User authority management method and device for cloud database

Abstract

The embodiment of the invention relates to a user authority management method and device for cloud databases. The method comprises the following steps: setting corresponding database / project / user configuration attributes for each cloud database / scientific research project / user; when a first access application sent by a first user is received, extracting a first user identifier, a first database name, a first item identifier and a first operation type from the first access application; using the user / database / project configuration attributes corresponding to the first user identifier, the first database name and the first project identifier as corresponding current user / database / project configuration attributes; performing operation authority confirmation on the first operation type based on the current user / database / project configuration attribute; sending the first access application to a preset database operation processing interface if the first access application is confirmed to be allowed, and feeding back the first application set to be forbidden in operation authority to the first user if the first access application is confirmed to be forbidden. According to the invention, waste of storage resources and risk of data leakage can be reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method and device for managing user rights of a cloud database. Background Art

[0002] The scientific research and technology platform establishes a shared database in the cloud to provide a shared service for public technical information for all platform users, and establishes a dedicated database for scientific research projects in the cloud to provide a shared service for project technical information for all project members. In order to ensure that project technical information does not leak data, the scientific research and technology platform should also provide a corresponding user authority management mechanism for various cloud databases. At present, most of these user authority management mechanisms for cloud databases are still based on conventional user-side configuration methods. The so-called user-side configuration method, in simple terms, is to set all relevant information of each user in the corresponding user attribute data through user attribute configuration. All relevant information mentioned here will at least include: 1) the user role information of the current user in each shared database (such as database creator, database manager, general access user, etc.), and the permission configuration information (allowed / not allowed) of the current user role in the current shared database for various database operations (such as import, export, query, delete, etc.); 2) the basic project information of each scientific research project in which the current user participates (such as project identification, names of all special databases corresponding to the project, etc.), and the project role information of the current user in each participating project (such as project creator, project manager, general project member, etc.), and the permission configuration information (allowed / not allowed) of each project role of the current user in each special database for various database operations (such as import, export, query, delete, etc.).

[0003] Through observation, we found that this conventional user-side configuration method has some problems: 1) A large amount of redundant data: Through observation, we found that the configuration method of database operation permissions for each type of user / project role in the cloud database is the same, but the processing mechanism of the user-side configuration method needs to configure the permissions of all database operation types for each user on each cloud database, which means that for multiple users of the same type of user / project role, multiple sets of repeated permission configuration information will be stored in their user attribute data. As the number of users increases, a large amount of redundant data will inevitably be generated; 2) The real-time performance of configuration changes is poor and the error rate is high: When there is an increase or decrease in personnel in the project, or when personnel roles or role permissions are switched, the user attribute data of the changed personnel needs to be adaptively reconfigured. Reconfiguration according to the processing mechanism of the user-side configuration method requires that a series of project-related information (such as basic project information, project role information, permission configuration information, etc.) of each changed personnel be modified item by item. Because there is a lot of modification information and the modification complexity is high, when the number of personnel changes at one time is large, there will often be situations such as untimely configuration and high configuration error rate. On the one hand, these two types of problems will cause a large waste of storage resources for the user rights management mechanism. On the other hand, they will also bring data leakage risks to the user rights management mechanism due to untimely or incorrect configuration modifications. Summary of the invention

[0004] The purpose of the present invention is to provide a method, device, electronic device and computer-readable storage medium for managing user rights of a cloud database in view of the defects of the prior art. The present invention changes the traditional user-side configuration mode into a multi-side configuration mode, namely: setting a corresponding database configuration attribute for each cloud database, setting a corresponding project configuration attribute for each scientific research project, setting a corresponding user configuration attribute for each user, and unifying the user's database operation permission settings in the shared / dedicated database into the database configuration attribute for one-time setting, and unifying the user's database role settings in the dedicated database into the project configuration attribute for one-time setting. The user authority management mechanism implemented by the present invention based on the multi-side configuration method is as follows: after receiving the first access application sent by the first user, the corresponding first user identification, the first database name, the first project identification and the first operation type are extracted therefrom; and the user configuration attributes, database configuration attributes and project configuration attributes corresponding to the first user identification, the first database name and the first project identification are used as the corresponding current user configuration attributes, the current database configuration attributes and the current project configuration attributes; and based on the current user configuration attributes, the current project configuration attributes and the current database configuration attributes, the operation authority of the first operation type is confirmed to obtain the corresponding first confirmation result; and when the first confirmation result is allowed, the first access application is sent to a preset database operation processing interface; and when the first confirmation result is prohibited, the corresponding first application feedback is set to operation authority prohibited, and the first application feedback with the completed setting is sent back to the first user. Through the improved multi-side configuration method of the present invention, on the one hand, the purpose of reducing the amount of redundant data and reducing the waste rate of storage resources can be achieved. On the other hand, the purpose of reducing the difficulty of configuration changes, improving the efficiency of configuration changes, and reducing the configuration error rate can be achieved when the project configuration changes. The user authority management mechanism implemented based on the multi-side configuration method of the present invention will perform multiple verifications on the user, project and database configuration sides. When there is an increase or decrease in personnel, or a switch in personnel roles or role permissions in the project, if the project configuration attributes or database configuration attributes are first modified once and then all related users are adaptively modified, then even if the adaptive modifications of all related users are not fully completed, it is difficult for data leakage accidents to occur, thereby achieving the purpose of reducing the risk of data leakage.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present invention provides a method for managing user rights of a cloud database, the method comprising:

[0006] Set a corresponding database configuration attribute for each cloud database; set a corresponding project configuration attribute for each scientific research project; and set a corresponding user configuration attribute for each user;

[0007] Upon receiving a first access application sent by a first user, extracting a corresponding first user identifier, a first database name, a first project identifier and a first operation type from the first access application; and using the user configuration attributes, the database configuration attributes and the project configuration attributes corresponding to the first user identifier, the first database name and the first project identifier as corresponding current user configuration attributes, current database configuration attributes and current project configuration attributes;

[0008] Based on the current user configuration attribute, the current project configuration attribute and the current database configuration attribute, the operation permission of the first operation type is confirmed to obtain a corresponding first confirmation result; the first confirmation result includes prohibition and permission;

[0009] The first confirmation result is identified; if the first confirmation result is allowed, the first access application is sent to a preset database operation processing interface; if the first confirmation result is prohibited, the corresponding first application feedback is set to operation authority prohibited, and the first application feedback with the setting completed is sent back to the first user.

[0010] Preferably, the database configuration attributes include database name, database purpose and role operation permission configuration table; the database name is the unique name of the corresponding cloud database; the database purpose includes shared and dedicated, when it is shared, it means that the corresponding cloud database is a shared database, and when it is dedicated, it means that the corresponding cloud database is a dedicated database for the scientific research project; each column of the role operation permission configuration table corresponds to a type of database operation of the corresponding cloud database, and each row corresponds to a type of database role of the corresponding cloud database; each configuration table unit of the role operation permission configuration table is a corresponding permission configuration s i,j , 1≤column index i≤N, 1≤row index j≤M, N is the total number of operation types of the corresponding cloud database, and M is the total number of role types of the corresponding cloud database; the permission configuration s i,j The value of includes 0 and 1. When it is 0, it indicates that the operation permission of the i-th database operation of the j-th database role of the corresponding cloud database is prohibited. When it is 1, it indicates that the operation permission of the i-th database operation of the j-th database role of the corresponding cloud database is allowed.

[0011] The project configuration attributes include a project identifier, a database configuration set and a personnel configuration set; the project identifier is a unique identifier of the corresponding scientific research project; the database configuration set consists of one or more special database names, each of which matches the database name of a special database under the corresponding scientific research project; the personnel configuration set consists of one or more database personnel configurations; the database personnel configurations of the personnel configuration set correspond one-to-one to the special database names of the database configuration set; the database personnel configuration consists of multiple role personnel configurations, and the role personnel configuration consists of a special database role and a personnel identification set; the special database role matches a class of database roles of the special database corresponding to the corresponding special database name; the personnel identification set consists of one or more personnel identifications, each of which matches the user identification of a user;

[0012] The user configuration attributes include user identifier, shared configuration set and project configuration set; the shared configuration set consists of one or more shared database configurations; each shared database configuration corresponds to a shared database; the shared database configuration consists of a shared database name and a shared database role; the shared database name is the database name of the corresponding shared database; the shared database role corresponds to a class of database roles of the corresponding shared database; when the project configuration set is not empty, it consists of one or more belonging project identifiers; each belonging project identifier matches the project identifier of a scientific research project.

[0013] Preferably, the first access application at least includes the first user identifier, the first database name, the first project identifier, the first operation type and a first operation parameter;

[0014] The first user identifier is the user identifier of the current first user; the first user identifier cannot be empty;

[0015] The first database name is the database name of the cloud database that the first user currently applies to access; the first database name cannot be empty;

[0016] When the first project identifier is empty, it indicates that the cloud database corresponding to the first database name is a shared database; when the first project identifier is not empty, it matches the project identifier of the scientific research project in which the first user is currently located;

[0017] The first operation type is a type of database operation of the cloud database currently being accessed; the first operation type cannot be empty;

[0018] When the first operation parameter is empty, it means that the database operation currently applied for does not require additional operation processing parameters; when the first operation parameter is not empty, it is the operation processing parameter corresponding to the database operation currently applied for.

[0019] Preferably, the using the user configuration attributes, the database configuration attributes and the project configuration attributes corresponding to the first user identifier, the first database name and the first project identifier as the corresponding current user configuration attributes, current database configuration attributes and current project configuration attributes specifically includes:

[0020] taking the user configuration attribute that matches the user identifier with the first user identifier as the corresponding current user configuration attribute;

[0021] and taking the database configuration attribute whose database name matches the first database name as the corresponding current database configuration attribute;

[0022] And identify whether the first project identifier is empty; if so, set the corresponding current project configuration attribute to empty; if not, use the project configuration attribute that matches the project identifier with the first project identifier as the corresponding current project configuration attribute.

[0023] Preferably, the confirming the operation authority of the first operation type based on the current user configuration attribute, the current project configuration attribute and the current database configuration attribute to obtain a corresponding first confirmation result specifically includes:

[0024] Step 51, identifying whether the current project configuration attribute is empty; if the current project configuration attribute is empty, go to step 52; if the current project configuration attribute is not empty, go to step 54;

[0025] Step 52, taking the shared database configuration whose shared database name matches the first database name in the shared configuration set of the current user configuration attribute as the corresponding current shared database configuration; and identifying whether the current shared database configuration is empty; if so, setting the corresponding first confirmation result to prohibited, and going to step 57; if not, taking the shared database role of the current shared database configuration as the corresponding current shared database role, and going to step 53;

[0026] Step 53, identifying whether the database purpose of the current database configuration attribute is shared; if not, setting the corresponding first confirmation result to prohibited, and going to step 57; if so, recording the row corresponding to the current shared database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and setting the permission configuration table corresponding to the first operation type on the current corresponding row to the current corresponding row. i,j Extract it as the corresponding current permission configuration, and identify the current permission configuration. If the current permission configuration is 0, set the corresponding first confirmation result to prohibit; if the current permission configuration is 1, set the corresponding first confirmation result to allow, and go to step 57;

[0027] Step 54, confirm whether there is the belonging project identifier matching the first project identifier in the project configuration set of the current user configuration attribute; if it is confirmed that it does not exist, set the corresponding first confirmation result to prohibition, and go to step 57; if it is confirmed that it exists, use the dedicated database name matching the first database name in the database configuration set of the current project configuration attribute as the corresponding current dedicated database name, and identify whether the current dedicated database name is empty, if so, set the corresponding first confirmation result to prohibition and go to step 57, otherwise, use the database personnel configuration corresponding to the current dedicated database name in the personnel configuration set of the current project configuration attribute as the corresponding current database personnel configuration and go to step 55;

[0028] Step 55, confirming whether there is a personnel identification set of the role personnel configuration in the current database personnel configuration in which there is a personnel identification that matches the first user identification; if confirmed as no, setting the corresponding first confirmation result to prohibited, and going to step 57; if confirmed as yes, taking the personnel identification set in which there is a personnel identification that matches the first user identification in the current database personnel configuration as the corresponding matching personnel identification set, and taking the dedicated database role corresponding to the matching personnel identification set as the corresponding current dedicated database role, and going to step 56;

[0029] Step 56, identifying whether the database purpose of the current database configuration attribute is dedicated; if not, setting the corresponding first confirmation result to prohibition; if so, recording the row corresponding to the current dedicated database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and setting the permission configuration table corresponding to the first operation type on the current corresponding row to prohibition. i,jExtract it as the corresponding current permission configuration, and identify the current permission configuration, if the current permission configuration is 0, set the corresponding first confirmation result to prohibit, if the current permission configuration is 1, set the corresponding first confirmation result to allow;

[0030] Step 57: Return the first confirmation result obtained as the confirmation result of this operation authority.

[0031] A second aspect of an embodiment of the present invention provides a device for implementing the user authority management method of a cloud database as described in the first aspect, the device comprising: a multi-side configuration module, an access application preprocessing module, a user authority confirmation module, and an access application processing module;

[0032] The multi-side configuration module is used to set a corresponding database configuration attribute for each cloud database; and set a corresponding project configuration attribute for each scientific research project; and set a corresponding user configuration attribute for each user;

[0033] The access application preprocessing module is used for, upon receiving a first access application sent by a first user, extracting a corresponding first user identifier, a first database name, a first project identifier and a first operation type from the first access application; and using the user configuration attributes, the database configuration attributes and the project configuration attributes corresponding to the first user identifier, the first database name and the first project identifier as corresponding current user configuration attributes, current database configuration attributes and current project configuration attributes;

[0034] The user authority confirmation module is used to confirm the operation authority of the first operation type based on the current user configuration attribute, the current project configuration attribute and the current database configuration attribute to obtain a corresponding first confirmation result; the first confirmation result includes prohibition and permission;

[0035] The access application processing module is used to identify the first confirmation result; if the first confirmation result is allowed, the first access application is sent to a preset database operation processing interface; if the first confirmation result is prohibited, the corresponding first application feedback is set to operation authority prohibited, and the first application feedback with the setting completed is sent back to the first user.

[0036] A third aspect of an embodiment of the present invention provides an electronic device, including: a memory, a processor, and a transceiver;

[0037] The processor is used to be coupled to the memory, read and execute instructions in the memory, so as to implement the method steps described in the first aspect above;

[0038] The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

[0039] A fourth aspect of an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions. When the computer instructions are executed by a computer, the computer executes the instructions of the method described in the first aspect above.

[0040] The embodiment of the present invention provides a method, device, electronic device and computer-readable storage medium for managing user rights of a cloud database. As can be seen from the above content, the embodiment of the present invention changes the traditional user-side configuration mode to a multi-side configuration mode, namely: setting a corresponding database configuration attribute for each cloud database, setting a corresponding project configuration attribute for each scientific research project, setting a corresponding user configuration attribute for each user, and unifying the user's database operation permission settings in the shared / dedicated database into the database configuration attribute for one-time setting, and unifying the user's database role settings in the dedicated database into the project configuration attribute for one-time setting. The user authority management mechanism implemented in the embodiment of the present invention based on the multi-side configuration method is: after receiving the first access application sent by the first user, the corresponding first user identifier, the first database name, the first project identifier and the first operation type are extracted therefrom; and the user configuration attributes, database configuration attributes and project configuration attributes corresponding to the first user identifier, the first database name and the first project identifier are used as the corresponding current user configuration attributes, the current database configuration attributes and the current project configuration attributes; and based on the current user configuration attributes, the current project configuration attributes and the current database configuration attributes, the operation authority of the first operation type is confirmed to obtain the corresponding first confirmation result; and when the first confirmation result is allowed, the first access application is sent to the preset database operation processing interface; and when the first confirmation result is prohibited, the corresponding first application feedback is set to operation authority prohibited, and the first application feedback with the completed setting is sent back to the first user. The improved multi-side configuration method according to the embodiment of the present invention reduces the amount of redundant data and the waste rate of storage resources on the one hand, and reduces the difficulty of configuration change, improves the efficiency of configuration change, and reduces the configuration error rate when the project configuration changes on the other hand; the user authority management mechanism implemented based on the multi-side configuration method according to the embodiment of the present invention will perform multiple verifications on the user, project and database configuration sides. When there is an increase or decrease in personnel, or a switch in personnel roles or role permissions in the project, if the project configuration attributes or database configuration attributes are modified once and then all related users are adaptively modified, even if the adaptive modifications of all related users are not completed, it is difficult for data leakage accidents to occur. In other words, the user authority management mechanism provided based on the implementation of the present invention reduces the risk of data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A schematic diagram of a method for managing user rights of a cloud database provided in Embodiment 1 of the present invention;

[0042] Figure 2 A schematic diagram of the data structure of user configuration attributes, project configuration attributes and database configuration attributes provided in the first embodiment of the present invention;

[0043] Figure 3 A schematic diagram of an example of the corresponding relationship between users, cloud databases and scientific research projects provided in the first embodiment of the present invention;

[0044] Figure 4 A module structure diagram of a user rights management device for a cloud database provided in Embodiment 2 of the present invention;

[0045] Figure 5 A schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] Embodiment 1 of the present invention provides a method for managing user rights of a cloud database. Figure 1 As shown in the schematic diagram of a user rights management method for a cloud database provided in the first embodiment of the present invention, the method mainly includes the following steps:

[0048] Step 1: set a corresponding database configuration attribute for each cloud database; set a corresponding project configuration attribute for each scientific research project; and set a corresponding user configuration attribute for each user.

[0049] Here, the embodiment of the present invention changes the traditional user-side configuration method to a multi-side configuration method, that is, setting a corresponding database configuration attribute for each cloud database, setting a corresponding project configuration attribute for each scientific research project, and setting a corresponding user configuration attribute for each user.

[0050] The database configuration attributes of the embodiment of the present invention include a database name, a database purpose, and a role operation permission configuration table; wherein the database name is the unique name of the corresponding cloud database; the database purpose includes shared and dedicated, and when it is shared, it means that the corresponding cloud database is a shared database, and when it is dedicated, it means that the corresponding cloud database is a dedicated database for a scientific research project; each column of the role operation permission configuration table corresponds to a type of database operation of the corresponding cloud database, and each row corresponds to a type of database role of the corresponding cloud database; each configuration table unit of the role operation permission configuration table is a corresponding permission configuration s i,j , 1≤column index i≤N, 1≤row index j≤M, N is the total number of operation types of the corresponding cloud database, M is the total number of role types of the corresponding cloud database; permission configuration s i,j The value of includes 0 and 1. When it is 0, it means that the operation permission of the i-th database operation of the j-th database role of the corresponding cloud database is prohibited. When it is 1, it means that the operation permission of the i-th database operation of the j-th database role of the corresponding cloud database is allowed. Figure 2 The data structure diagram of the user configuration attributes, project configuration attributes and database configuration attributes provided in the first embodiment of the present invention can be intuitively viewed through Figure 2 Understand database configuration properties.

[0051] The project configuration attributes of the embodiment of the present invention include a project identifier, a database configuration set and a personnel configuration set; wherein the project identifier is a unique identifier of the corresponding scientific research project; the database configuration set consists of one or more special database names, each of which matches the database name of a special database under the corresponding scientific research project; the personnel configuration set consists of one or more database personnel configurations; the database personnel configuration of the personnel configuration set corresponds one-to-one with the special database name of the database configuration set; the database personnel configuration consists of multiple role personnel configurations, and the role personnel configuration consists of a special database role and a personnel identification set; the special database role matches a class of database roles of the special database corresponding to the corresponding special database name; the personnel identification set consists of one or more personnel identifications, each of which matches the user identification of a user. It can be intuitively achieved through Figure 2 Understand the project configuration properties.

[0052] The user configuration attributes of the embodiment of the present invention include user identification, shared configuration set and project configuration set; the shared configuration set is composed of one or more shared database configurations; each shared database configuration corresponds to a shared database; the shared database configuration is composed of a shared database name and a shared database role; the shared database name is the database name of the corresponding shared database; the shared database role corresponds to a class of database roles of the corresponding shared database; when the project configuration set is not empty, it is composed of one or more belonging project identifications; each belonging project identification matches the project identification of a scientific research project. It can be intuitively Figure 2 Understand user configuration properties.

[0053] It should be noted that, it is not difficult to see from the above content that the multi-side configuration method of the embodiment of the present invention greatly simplifies the user configuration attributes. The configuration method according to the embodiment of the present invention can reduce a large amount of repetitive configuration on the user side, thereby reducing the amount of redundant data and reducing the waste rate of storage resources.

[0054] It should also be noted that, based on the multi-side configuration method provided in the embodiment of the present invention, multiple corresponding relationships can be easily configured between users, cloud databases and scientific research projects, such as forming a one-to-one or one-to-many corresponding relationship between users and shared / dedicated cloud databases, and forming a one-to-one or one-to-many corresponding relationship between users and scientific research projects. Figure 3 The schematic diagram of the example of the corresponding relationship between the user, the cloud database and the scientific research project provided in the first embodiment of the present invention can be intuitively viewed through Figure 3 The examples given are used to understand how to flexibly set various corresponding relationships based on the embodiments of the present invention.

[0055] Step 2, upon receiving a first access request sent by a first user, extracting a corresponding first user identifier, a first database name, a first project identifier, and a first operation type from the first access request; and using the user configuration attributes, database configuration attributes, and project configuration attributes corresponding to the first user identifier, the first database name, and the first project identifier as corresponding current user configuration attributes, current database configuration attributes, and current project configuration attributes;

[0056] Specifically comprising: step 21, upon receiving a first access application sent by a first user, extracting a corresponding first user identifier, a first database name, a first project identifier and a first operation type from the first access application;

[0057] Here, the first access application of the embodiment of the present invention at least includes a first application source address, a first user identifier, a first database name, a first project identifier, a first operation type and a first operation parameter; wherein the first application source address is the application / feedback message sending and receiving address of the browser, client or APP used by the current first user to send the current first access application; the first user identifier is the user identifier of the current first user, and the first user identifier cannot be empty; the first database name is the database name of the cloud database that the current first user currently applies to access, and the first database name cannot be empty; the first project identifier can be empty, and when the first project identifier is empty, it indicates that the first database name is The corresponding cloud database is a shared database. When the first project identifier is not empty, the first project identifier matches the project identifier of a scientific research project in which the current first user is located. The first operation type is a type of database operation of the cloud database currently being accessed, and the first operation type cannot be empty. The first operation parameter can be empty. When the first operation parameter is empty, it indicates that the currently applied database operation does not require additional operation processing parameters, such as a database full database deletion operation can be performed without any parameters. When the first operation parameter is not empty, the first operation parameter is an operation processing parameter corresponding to the currently applied database operation, such as a query keyword that must be carried by a database query operation.

[0058] Step 22, and taking the user configuration attributes, database configuration attributes and project configuration attributes corresponding to the first user identifier, the first database name and the first project identifier as the corresponding current user configuration attributes, current database configuration attributes and current project configuration attributes;

[0059] Specifically, it includes: step 221, taking the user configuration attribute that matches the user identifier with the first user identifier as the corresponding current user configuration attribute;

[0060] Step 222, and taking the database configuration attribute whose database name matches the first database name as the corresponding current database configuration attribute;

[0061] Step 223, and identify whether the first project identifier is empty; if so, set the corresponding current project configuration attribute to empty; if not, use the project configuration attribute whose project identifier matches the first project identifier as the corresponding current project configuration attribute;

[0062] Step 3: confirming the operation authority of the first operation type based on the current user configuration attribute, the current project configuration attribute and the current database configuration attribute to obtain a corresponding first confirmation result;

[0063] Among them, the first confirmation result includes prohibition and permission;

[0064] Specifically, the method includes: step 31, identifying whether the current project configuration attribute is empty; if the current project configuration attribute is empty, then going to step 32; if the current project configuration attribute is not empty, then going to step 34;

[0065] Here, when the current project configuration attribute is empty, it means that the cloud database that the current first user's first access application expects to access is a shared database. On the contrary, when the current project configuration attribute is not empty, it means that the cloud database that the current first user's first access application expects to access is a dedicated database.

[0066] Step 32, taking the shared database configuration whose shared database name matches the first database name in the shared configuration set of the current user configuration attribute as the corresponding current shared database configuration; and identifying whether the current shared database configuration is empty; if so, setting the corresponding first confirmation result to prohibited, and going to step 37; if not, taking the shared database role of the current shared database configuration as the corresponding current shared database role, and going to step 33;

[0067] Step 33, identify whether the database purpose of the current database configuration attribute is shared; if not, set the corresponding first confirmation result to prohibited, and go to step 37; if so, record the row corresponding to the current shared database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and set the permission configuration s corresponding to the first operation type on the current corresponding row. i,j Extract it as the corresponding current permission configuration, and identify the current permission configuration. If the current permission configuration is 0, set the corresponding first confirmation result to prohibit; if the current permission configuration is 1, set the corresponding first confirmation result to allow, and go to step 37;

[0068] Step 34, confirm whether there is an attribution project identifier matching the first project identifier in the project configuration set of the current user configuration attribute; if it is confirmed that it does not exist, set the corresponding first confirmation result to prohibition, and go to step 37; if it is confirmed that it exists, use the dedicated database name matching the first database name in the database configuration set of the current project configuration attribute as the corresponding current dedicated database name, and identify whether the current dedicated database name is empty, if so, set the corresponding first confirmation result to prohibition and go to step 37, if not, use the database personnel configuration corresponding to the current dedicated database name in the personnel configuration set of the current project configuration attribute as the corresponding current database personnel configuration and go to step 35;

[0069] Step 35, confirming whether there is a personnel identification set of a role personnel configuration in the database personnel configuration that has a personnel identification that matches the first user identification; if it is confirmed to be no, setting the corresponding first confirmation result to be prohibited, and going to step 37; if it is confirmed to be yes, taking the personnel identification set in which there is a personnel identification that matches the first user identification in the database personnel configuration as the corresponding matching personnel identification set, and taking the dedicated database role corresponding to the matching personnel identification set as the corresponding current dedicated database role, and going to step 36;

[0070] Step 36, identify whether the database purpose of the current database configuration attribute is dedicated; if not, set the corresponding first confirmation result to prohibit; if so, record the row corresponding to the current dedicated database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and set the permission configuration table corresponding to the first operation type on the current corresponding row to prohibit. i,j Extract it as the corresponding current permission configuration, and identify the current permission configuration. If the current permission configuration is 0, set the corresponding first confirmation result to prohibit; if the current permission configuration is 1, set the corresponding first confirmation result to allow;

[0071] Step 37: Return the first confirmation result obtained as the confirmation result of this operation authority.

[0072] Step 4, identify the first confirmation result; if the first confirmation result is allowed, send the first access application to the preset database operation processing interface; if the first confirmation result is prohibited, set the corresponding first application feedback as operation authority prohibited, and send the completed first application feedback back to the first user.

[0073] Here, the database operation processing interface of the embodiment of the present invention is a pre-set processing interface, which will perform a database operation corresponding to the first operation type on the cloud database specified by the first database name in the first access application, and use the first operation parameter as the input parameter of this database operation. After completing this database operation, the processing interface will directly send the obtained operation feedback back to the message receiving and sending address specified by the first application source address in the first access application. When sending the completed first application feedback back to the first user, the embodiment of the present invention also sends the first application feedback back to the message receiving and sending address specified by the first application source address in the first access application.

[0074] Figure 4 This is a module structure diagram of a user rights management device for a cloud database provided in the second embodiment of the present invention. The device is a terminal device or server that implements the aforementioned method embodiment, or can be a device that enables the aforementioned terminal device or server to implement the aforementioned method embodiment. For example, the device can be a device or chip system of the aforementioned terminal device or server. Figure 4 As shown, the device includes: a multi-side configuration module 201, an access application pre-processing module 202, a user authority confirmation module 203 and an access application processing module 204.

[0075] The multi-side configuration module 201 is used to set a corresponding database configuration attribute for each cloud database; set a corresponding project configuration attribute for each scientific research project; and set a corresponding user configuration attribute for each user.

[0076] The access application preprocessing module 202 is used to extract the corresponding first user identifier, first database name, first project identifier and first operation type from the first access application when receiving the first access application sent by the first user; and use the user configuration attributes, database configuration attributes and project configuration attributes corresponding to the first user identifier, first database name and first project identifier as the corresponding current user configuration attributes, current database configuration attributes and current project configuration attributes.

[0077] The user authority confirmation module 203 is used to confirm the operation authority of the first operation type based on the current user configuration attributes, the current project configuration attributes and the current database configuration attributes to obtain a corresponding first confirmation result; the first confirmation result includes prohibition and permission.

[0078] The access application processing module 204 is used to identify the first confirmation result; if the first confirmation result is allowed, the first access application is sent to the preset database operation processing interface; if the first confirmation result is prohibited, the corresponding first application feedback is set to operation authority prohibited, and the first application feedback with the completed setting is sent back to the first user.

[0079] A user authority management device for a cloud database provided in an embodiment of the present invention can execute the method steps in the above method embodiment, and its implementation principle and technical effects are similar, which will not be repeated here.

[0080] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example, the multi-side configuration module can be a separately established processing element, or it can be integrated in a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a processing element of the above device. The function of the above-determined module. The implementation of other modules is similar. In addition, these modules can be integrated together in whole or in part, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0081] For example, the above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), or one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA). For another example, when a module above is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0082] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the above method embodiments are generated. The above computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The above-mentioned computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the above-mentioned computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, Bluetooth, microwave, etc.) methods. The above-mentioned computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated. The above-mentioned available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (SSD)), etc.

[0083] Figure 5 This is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present invention. The electronic device may be a terminal device or a server for implementing the method of the aforementioned embodiment, or may be a terminal device or a server for implementing the method of the aforementioned embodiment connected to the aforementioned terminal device or server. Figure 5 As shown, the electronic device may include: a processor 301 (such as a CPU), a memory 302, and a transceiver 303; the transceiver 303 is coupled to the processor 301, and the processor 301 controls the transceiver 303. Various instructions may be stored in the memory 302 to complete various processing functions and implement the processing steps described in the aforementioned embodiment method. Preferably, the electronic device involved in the embodiment of the present invention also includes: a power supply 304, a system bus 305 and a communication port 306. The system bus 305 is used to realize the communication connection between components. The above-mentioned communication port 306 is used for connecting and communicating between the electronic device and other peripherals.

[0084] exist Figure 5The system bus 305 mentioned in the figure can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The communication interface is used to realize the communication between the database access device and other devices (such as clients, read-write libraries, and read-only libraries). The memory may include random access memory (RAM), and may also include non-volatile memory (Non-Volatile Memory), such as at least one disk storage.

[0085] The above-mentioned processor can be a general-purpose processor, including a central processing unit CPU, a network processor (Network Processor, NP), a graphics processing unit (Graphics Processing Unit, GPU), etc.; it can also be a digital signal processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0086] It should be noted that an embodiment of the present invention further provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the method and processing process provided in the above embodiments.

[0087] The embodiment of the present invention provides a method, device, electronic device and computer-readable storage medium for managing user rights of a cloud database. As can be seen from the above content, the embodiment of the present invention changes the traditional user-side configuration mode to a multi-side configuration mode, namely: setting a corresponding database configuration attribute for each cloud database, setting a corresponding project configuration attribute for each scientific research project, setting a corresponding user configuration attribute for each user, and unifying the user's database operation permission settings in the shared / dedicated database into the database configuration attribute for one-time setting, and unifying the user's database role settings in the dedicated database into the project configuration attribute for one-time setting. The user authority management mechanism implemented in the embodiment of the present invention based on the multi-side configuration method is: after receiving the first access application sent by the first user, the corresponding first user identifier, the first database name, the first project identifier and the first operation type are extracted therefrom; and the user configuration attributes, database configuration attributes and project configuration attributes corresponding to the first user identifier, the first database name and the first project identifier are used as the corresponding current user configuration attributes, the current database configuration attributes and the current project configuration attributes; and based on the current user configuration attributes, the current project configuration attributes and the current database configuration attributes, the operation authority of the first operation type is confirmed to obtain the corresponding first confirmation result; and when the first confirmation result is allowed, the first access application is sent to the preset database operation processing interface; and when the first confirmation result is prohibited, the corresponding first application feedback is set to operation authority prohibited, and the first application feedback with the completed setting is sent back to the first user. The improved multi-side configuration method according to the embodiment of the present invention reduces the amount of redundant data and the waste rate of storage resources on the one hand, and reduces the difficulty of configuration change, improves the efficiency of configuration change, and reduces the configuration error rate when the project configuration changes on the other hand; the user authority management mechanism implemented based on the multi-side configuration method according to the embodiment of the present invention will perform multiple verifications on the user, project and database configuration sides. When there is an increase or decrease in personnel, or a switch in personnel roles or role permissions in the project, if the project configuration attributes or database configuration attributes are modified once and then all related users are adaptively modified, even if the adaptive modifications of all related users are not completed, it is difficult for data leakage accidents to occur. In other words, the user authority management mechanism provided based on the implementation of the present invention reduces the risk of data leakage.

[0088] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0089] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for managing user rights of a cloud database, characterized in that: The method comprises: Set a corresponding database configuration attribute for each cloud database; set a corresponding project configuration attribute for each scientific research project; and set a corresponding user configuration attribute for each user; Upon receiving a first access application sent by a first user, extracting a corresponding first user identifier, a first database name, a first project identifier and a first operation type from the first access application; and using the user configuration attributes, the database configuration attributes and the project configuration attributes corresponding to the first user identifier, the first database name and the first project identifier as corresponding current user configuration attributes, current database configuration attributes and current project configuration attributes; Based on the current user configuration attribute, the current project configuration attribute and the current database configuration attribute, the operation permission of the first operation type is confirmed to obtain a corresponding first confirmation result; the first confirmation result includes prohibition and permission; The first confirmation result is identified; if the first confirmation result is allowed, the first access application is sent to a preset database operation processing interface; if the first confirmation result is prohibited, the corresponding first application feedback is set to operation authority prohibited, and the first application feedback with the setting completed is sent back to the first user.

2. The user rights management method of a cloud database according to claim 1, characterized in that: The database configuration attributes include database name, database purpose and role operation permission configuration table; the database name is the unique name of the corresponding cloud database; the database purpose includes shared and dedicated, when it is shared, it means that the corresponding cloud database is a shared database, and when it is dedicated, it means that the corresponding cloud database is a dedicated database for the scientific research project; each column of the role operation permission configuration table corresponds to a type of database operation of the corresponding cloud database, and each row corresponds to a type of database role of the corresponding cloud database; each configuration table unit of the role operation permission configuration table is a corresponding permission configuration s i,j , 1≤column index i≤N, 1≤row index j≤M, N is the total number of operation types of the corresponding cloud database, and M is the total number of role types of the corresponding cloud database; the permission configuration s i,j The value of includes 0 and 1. When it is 0, it indicates that the operation permission of the i-th type of database operation of the j-th type of database role of the corresponding cloud database is prohibited. When it is 1, it indicates that the operation permission of the i-th type of database operation of the j-th type of database role of the corresponding cloud database is allowed. The project configuration attributes include a project identifier, a database configuration set and a personnel configuration set; the project identifier is a unique identifier of the corresponding scientific research project; the database configuration set consists of one or more special database names, each of which matches the database name of a special database under the corresponding scientific research project; the personnel configuration set consists of one or more database personnel configurations; the database personnel configurations of the personnel configuration set correspond one-to-one to the special database names of the database configuration set; the database personnel configuration consists of multiple role personnel configurations, and the role personnel configuration consists of a special database role and a personnel identification set; the special database role matches a class of database roles of the special database corresponding to the corresponding special database name; the personnel identification set consists of one or more personnel identifications, each of which matches the user identification of a user; The user configuration attributes include user identifier, shared configuration set and project configuration set; the shared configuration set consists of one or more shared database configurations; each shared database configuration corresponds to a shared database; the shared database configuration consists of a shared database name and a shared database role; the shared database name is the database name of the corresponding shared database; the shared database role corresponds to a class of database roles of the corresponding shared database; when the project configuration set is not empty, it consists of one or more belonging project identifiers; each belonging project identifier matches the project identifier of a scientific research project.

3. The user rights management method of a cloud database according to claim 2, characterized in that: The first access application at least includes the first user identifier, the first database name, the first project identifier, the first operation type and a first operation parameter; The first user identifier is the user identifier of the current first user; The first user ID cannot be empty; The first database name is the database name of the cloud database that the first user currently applies to access; the first database name cannot be empty; When the first project identifier is empty, it indicates that the cloud database corresponding to the first database name is a shared database; when the first project identifier is not empty, it matches the project identifier of the scientific research project in which the first user is currently located; The first operation type is a type of database operation of the cloud database currently being accessed; the first operation type cannot be empty; When the first operation parameter is empty, it means that the database operation currently applied for does not require additional operation processing parameters; when the first operation parameter is not empty, it is the operation processing parameter corresponding to the database operation currently applied for.

4. The user rights management method of a cloud database according to claim 3, characterized in that: The method of using the user configuration attributes, the database configuration attributes, and the project configuration attributes corresponding to the first user identifier, the first database name, and the first project identifier as corresponding current user configuration attributes, current database configuration attributes, and current project configuration attributes specifically includes: taking the user configuration attribute that matches the user identifier with the first user identifier as the corresponding current user configuration attribute; and taking the database configuration attribute whose database name matches the first database name as the corresponding current database configuration attribute; And identify whether the first project identifier is empty; if so, set the corresponding current project configuration attribute to empty; if not, use the project configuration attribute that matches the project identifier with the first project identifier as the corresponding current project configuration attribute.

5. The user rights management method of a cloud database according to claim 2, characterized in that: The step of confirming the operation authority of the first operation type based on the current user configuration attribute, the current project configuration attribute, and the current database configuration attribute to obtain a corresponding first confirmation result specifically includes: Step 51, identifying whether the current project configuration attribute is empty; if the current project configuration attribute is empty, go to step 52; if the current project configuration attribute is not empty, go to step 54; Step 52, taking the shared database configuration whose shared database name matches the first database name in the shared configuration set of the current user configuration attribute as the corresponding current shared database configuration; and identifying whether the current shared database configuration is empty; if so, setting the corresponding first confirmation result to prohibited, and going to step 57; if not, taking the shared database role of the current shared database configuration as the corresponding current shared database role, and going to step 53; Step 53, identifying whether the database purpose of the current database configuration attribute is shared; if not, setting the corresponding first confirmation result to prohibited, and going to step 57; if so, recording the row corresponding to the current shared database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and setting the permission configuration table corresponding to the first operation type on the current corresponding row to the current corresponding row. i,j Extract it as the corresponding current permission configuration, and identify the current permission configuration. If the current permission configuration is 0, set the corresponding first confirmation result to prohibit; if the current permission configuration is 1, set the corresponding first confirmation result to allow, and go to step 57; Step 54, confirm whether there is the belonging project identifier matching the first project identifier in the project configuration set of the current user configuration attribute; if it is confirmed that it does not exist, set the corresponding first confirmation result to prohibition, and go to step 57; if it is confirmed that it exists, use the dedicated database name matching the first database name in the database configuration set of the current project configuration attribute as the corresponding current dedicated database name, and identify whether the current dedicated database name is empty, if so, set the corresponding first confirmation result to prohibition and go to step 57, otherwise, use the database personnel configuration corresponding to the current dedicated database name in the personnel configuration set of the current project configuration attribute as the corresponding current database personnel configuration and go to step 55; Step 55, confirming whether there is a personnel identification set of the role personnel configuration in the current database personnel configuration in which there is a personnel identification that matches the first user identification; if confirmed as no, setting the corresponding first confirmation result to prohibited, and going to step 57; if confirmed as yes, taking the personnel identification set in which there is a personnel identification that matches the first user identification in the current database personnel configuration as the corresponding matching personnel identification set, and taking the dedicated database role corresponding to the matching personnel identification set as the corresponding current dedicated database role, and going to step 56; Step 56, identifying whether the database purpose of the current database configuration attribute is dedicated; if not, setting the corresponding first confirmation result to prohibition; if so, recording the row corresponding to the current dedicated database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and setting the permission configuration table corresponding to the first operation type on the current corresponding row to prohibition. i,j Extract it as the corresponding current permission configuration, and identify the current permission configuration, if the current permission configuration is 0, set the corresponding first confirmation result to prohibit, if the current permission configuration is 1, set the corresponding first confirmation result to allow; Step 57: Return the first confirmation result obtained as the confirmation result of this operation authority.

6. A device for executing the user authority management method of a cloud database according to any one of claims 1 to 5, characterized in that: The device comprises: a multi-side configuration module, an access application pre-processing module, a user authority confirmation module and an access application processing module; The multi-side configuration module is used to set a corresponding database configuration attribute for each cloud database; and set a corresponding project configuration attribute for each scientific research project; and set a corresponding user configuration attribute for each user; The access application preprocessing module is used for, upon receiving a first access application sent by a first user, extracting a corresponding first user identifier, a first database name, a first project identifier and a first operation type from the first access application; and using the user configuration attributes, the database configuration attributes and the project configuration attributes corresponding to the first user identifier, the first database name and the first project identifier as corresponding current user configuration attributes, current database configuration attributes and current project configuration attributes; The user authority confirmation module is used to confirm the operation authority of the first operation type based on the current user configuration attribute, the current project configuration attribute and the current database configuration attribute to obtain a corresponding first confirmation result; the first confirmation result includes prohibition and permission; The access application processing module is used to identify the first confirmation result; if the first confirmation result is allowed, the first access application is sent to a preset database operation processing interface; if the first confirmation result is prohibited, the corresponding first application feedback is set to operation authority prohibited, and the first application feedback with the setting completed is sent back to the first user.

7. An electronic device, characterized in that: include: memory, processors, and transceivers; The processor is used to couple with the memory, read and execute instructions in the memory, so as to implement the method according to any one of claims 1 to 5; The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a computer, the computer is enabled to execute the method according to any one of claims 1 to 5.

Images