A user permission management method and device for a cloud database

Abstract

The embodiment of the present application relates to a kind of cloud database user authority management method and device, the method comprises: corresponding database / project / user configuration attribute is set for each cloud database / research project / user;When receiving the first access application sent by the first user, first user identifier, first database name, first project identifier and first operation type are extracted from it;And the user / database / project configuration attribute corresponding to the first user identifier, the first database name and the first project identifier is used as the corresponding current user / database / project configuration attribute;Operation authority confirmation is carried out to the first operation type based on current user / database / project configuration attribute;If it is confirmed to allow, then the first access application is sent to the preset database operation processing interface, if it is confirmed to prohibit, then the first application is sent back to the first user with the operation authority prohibition being set. Through the present application, storage resource waste can be reduced, and data leakage risk can be reduced.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and apparatus for user permission management in a cloud database. Background Technology

[0002] Research and technology platforms can establish shared databases in the cloud to provide public technical information sharing services for all platform users, and dedicated databases for research projects in the cloud to provide project technical information sharing services for all project members. To ensure that project technical information is not leaked, research and technology platforms should also provide a corresponding user access control mechanism for various cloud databases. Currently, most user access control mechanisms for cloud databases are still based on conventional user-side configuration methods. Simply put, user-side configuration methods involve setting all relevant information for each user in corresponding user attribute data through user attribute configuration. All relevant information mentioned here will include at least: 1) the current user's role information in each shared database (such as database creator, database administrator, ordinary access user, etc.), and the permission configuration information (allow / disallow) for the current user's role in the current shared database for various database operations (such as import, export, query, delete, etc.); 2) the basic project information of each research project in which the current user participates (such as project identifier, names of all dedicated databases corresponding to the project, etc.), and the project role information of the current user in each participating project (such as project creator, project administrator, ordinary project member, etc.), and the permission configuration information (allow / disallow) for the current user's project roles in each dedicated database for various database operations (such as import, export, query, delete, etc.).

[0003] Through observation, we found some problems with this conventional user-side configuration method: 1) Large amount of redundant data: We found that the configuration method of database operation permissions for each type of user / project role in the cloud database is the same, but the processing mechanism of the user-side configuration method requires configuring permissions for all database operation types for each user on each cloud database. This means that for multiple users of the same type of user / project role, multiple sets of duplicate permission configuration information will be stored in their user attribute data. As the number of users increases, a large amount of redundant data will inevitably be generated; 2) Poor real-time performance and high error rate of configuration changes: When personnel are added or removed from the project, or when personnel roles or role permissions are switched, the user attribute data of the changed personnel needs to be adaptively reconfigured. Reconfiguration according to the processing mechanism of the user-side configuration method requires modifying a series of project-related information (such as basic project information, project role information, permission configuration information, etc.) for each changed personnel item by item. Because there is a lot of information to modify and the modification complexity is high, when the number of personnel changing at one time is large, configuration is often not timely and the configuration error rate is high. These two types of problems will, on the one hand, cause a significant waste of storage resources for the user permission management mechanism, and on the other hand, they will also bring the risk of data leakage to the user permission management mechanism due to untimely or incorrect configuration modifications. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by providing a user permission management method, apparatus, electronic device, and computer-readable storage medium for cloud databases. This invention replaces the traditional user-side configuration method with a multi-side configuration method, namely: setting a corresponding database configuration attribute for each cloud database, a corresponding project configuration attribute for each research project, and a corresponding user configuration attribute for each user; and unifying the user's database operation permissions in shared / dedicated databases into a single database configuration attribute setting, and unifying the user's database role settings in dedicated databases into a single project configuration attribute setting. The user permission management mechanism implemented by this invention based on a multi-sided configuration method is as follows: After receiving a first access request sent by a first user, the corresponding first user identifier, first database name, first project identifier, and first operation type are extracted from it; the user configuration attributes, database configuration attributes, and project configuration attributes corresponding to the first user identifier, first database name, and first project identifier are used as the corresponding current user configuration attributes, current database configuration attributes, and current project configuration attributes; and the operation permission of the first operation type is confirmed based on the current user configuration attributes, current project configuration attributes, and current database configuration attributes to obtain the corresponding first confirmation result; if the first confirmation result is allowed, the first access request is sent to a preset database operation processing interface; and if the first confirmation result is prohibited, the corresponding first request feedback is set to operation permission prohibited, and the first request feedback with the completed setting is sent back to the first user. The improved multi-sided configuration method of this invention can reduce redundant data and storage resource waste, while also reducing the difficulty, efficiency, and error rate of configuration changes when project configurations change. The user permission management mechanism based on this invention performs multiple verifications on the user, project, and database configuration sides. When personnel are added or removed from a project, or when personnel roles or role permissions are switched, if the project configuration attributes or database configuration attributes are modified all at once before adaptive modifications are made to all associated users, data leakage is unlikely to occur even if all adaptive modifications to associated users are not completed. This effectively reduces the risk of data leakage.

[0005] To achieve the above objectives, a first aspect of the present invention provides a user permission management method for a cloud database, the method comprising:

[0006] Set a corresponding database configuration attribute for each cloud database; set a corresponding project configuration attribute for each research project; and set a corresponding user configuration attribute for each user.

[0007] Upon receiving the first access request from the first user, the first user identifier, first database name, first project identifier, and first operation type are extracted from the first access request; and the user configuration attribute, database configuration attribute, and project configuration attribute corresponding to the first user identifier, first database name, and first project identifier are used as the corresponding current user configuration attribute, current database configuration attribute, and current project configuration attribute.

[0008] Based on the current user configuration attributes, the current project configuration attributes, and the current database configuration attributes, the operation permission of the first operation type is confirmed to obtain a corresponding first confirmation result; the first confirmation result includes prohibition and permission;

[0009] The first confirmation result is identified; if the first confirmation result is allowed, the first access request is sent to the preset database operation processing interface; if the first confirmation result is prohibited, the corresponding first request feedback is set to operation permission prohibited, and the first request feedback with the completed setting is sent back to the first user.

[0010] Preferably, the database configuration attributes include a database name, database purpose, and a role operation permission configuration table; the database name is the unique name of the corresponding cloud database; the database purpose includes shared and dedicated, where shared indicates that the corresponding cloud database is a shared database, and dedicated indicates that the corresponding cloud database is a dedicated database for the research project; each column of the role operation permission configuration table corresponds to a type of database operation of the corresponding cloud database, and each row corresponds to a type of database role of the corresponding cloud database; each configuration table unit of the role operation permission configuration table is a corresponding permission configuration s. i,j 1 ≤ column index i ≤ N, 1 ≤ row index j ≤ M, N is the total number of operation types in the corresponding cloud database, and M is the total number of role types in the corresponding cloud database; the permission configuration s i,j The value includes 0 and 1. When it is 0, it means that the operation permission of the i-th type of database operation of the j-th type of database role in the cloud database is prohibited. When it is 1, it means that the operation permission of the i-th type of database operation of the j-th type of database role in the cloud database is allowed.

[0011] The project configuration attributes include a project identifier, a database configuration set, and a personnel configuration set; the project identifier is a unique identifier for the corresponding research project; the database configuration set consists of one or more dedicated database names, each dedicated database name matching the database name of a dedicated database under the corresponding research project; the personnel configuration set consists of one or more database personnel configurations; the database personnel configurations in the personnel configuration set correspond one-to-one with the dedicated database names in the database configuration set; the database personnel configurations consist of multiple role personnel configurations, each role personnel configuration consisting of a dedicated database role and a personnel identifier set; the dedicated database role matches a type of database role in the dedicated database corresponding to the dedicated database name; the personnel identifier set consists of one or more personnel identifiers, each personnel identifier matching a user identifier of a user;

[0012] The user configuration attributes include a user identifier, a shared configuration set, and a project configuration set; the shared configuration set consists of one or more shared database configurations; each shared database configuration corresponds to one shared database; each shared database configuration consists of a shared database name and a shared database role; the shared database name is the database name of the corresponding shared database; the shared database role corresponds to a type of database role of the corresponding shared database; when the project configuration set is not empty, it consists of one or more affiliated project identifiers; each affiliated project identifier matches the project identifier of one research project.

[0013] Preferably, the first access request includes at least the first user identifier, the first database name, the first project identifier, the first operation type, and the first operation parameters;

[0014] The first user identifier is the user identifier of the current first user; the first user identifier cannot be empty;

[0015] The first database name is the name of the cloud database that the first user is currently requesting to access; the first database name cannot be empty;

[0016] When the first project identifier is empty, it indicates that the cloud database corresponding to the first database name is a shared database; when the first project identifier is not empty, it matches the project identifier of a research project in which the first user is currently located.

[0017] The first operation type is a type of database operation of the cloud database currently requested for access; the first operation type cannot be empty;

[0018] When the first operation parameter is empty, it means that the database operation of the current application does not require additional operation processing parameters; when the first operation parameter is not empty, it is the operation processing parameter corresponding to the database operation of the current application.

[0019] Preferably, the step of using the user configuration attribute, database configuration attribute, and project configuration attribute corresponding to the first user identifier, the first database name, and the first project identifier as the corresponding current user configuration attribute, current database configuration attribute, and current project configuration attribute specifically includes:

[0020] The user configuration attribute that matches the first user identifier is taken as the corresponding current user configuration attribute;

[0021] And the database configuration attribute whose database name matches the first database name is taken as the corresponding current database configuration attribute;

[0022] It also identifies whether the first project identifier is empty; if so, it sets the corresponding current project configuration attribute to empty; if not, it uses the project configuration attribute that matches the first project identifier as the corresponding current project configuration attribute.

[0023] Preferably, the step of confirming the operation permission of the first operation type based on the current user configuration attribute, the current project configuration attribute, and the current database configuration attribute to obtain the corresponding first confirmation result specifically includes:

[0024] Step 51: Identify whether the current project configuration attribute is empty; if the current project configuration attribute is empty, proceed to step 52; if the current project configuration attribute is not empty, proceed to step 54.

[0025] Step 52: Take the shared database configuration whose shared database name matches the first database name in the shared configuration set of the current user configuration attributes as the corresponding current shared database configuration; and identify whether the current shared database configuration is empty; if yes, set the corresponding first confirmation result to prohibit, and go to step 57; if no, take the shared database role of the current shared database configuration as the corresponding current shared database role, and go to step 53.

[0026] Step 53: Identify whether the database purpose of the current database configuration attribute is shared; if not, set the corresponding first confirmation result to prohibited and proceed to step 57; if yes, record the row corresponding to the current shared database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and set the permission configuration s corresponding to the first operation type in the current corresponding row. i,j Extract the current permission configuration as the corresponding current permission configuration, and identify the current permission configuration. If the current permission configuration is 0, set the corresponding first confirmation result to prohibit; if the current permission configuration is 1, set the corresponding first confirmation result to allow, and proceed to step 57.

[0027] Step 54: Confirm whether there is an affiliated project identifier that matches the first project identifier in the project configuration set of the current user configuration attributes; if it is confirmed that there is no such identifier, set the corresponding first confirmation result to prohibit and proceed to step 57; if it is confirmed that there is such an identifier, take the dedicated database name that matches the first database name in the database configuration set of the current project configuration attributes as the corresponding current dedicated database name, and identify whether the current dedicated database name is empty. If it is, set the corresponding first confirmation result to prohibit and proceed to step 57; otherwise, take the database personnel configuration that matches the current dedicated database name in the personnel configuration set of the current project configuration attributes as the corresponding current database personnel configuration and proceed to step 55.

[0028] Step 55: Confirm whether there is a personnel identifier in the personnel identifier set of the role personnel configuration in the current database personnel configuration that matches the first user identifier; if the confirmation is negative, set the corresponding first confirmation result to prohibit and proceed to step 57; if the confirmation is positive, take the personnel identifier set in the current database personnel configuration that matches the first user identifier as the corresponding matching personnel identifier set, and take the dedicated database role corresponding to the matching personnel identifier set as the corresponding current dedicated database role, and proceed to step 56;

[0029] Step 56: Identify whether the database purpose of the current database configuration attribute is dedicated; if not, set the corresponding first confirmation result to prohibited; if yes, record the row corresponding to the current dedicated database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and set the permission configuration s corresponding to the first operation type in the current corresponding row. i,jExtract the current permission configuration as the corresponding current permission configuration, and identify the current permission configuration. If the current permission configuration is 0, set the corresponding first confirmation result to prohibit; if the current permission configuration is 1, set the corresponding first confirmation result to allow.

[0030] Step 57: Return the first confirmation result as the confirmation result for this operation permission.

[0031] A second aspect of the present invention provides an apparatus for implementing the cloud database user permission management method described in the first aspect above, the apparatus comprising: a multi-side configuration module, an access request preprocessing module, a user permission confirmation module, and an access request processing module;

[0032] The multi-side configuration module is used to set a corresponding database configuration attribute for each cloud database; and to set a corresponding project configuration attribute for each research project; and to set a corresponding user configuration attribute for each user.

[0033] The access request preprocessing module is used to extract the corresponding first user identifier, first database name, first project identifier, and first operation type from the first access request when it receives the first access request sent by the first user; and to use the user configuration attribute, database configuration attribute, and project configuration attribute corresponding to the first user identifier, first database name, and first project identifier as the corresponding current user configuration attribute, current database configuration attribute, and current project configuration attribute.

[0034] The user permission confirmation module is used to confirm the operation permission of the first operation type based on the current user configuration attributes, the current project configuration attributes, and the current database configuration attributes to obtain a corresponding first confirmation result; the first confirmation result includes prohibition and permission;

[0035] The access request processing module is used to identify the first confirmation result; if the first confirmation result is allowed, the first access request is sent to the preset database operation processing interface; if the first confirmation result is prohibited, the corresponding first request feedback is set to operation permission prohibited, and the first request feedback with the completed setting is sent back to the first user.

[0036] A third aspect of the present invention provides an electronic device, including: a memory, a processor, and a transceiver;

[0037] The processor is used to couple with the memory, read and execute instructions in the memory to implement the steps of the method described in the first aspect above;

[0038] The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

[0039] A fourth aspect of the present invention provides a computer-readable storage medium storing computer instructions that, when executed by a computer, cause the computer to perform the instructions described in the first aspect.

[0040] This invention provides a method, apparatus, electronic device, and computer-readable storage medium for managing user permissions in a cloud database. As described above, this invention replaces the traditional user-side configuration method with a multi-side configuration method. Specifically, it sets a corresponding database configuration attribute for each cloud database, a corresponding project configuration attribute for each research project, and a corresponding user configuration attribute for each user. Furthermore, it unifies the user's database operation permissions in shared / dedicated databases into a single database configuration attribute setting, and unifies the user's database role settings in dedicated databases into a single project configuration attribute setting. The user permission management mechanism implemented based on multi-side configuration in this embodiment of the invention is as follows: After receiving the first access request sent by the first user, the corresponding first user identifier, first database name, first project identifier, and first operation type are extracted from it; the user configuration attributes, database configuration attributes, and project configuration attributes corresponding to the first user identifier, first database name, and first project identifier are used as the corresponding current user configuration attributes, current database configuration attributes, and current project configuration attributes; the operation permission of the first operation type is confirmed based on the current user configuration attributes, current project configuration attributes, and current database configuration attributes to obtain the corresponding first confirmation result; when the first confirmation result is allowed, the first access request is sent to the preset database operation processing interface; when the first confirmation result is prohibited, the corresponding first request feedback is set to operation permission prohibited, and the first request feedback with the completed setting is sent back to the first user. The improved multi-sided configuration method of this invention reduces redundant data and storage resource waste, while also reducing the difficulty of configuration changes, improving efficiency, and lowering error rates when project configurations change. The user permission management mechanism implemented based on this invention performs multiple verifications on the user, project, and database configuration sides. When personnel are added or removed from a project, or when personnel roles or role permissions are switched, if the project configuration attributes or database configuration attributes are modified all at once before adaptive modifications are made to all associated users, data leakage is unlikely to occur even if all adaptive modifications to associated users are not completed. In other words, the user permission management mechanism provided by this invention reduces the risk of data leakage. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of a cloud database user permission management method provided in Embodiment 1 of the present invention;

[0042] Figure 2 This is a schematic diagram of the data structure of user configuration attributes, project configuration attributes, and database configuration attributes provided in Embodiment 1 of the present invention;

[0043] Figure 3 This is a schematic diagram illustrating an example of the correspondence between users, cloud databases, and scientific research projects provided in Embodiment 1 of the present invention;

[0044] Figure 4 This is a module structure diagram of a cloud database user permission management device provided in Embodiment 2 of the present invention;

[0045] Figure 5 This is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0047] Embodiment 1 of the present invention provides a user permission management method for a cloud database, such as... Figure 1 The schematic diagram shows a user permission management method for a cloud database provided in Embodiment 1 of the present invention. This method mainly includes the following steps:

[0048] Step 1: Set a corresponding database configuration attribute for each cloud database; set a corresponding project configuration attribute for each research project; and set a corresponding user configuration attribute for each user.

[0049] Here, the embodiments of the present invention change the traditional user-side configuration method to a multi-side configuration method, that is, set a corresponding database configuration attribute for each cloud database, set a corresponding project configuration attribute for each scientific research project, and set a corresponding user configuration attribute for each user.

[0050] The database configuration attributes in this embodiment of the invention include a database name, database purpose, and a role operation permission configuration table. The database name is the unique name of the corresponding cloud database. The database purpose includes shared and dedicated uses; shared uses indicate that the corresponding cloud database is a shared database, while dedicated uses indicate that the corresponding cloud database is a dedicated database for a research project. Each column of the role operation permission configuration table corresponds to a type of database operation in the corresponding cloud database, and each row corresponds to a type of database role in the corresponding cloud database. Each configuration table unit of the role operation permission configuration table is a corresponding permission configuration s. i,j 1 ≤ column index i ≤ N, 1 ≤ row index j ≤ M, N is the total number of operation types in the corresponding cloud database, and M is the total number of role types in the corresponding cloud database; permission configuration s i,j The value can be either 0 or 1. When it is 0, it means that the operation permission of the i-th type of database operation for the j-th type of database role in the corresponding cloud database is prohibited. When it is 1, it means that the operation permission of the i-th type of database operation for the j-th type of database role in the corresponding cloud database is allowed. Figure 2 This is a schematic diagram of the data structure of user configuration attributes, project configuration attributes, and database configuration attributes provided in Embodiment 1 of the present invention, which can be intuitively understood through... Figure 2 Understand the database configuration properties.

[0051] The project configuration attributes in this embodiment of the invention include a project identifier, a database configuration set, and a personnel configuration set. The project identifier is a unique identifier for the corresponding research project. The database configuration set consists of one or more dedicated database names, each matching the database name of a dedicated database under the corresponding research project. The personnel configuration set consists of one or more database personnel configurations. Each database personnel configuration in the personnel configuration set corresponds one-to-one with a dedicated database name in the database configuration set. Each database personnel configuration consists of multiple role personnel configurations, each consisting of a dedicated database role and a personnel identifier set. A dedicated database role matches a type of database role in the dedicated database corresponding to the dedicated database name. The personnel identifier set consists of one or more personnel identifiers, each matching a user identifier. This can be intuitively understood through… Figure 2 Understand the project configuration properties.

[0052] The user configuration attributes in this embodiment of the invention include a user identifier, a shared configuration set, and a project configuration set. The shared configuration set consists of one or more shared database configurations; each shared database configuration corresponds to a shared database; each shared database configuration consists of a shared database name and a shared database role; the shared database name is the database name of the corresponding shared database; the shared database role corresponds to a type of database role of the corresponding shared database; when the project configuration set is not empty, it consists of one or more affiliated project identifiers; each affiliated project identifier matches the project identifier of a research project. This can be intuitively understood through… Figure 2 Understand the user configuration attributes.

[0053] It should be noted that, as can be seen from the above, the multi-side configuration method of the present invention greatly simplifies the user configuration attributes. The configuration method according to the present invention can reduce a large amount of repetitive configuration on the user side, thereby reducing the amount of redundant data and reducing the waste rate of storage resources.

[0054] It should also be noted that, based on the multi-side configuration method given in the embodiments of the present invention, various correspondences can be easily configured between users, cloud databases and scientific research projects, such as forming a one-to-one or one-to-many correspondence between users and shared / dedicated cloud databases, and forming a one-to-one or one-to-many correspondence between users and scientific research projects. Figure 3 This is a schematic diagram illustrating the correspondence between users, cloud databases, and research projects provided in Embodiment 1 of the present invention, which can be intuitively understood through... Figure 3 The given examples illustrate how to flexibly set up various correspondences based on embodiments of the present invention.

[0055] Step 2: Upon receiving the first access request from the first user, extract the corresponding first user identifier, first database name, first project identifier, and first operation type from the first access request; and use the user configuration attributes, database configuration attributes, and project configuration attributes corresponding to the first user identifier, first database name, and first project identifier as the corresponding current user configuration attributes, current database configuration attributes, and current project configuration attributes.

[0056] Specifically, this includes: Step 21, upon receiving the first access request sent by the first user, extracting the corresponding first user identifier, first database name, first project identifier, and first operation type from the first access request;

[0057] Here, the first access request in this embodiment of the invention includes at least a first request source address, a first user identifier, a first database name, a first project identifier, a first operation type, and a first operation parameter; wherein, the first request source address is the request / feedback message sending and receiving address of the browser, client, or APP used by the current first user when sending the current first access request; the first user identifier is the user identifier of the current first user, and the first user identifier cannot be empty; the first database name is the database name of the cloud database that the current first user is currently requesting to access, and the first database name cannot be empty; the first project identifier can be empty, and when the first project identifier is empty, it indicates that the first database name is empty. The corresponding cloud database is a shared database. When the first project identifier is not empty, the first project identifier matches the project identifier of a research project currently being accessed by the first user. The first operation type is a type of database operation of the cloud database currently being accessed, and the first operation type cannot be empty. The first operation parameter can be empty. When the first operation parameter is empty, it means that the database operation currently being accessed does not require additional operation processing parameters. For example, the full database deletion operation can be performed without any parameters. When the first operation parameter is not empty, the first operation parameter is the operation processing parameter corresponding to the database operation currently being accessed. For example, the query keyword must be carried in the database query operation.

[0058] Step 22, and use the user configuration attribute, database configuration attribute and project configuration attribute corresponding to the first user identifier, the first database name and the first project identifier as the corresponding current user configuration attribute, current database configuration attribute and current project configuration attribute;

[0059] Specifically, this includes: step 221, taking the user configuration attribute that matches the first user identifier as the corresponding current user configuration attribute;

[0060] Step 222, and take the database configuration attribute whose database name matches the first database name as the corresponding current database configuration attribute;

[0061] Step 223, and identify whether the first project identifier is empty; if yes, set the corresponding current project configuration attribute to empty; if no, take the project configuration attribute that matches the first project identifier as the corresponding current project configuration attribute.

[0062] Step 3: Based on the current user configuration attributes, current project configuration attributes, and current database configuration attributes, confirm the operation permissions for the first operation type to obtain the corresponding first confirmation result;

[0063] The first confirmation result includes both prohibition and permission;

[0064] Specifically, this includes: Step 31, identifying whether the current project configuration attribute is empty; if the current project configuration attribute is empty, proceed to Step 32; if the current project configuration attribute is not empty, proceed to Step 34.

[0065] Here, when the current project configuration attribute is empty, it means that the first access request of the first user expects to access a shared cloud database; otherwise, when the current project configuration attribute is not empty, it means that the first access request of the first user expects to access a dedicated cloud database.

[0066] Step 32: Take the shared database configuration whose shared database name matches the first database name in the shared configuration set of the current user configuration attributes as the corresponding current shared database configuration; and identify whether the current shared database configuration is empty; if yes, set the corresponding first confirmation result to prohibit and go to step 37; if no, take the shared database role of the current shared database configuration as the corresponding current shared database role and go to step 33.

[0067] Step 33: Identify whether the database usage in the current database configuration attribute is shared; if not, set the corresponding first confirmation result to prohibited and proceed to step 37; if yes, record the row corresponding to the current shared database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and set the permission configuration s corresponding to the first operation type in the current corresponding row. i,j Extract the current permission configuration as the corresponding current permission configuration, and identify the current permission configuration. If the current permission configuration is 0, set the corresponding first confirmation result to prohibit; if the current permission configuration is 1, set the corresponding first confirmation result to allow, and proceed to step 37.

[0068] Step 34: Confirm whether there is an affiliated project identifier that matches the first project identifier in the project configuration set of the current user configuration attributes; if it is confirmed that there is no such identifier, set the corresponding first confirmation result to prohibit and proceed to step 37; if it is confirmed that there is such an identifier, take the dedicated database name that matches the first database name in the database configuration set of the current project configuration attributes as the corresponding current dedicated database name, and identify whether the current dedicated database name is empty. If it is, set the corresponding first confirmation result to prohibit and proceed to step 37; otherwise, take the database personnel configuration that matches the current dedicated database name in the personnel configuration set of the current project configuration attributes as the corresponding current database personnel configuration and proceed to step 35.

[0069] Step 35: Confirm whether there is a personnel identifier in the personnel identifier set of the current database personnel configuration that matches the first user identifier; if not, set the corresponding first confirmation result to prohibit and proceed to step 37; if yes, take the personnel identifier set in the current database personnel configuration that matches the first user identifier as the corresponding matching personnel identifier set, and take the dedicated database role corresponding to the matching personnel identifier set as the corresponding current dedicated database role, and proceed to step 36.

[0070] Step 36: Identify whether the database purpose of the current database configuration attribute is dedicated; if not, set the corresponding first confirmation result to prohibited; if yes, record the row corresponding to the current dedicated database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and set the permission configuration s corresponding to the first operation type in the current corresponding row. i,j Extract the current permission configuration and identify it. If the current permission configuration is 0, set the corresponding first confirmation result to prohibit; if the current permission configuration is 1, set the corresponding first confirmation result to allow.

[0071] Step 37: Return the first confirmation result as the confirmation result for this operation permission.

[0072] Step 4: Identify the first confirmation result; if the first confirmation result is allowed, send the first access request to the preset database operation processing interface; if the first confirmation result is prohibited, set the corresponding first request feedback to operation permission prohibited, and send the completed first request feedback back to the first user.

[0073] Here, the database operation processing interface in this embodiment of the invention is a pre-set processing interface. This processing interface performs a database operation corresponding to the first operation type on the cloud database specified by the first database name in the first access request, and uses the first operation parameter as the input parameter for this database operation. After completing this database operation, the processing interface also directly sends the obtained operation feedback back to the message sending and receiving address specified by the first request source address in the first access request. In this embodiment of the invention, when sending the completed first request feedback back to the first user, the first request feedback is also sent back to the message sending and receiving address specified by the first request source address in the first access request.

[0074] Figure 4 This is a module structure diagram of a cloud database user permission management device provided in Embodiment 2 of the present invention. This device can be a terminal device or server implementing the aforementioned method embodiments, or it can be a device that enables the aforementioned terminal device or server to implement the aforementioned method embodiments. For example, the device can be a device or chip system of the aforementioned terminal device or server. Figure 4 As shown, the device includes: a multi-side configuration module 201, an access request preprocessing module 202, a user permission confirmation module 203, and an access request processing module 204.

[0075] The multi-side configuration module 201 is used to set a corresponding database configuration attribute for each cloud database; to set a corresponding project configuration attribute for each scientific research project; and to set a corresponding user configuration attribute for each user.

[0076] The access request preprocessing module 202 is used to extract the corresponding first user identifier, first database name, first project identifier and first operation type from the first access request when it receives the first access request sent by the first user; and to use the user configuration attribute, database configuration attribute and project configuration attribute corresponding to the first user identifier, first database name and first project identifier as the corresponding current user configuration attribute, current database configuration attribute and current project configuration attribute.

[0077] The user permission confirmation module 203 is used to confirm the operation permission of the first operation type based on the current user configuration attributes, the current project configuration attributes, and the current database configuration attributes to obtain the corresponding first confirmation result; the first confirmation result includes prohibition and permission.

[0078] The access request processing module 204 is used to identify the first confirmation result; if the first confirmation result is allowed, the first access request is sent to the preset database operation processing interface; if the first confirmation result is prohibited, the corresponding first request feedback is set to operation permission prohibited, and the completed first request feedback is sent back to the first user.

[0079] The cloud database user permission management device provided in this embodiment of the invention can execute the method steps in the above method embodiment. Its implementation principle and technical effect are similar, and will not be repeated here.

[0080] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented by processing element calls to software, while others are implemented in hardware. For example, the multi-side configuration module can be a separate processing element, or it can be integrated into a chip in the above device. Alternatively, it can be stored as program code in the memory of the above device, and called and executed by a processing element of the device. The implementation of other modules is similar. Moreover, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed through integrated logic circuits in the hardware of the processor element or through software instructions.

[0081] For example, these modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). As another example, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a System-on-a-Chip (SOC).

[0082] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the foregoing method embodiments are generated. The computer described above can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The aforementioned computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the aforementioned computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, Bluetooth, microwave, etc.) means. The aforementioned computer-readable storage medium can be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The aforementioned available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)).

[0083] Figure 5 This is a schematic diagram of an electronic device provided in Embodiment 3 of the present invention. This electronic device can be a terminal device or server implementing the methods of the aforementioned embodiments, or it can be a terminal device or server connected to the aforementioned terminal device or server implementing the methods of the aforementioned embodiments. Figure 5 As shown, the electronic device may include: a processor 301 (e.g., CPU), a memory 302, and a transceiver 303; the transceiver 303 is coupled to the processor 301, and the processor 301 controls the transmission and reception operations of the transceiver 303. The memory 302 may store various instructions for performing various processing functions and implementing the processing steps described in the foregoing embodiments. Preferably, the electronic device involved in the embodiments of the present invention further includes: a power supply 304, a system bus 305, and a communication port 306. The system bus 305 is used to realize communication connections between components. The communication port 306 is used for communication between the electronic device and other peripherals.

[0084] exist Figure 5The system bus 305 mentioned can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This system bus can be divided into address bus, data bus, control bus, etc. For ease of representation, it is represented by only one thick line in the figure, but this does not indicate that there is only one bus or one type of bus. The communication interface is used to enable communication between the database access device and other devices (e.g., clients, read-write libraries, and read-only libraries). Memory may include Random Access Memory (RAM) and may also include non-volatile memory, such as at least one disk storage device.

[0085] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), graphics processing units (GPUs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0086] It should be noted that the embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when run on a computer, cause the computer to perform the methods and processes provided in the above embodiments.

[0087] This invention provides a method, apparatus, electronic device, and computer-readable storage medium for managing user permissions in a cloud database. As described above, this invention replaces the traditional user-side configuration method with a multi-side configuration method. Specifically, it sets a corresponding database configuration attribute for each cloud database, a corresponding project configuration attribute for each research project, and a corresponding user configuration attribute for each user. Furthermore, it unifies the user's database operation permissions in shared / dedicated databases into a single database configuration attribute setting, and unifies the user's database role settings in dedicated databases into a single project configuration attribute setting. The user permission management mechanism implemented based on multi-side configuration in this embodiment of the invention is as follows: After receiving the first access request sent by the first user, the corresponding first user identifier, first database name, first project identifier, and first operation type are extracted from it; the user configuration attributes, database configuration attributes, and project configuration attributes corresponding to the first user identifier, first database name, and first project identifier are used as the corresponding current user configuration attributes, current database configuration attributes, and current project configuration attributes; the operation permission of the first operation type is confirmed based on the current user configuration attributes, current project configuration attributes, and current database configuration attributes to obtain the corresponding first confirmation result; when the first confirmation result is allowed, the first access request is sent to the preset database operation processing interface; when the first confirmation result is prohibited, the corresponding first request feedback is set to operation permission prohibited, and the first request feedback with the completed setting is sent back to the first user. The improved multi-sided configuration method of this invention reduces redundant data and storage resource waste, while also reducing the difficulty of configuration changes, improving efficiency, and lowering error rates when project configurations change. The user permission management mechanism implemented based on this invention performs multiple verifications on the user, project, and database configuration sides. When personnel are added or removed from a project, or when personnel roles or role permissions are switched, if the project configuration attributes or database configuration attributes are modified all at once before adaptive modifications are made to all associated users, data leakage is unlikely to occur even if all adaptive modifications to associated users are not completed. In other words, the user permission management mechanism provided by this invention reduces the risk of data leakage.

[0088] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0089] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A user permission management method for a cloud database, characterized in that, The method includes: Set a corresponding database configuration attribute for each cloud database; set a corresponding project configuration attribute for each research project; and set a corresponding user configuration attribute for each user. Upon receiving the first access request from the first user, the first user identifier, first database name, first project identifier, and first operation type are extracted from the first access request; and the user configuration attribute, database configuration attribute, and project configuration attribute corresponding to the first user identifier, first database name, and first project identifier are used as the corresponding current user configuration attribute, current database configuration attribute, and current project configuration attribute. Based on the current user configuration attributes, the current project configuration attributes, and the current database configuration attributes, the operation permission of the first operation type is confirmed to obtain a corresponding first confirmation result; the first confirmation result includes prohibition and permission; The first confirmation result is identified; if the first confirmation result is allowed, the first access request is sent to the preset database operation processing interface; if the first confirmation result is prohibited, the corresponding first request feedback is set to operation permission prohibited, and the first request feedback with the completed setting is sent back to the first user. The database configuration attributes include a database name, database purpose, and a role-based operation permission configuration table. The database name is the unique name of the corresponding cloud database. The database purpose includes shared and dedicated uses; shared uses indicate that the corresponding cloud database is a shared database, while dedicated uses indicate that the corresponding cloud database is a dedicated database for the research project. Each column of the role-based operation permission configuration table corresponds to a type of database operation in the corresponding cloud database, and each row corresponds to a type of database role in the corresponding cloud database. Each configuration unit of the role-based operation permission configuration table is a corresponding permission configuration. i,j 1 ≤ column index i ≤ N, 1 ≤ row index j ≤ M, N is the total number of operation types in the corresponding cloud database, and M is the total number of role types in the corresponding cloud database; the permission configuration s i,j The value includes 0 and 1. When it is 0, it means that the operation permission of the i-th type of database operation of the j-th type of database role in the cloud database is prohibited. When it is 1, it means that the operation permission of the i-th type of database operation of the j-th type of database role in the cloud database is allowed. The project configuration attributes include a project identifier, a database configuration set, and a personnel configuration set; the project identifier is a unique identifier for the corresponding research project; the database configuration set consists of one or more dedicated database names, each dedicated database name matching the database name of a dedicated database under the corresponding research project; the personnel configuration set consists of one or more database personnel configurations; the database personnel configurations in the personnel configuration set correspond one-to-one with the dedicated database names in the database configuration set; the database personnel configurations consist of multiple role personnel configurations, each role personnel configuration consisting of a dedicated database role and a personnel identifier set; the dedicated database role matches a type of database role in the dedicated database corresponding to the dedicated database name; the personnel identifier set consists of one or more personnel identifiers, each personnel identifier matching a user identifier of a user; The user configuration attributes include a user identifier, a shared configuration set, and a project configuration set; the shared configuration set consists of one or more shared database configurations; each shared database configuration corresponds to one shared database; each shared database configuration consists of a shared database name and a shared database role; the shared database name is the database name of the corresponding shared database; the shared database role corresponds to a type of database role of the corresponding shared database; when the project configuration set is not empty, it consists of one or more affiliated project identifiers; each affiliated project identifier matches the project identifier of a research project. The step of confirming operation permissions for the first operation type based on the current user configuration attributes, the current project configuration attributes, and the current database configuration attributes to obtain the corresponding first confirmation result specifically includes: Step 51: Identify whether the current project configuration attribute is empty; if the current project configuration attribute is empty, proceed to step 52; if the current project configuration attribute is not empty, proceed to step 54. Step 52: Take the shared database configuration whose shared database name matches the first database name in the shared configuration set of the current user configuration attributes as the corresponding current shared database configuration; and identify whether the current shared database configuration is empty; if yes, set the corresponding first confirmation result to prohibit, and go to step 57; if no, take the shared database role of the current shared database configuration as the corresponding current shared database role, and go to step 53. Step 53: Identify whether the database purpose of the current database configuration attribute is shared; if not, set the corresponding first confirmation result to prohibited and proceed to step 57; if yes, record the row corresponding to the current shared database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and set the permission configuration s corresponding to the first operation type in the current corresponding row. i,j Extract the current permission configuration as the corresponding current permission configuration, and identify the current permission configuration. If the current permission configuration is 0, set the corresponding first confirmation result to prohibit; if the current permission configuration is 1, set the corresponding first confirmation result to allow, and proceed to step 57. Step 54: Confirm whether there is an affiliated project identifier that matches the first project identifier in the project configuration set of the current user configuration attributes; if it is confirmed that there is no such identifier, set the corresponding first confirmation result to prohibit and proceed to step 57; if it is confirmed that there is such an identifier, take the dedicated database name that matches the first database name in the database configuration set of the current project configuration attributes as the corresponding current dedicated database name, and identify whether the current dedicated database name is empty. If it is, set the corresponding first confirmation result to prohibit and proceed to step 57; otherwise, take the database personnel configuration that matches the current dedicated database name in the personnel configuration set of the current project configuration attributes as the corresponding current database personnel configuration and proceed to step 55. Step 55: Confirm whether there is a personnel identifier in the personnel identifier set of the current database personnel configuration that matches the first user identifier; if not, set the corresponding first confirmation result to prohibit and proceed to step 57; if yes, take the personnel identifier set in the current database personnel configuration that matches the first user identifier as the corresponding matching personnel identifier set, and take the dedicated database role corresponding to the matching personnel identifier set as the corresponding current dedicated database role, and proceed to step 56. Step 56: Identify whether the database purpose of the current database configuration attribute is dedicated; if not, set the corresponding first confirmation result to prohibited; if yes, record the row corresponding to the current dedicated database role in the role operation permission configuration table of the current database configuration attribute as the current corresponding row, and set the permission configuration s corresponding to the first operation type in the current corresponding row. i,j Extract the current permission configuration as the corresponding current permission configuration, and identify the current permission configuration. If the current permission configuration is 0, set the corresponding first confirmation result to prohibit; if the current permission configuration is 1, set the corresponding first confirmation result to allow. Step 57: Return the first confirmation result as the confirmation result for this operation permission.

2. The user permission management method for a cloud database according to claim 1, characterized in that, The first access request includes at least the first user identifier, the first database name, the first project identifier, the first operation type, and the first operation parameters; The first user identifier is the user identifier of the current first user; The first user identifier cannot be empty; The first database name is the name of the cloud database that the first user is currently requesting to access; the first database name cannot be empty; When the first project identifier is empty, it indicates that the cloud database corresponding to the first database name is a shared database; when the first project identifier is not empty, it matches the project identifier of a research project in which the first user is currently located. The first operation type is a type of database operation of the cloud database currently requested for access; the first operation type cannot be empty; When the first operation parameter is empty, it means that the database operation of the current application does not require additional operation processing parameters; when the first operation parameter is not empty, it is the operation processing parameter corresponding to the database operation of the current application.

3. The user permission management method for a cloud database according to claim 2, characterized in that, The step of using the user configuration attribute, database configuration attribute, and project configuration attribute corresponding to the first user identifier, the first database name, and the first project identifier as the corresponding current user configuration attribute, current database configuration attribute, and current project configuration attribute specifically includes: The user configuration attribute that matches the first user identifier is taken as the corresponding current user configuration attribute; And the database configuration attribute whose database name matches the first database name is taken as the corresponding current database configuration attribute; It also identifies whether the first project identifier is empty; if so, it sets the corresponding current project configuration attribute to empty; if not, it uses the project configuration attribute that matches the first project identifier as the corresponding current project configuration attribute.

4. An apparatus for performing the user access control method for a cloud database according to any one of claims 1-3, characterized in that, The device includes: a multi-side configuration module, an access request preprocessing module, a user permission confirmation module, and an access request processing module; The multi-side configuration module is used to set a corresponding database configuration attribute for each cloud database; and to set a corresponding project configuration attribute for each research project; and to set a corresponding user configuration attribute for each user. The access request preprocessing module is used to extract the corresponding first user identifier, first database name, first project identifier, and first operation type from the first access request when it receives the first access request sent by the first user; and to use the user configuration attribute, database configuration attribute, and project configuration attribute corresponding to the first user identifier, first database name, and first project identifier as the corresponding current user configuration attribute, current database configuration attribute, and current project configuration attribute. The user permission confirmation module is used to confirm the operation permission of the first operation type based on the current user configuration attributes, the current project configuration attributes, and the current database configuration attributes to obtain a corresponding first confirmation result; the first confirmation result includes prohibition and permission; The access request processing module is used to identify the first confirmation result; if the first confirmation result is allowed, the first access request is sent to the preset database operation processing interface; if the first confirmation result is prohibited, the corresponding first request feedback is set to operation permission prohibited, and the first request feedback with the completed setting is sent back to the first user.

5. An electronic device, characterized in that, include: Memory, processor, and transceiver; The processor is configured to be coupled to the memory, read and execute instructions in the memory to implement the method according to any one of claims 1-3; The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a computer, cause the computer to perform the method described in any one of claims 1-3.

Images