effect of dynamic and refined management and control of data access permissions during the data access process.

[0094] Optionally, the user attribute information includes a user role identifier; the permission type determination module 320 includes: a role identifier determination unit, an interface identifier determination unit and a permission type determination unit.

[0095] A role identification determination unit, configured to obtain user attribute information corresponding to the target user, and determine a user role identification corresponding to the target user based on the user attribute information;

[0096] An interface identifier determining unit, used to determine an access item identifier corresponding to the target access item and an interface identifier corresponding to the permission restriction interface;

[0097] A permission type determination unit is used to query in preset permission type association information based on the user role identifier, the access item identifier and the interface identifier to obtain the access permission type of the target user to the permission restriction interface; wherein the permission type association information is used to indicate the mapping relationship between the user role identifier, the access item identifier, the interface identifier and the access permission type.

[0098] Optionally, the user attribute information is used to determine a filter identifier; the user attribute information includes a user identifier; the access statement generation module 330 includes: an access item identifier determination unit, a filter identifier determination unit and a filter condition determination unit.

[0099] An access item identifier determining unit, used to determine an access item identifier corresponding to the target access item;

[0100] a filter identifier determination unit, configured to parse the user attribute information to obtain a filter identifier corresponding to the target user, and determine a user identifier corresponding to the target user based on the user attribute information;

[0101] The filtering condition determination unit is used to query the preset filtering condition configuration information according to the access item identifier, the filtering identifier and the user identifier to determine the access filtering condition corresponding to the target user.

[0102] Optionally, the device further includes: a filtering condition template determination module and a filtering condition determination module.

[0103] A filtering condition template determination module, used to determine a filtering condition template corresponding to the access permission type according to preset filtering condition mapping information when the access permission type is a non-target permission type; wherein the filtering condition mapping information is used to indicate an association relationship between at least one of the non-target permission types and the filtering condition template;

[0104] The filtering condition determination module is used to process the filtering condition template based on the user attribute information to obtain the access filtering condition corresponding to the authority restriction interface.

[0105] Optionally, the access statement generation module 330 includes: a conditional clause generation unit and an access statement generation unit.

[0106] A conditional clause generating unit, configured to generate a filtering condition clause based on the access filtering condition;

[0107] The access statement generating unit is used to nest and splice the data access statements based on the filter condition clauses, and use the statements obtained after the splicing as the target access statement corresponding to the data access interface.

[0108] Optionally, the device further includes: an interface marking module.

[0109] An interface marking module is used to annotate and mark at least one of the data access interfaces according to at least one preset permission marking field and a field value corresponding to the permission marking field, when the data access interface is an interface that requires permission control, and use the marked data access interface as a permission restricted interface.

[0110] Optionally, the device further includes: an access data display module.

[0111] The access data display module is used to feed back the target access data to a user terminal associated with the target user, and display the target access data based on the user terminal.

[0112] The data access device provided in the embodiment of the present invention can execute the data access method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0113] Embodiment 4

[0114] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0115] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0116] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0117] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a data access method.

[0118] In some embodiments, the data access method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data access method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the data access method in any other appropriate manner (e.g., by means of firmware).

[0119] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0120] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0121] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0122] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0123] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0124] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0125] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0126] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data access method, characterized in that: include: receiving a data access request from a target user for a target access item, and generating a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request; For at least one of the data access interfaces, when the data access interface is a permission-restricted interface, the type of access permission of the target user to the permission-restricted interface is determined based on the user attribute information corresponding to the target user, the access item identifier corresponding to the target access item, and the interface identifier corresponding to the permission-restricted interface; wherein the permission-restricted interface is a data access interface that requires permission control; In the case where the access permission type is a target permission type, the access filtering condition corresponding to the target user is determined according to the user attribute information, the access item identifier and the preset filtering condition configuration information, and based on the data access statement corresponding to the permission restriction interface and the access filtering condition, a target access statement corresponding to the permission restriction interface is generated; wherein the filtering condition configuration information is used to indicate the mapping relationship between the user attribute information, the access item identifier and the access filtering condition; Based on a target access statement corresponding to at least one of the permission restriction interfaces and a data access statement corresponding to other data access interfaces in at least one of the data access interfaces except the permission restriction interface, target access data corresponding to the data access request is determined.

2. The data access method according to claim 1, characterized in that: The user attribute information includes a user role identifier; the determining the access permission type of the target user to the permission restriction interface based on the user attribute information corresponding to the target user, the access item identifier corresponding to the target access item, and the interface identifier corresponding to the permission restriction interface includes: Acquire user attribute information corresponding to the target user, and determine a user role identifier corresponding to the target user based on the user attribute information; Determine an access item identifier corresponding to the target access item and an interface identifier corresponding to the permission restriction interface; Searching in preset permission type association information according to the user role identifier, the access item identifier and the interface identifier to obtain the access permission type of the target user to the permission restriction interface; The permission type association information is used to indicate the mapping relationship between the user role identifier, the access item identifier, the interface identifier and the access permission type.

3. The data access method according to claim 1, characterized in that: The user attribute information is used to determine the filtering identifier; the user attribute information includes a user identifier; the access filtering condition corresponding to the target user is determined according to the user attribute information, the access item identifier and the preset filtering condition configuration information, including: Determining an access item identifier corresponding to the target access item; Parsing the user attribute information to obtain a filtering identifier corresponding to the target user, and determining a user identifier corresponding to the target user based on the user attribute information; The preset filtering condition configuration information is queried according to the access item identifier, the filtering identifier and the user identifier to determine the access filtering condition corresponding to the target user.

4. The data access method according to claim 1, characterized in that: Also includes: In the case where the access permission type is a non-target permission type, determining a filtering condition template corresponding to the access permission type according to preset filtering condition mapping information; wherein the filtering condition mapping information is used to indicate an association relationship between at least one of the non-target permission types and the filtering condition template; The filtering condition template is processed based on the user attribute information to obtain an access filtering condition corresponding to the authority restriction interface.

5. The data access method according to claim 1, characterized in that: The step of generating a target access statement corresponding to the data access interface based on the data access statement corresponding to the data access interface and the access filtering condition comprises: generating a filter condition clause based on the access filter condition; The data access statements are nested and spliced ​​based on the filter condition clauses, and the statements obtained after the splicing are used as target access statements corresponding to the data access interface.

6. The data access method according to claim 1, characterized in that: Also includes: For at least one of the data access interfaces, when the data access interface is an interface that requires permission control, the data access interface is annotated and marked based on at least one preset permission marking field and the field value corresponding to the permission marking field, and the marked data access interface is used as a permission restriction interface.

7. The data access method according to claim 1, characterized in that: Also includes: The target access data is fed back to a user terminal associated with the target user, and the target access data is displayed based on the user terminal.

8. A data access device, characterized in that: include: A request receiving module, configured to receive a data access request from a target user for a target access item, and generate a data access statement corresponding to at least one data access interface associated with the target access item based on the data access request; a permission type determination module for determining, for at least one of the data access interfaces, the type of access permission for the target user to the permission-restricted interface based on the user attribute information corresponding to the target user, the access item identifier corresponding to the target access item, and the interface identifier corresponding to the permission-restricted interface; An access statement generation module, used to determine the access filtering condition corresponding to the target user according to the user attribute information, the access item identifier and the preset filtering condition configuration information when the access permission type is the target permission type, and generate a target access statement corresponding to the permission restriction interface based on the data access statement corresponding to the permission restriction interface and the access filtering condition; wherein the filtering condition configuration information is used to indicate the mapping relationship between the user attribute information, the access item identifier and the access filtering condition; An access data determination module is used to determine the target access data corresponding to the data access request based on a target access statement corresponding to at least one of the permission restriction interfaces and a data access statement corresponding to other data access interfaces in at least one of the data access interfaces except the permission restriction interface.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data access method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data access method according to any one of claims 1 to 7 when executed.

Images