Data access control method and device, equipment, medium and program product

Abstract

The invention discloses a data access control method and device, equipment, a medium and a program product. The method comprises the following steps: receiving a data access request sent by a user; obtaining a field-level data access permission of the user according to the data access request; wherein the data access permission comprises one or more target data tables which the user has the permission to access and one or more target fields in each target data table; and controlling the user to access each target field in each target data table according to the field-level data access authority. According to the embodiment of the invention, data access can be finely controlled, the risk of data leakage is reduced, and maximized data sharing is realized.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data security technology, and in particular to a data access control method, apparatus, device, medium and program product. Background Art

[0002] Data access control is an important part of information security, which aims to ensure that information resources can only be accessed by authorized users in an authorized manner. As data becomes a strategic resource and production factor for enterprises, data security management and control capabilities will also become one of the important indicators for measuring corporate competitiveness. In order to ensure data security and reduce the risk of data leakage, it is necessary to strictly control the scope of user access to corporate data.

[0003] The existing data access control scheme is mainly based on the user's data table access approval record and the user's region information. According to the granularity of the physical table, the user can query the data in the region of the user in the physical table. Due to the large granularity of the physical table, it is impossible to finely control data access, the risk of data leakage is high, and it is impossible to achieve maximum data sharing. Summary of the invention

[0004] The present application provides a data access control method, apparatus, device, medium and program product, which can perform refined control over data access, reduce the risk of data leakage, and achieve maximum data sharing.

[0005] In a first aspect, an embodiment of the present application provides a data access control method, the method comprising:

[0006] Receive data access requests sent by users;

[0007] Acquire the field-level data access permission of the user according to the data access request; wherein the data access permission includes: one or more target data tables that the user has permission to access and one or more target fields in each target data table;

[0008] The user's access to each target field in each target data table is controlled according to the field-level data access authority.

[0009] In a second aspect, an embodiment of the present application further provides a data access control device, the device comprising: a request receiving module, a permission obtaining module and an access control module; wherein:

[0010] The request receiving module is used to receive a data access request sent by a user;

[0011] The permission acquisition module is used to acquire the field-level data access permission of the user according to the data access request; wherein the data access permission includes: one or more target data tables that the user has permission to access and one or more target fields in each target data table;

[0012] The access control module is used to control the user's access to each target field in each target data table according to the field-level data access permission.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0014] one or more processors;

[0015] a memory for storing one or more programs,

[0016] When the one or more programs are executed by the one or more processors, the one or more processors implement the data access control method described in any embodiment of the present application.

[0017] In a fourth aspect, an embodiment of the present application provides a storage medium on which a computer program is stored, and when the program is executed by a processor, the data access control method described in any embodiment of the present application is implemented.

[0018] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the data access control method described in any embodiment of the present application.

[0019] The embodiment of the present application proposes a data access control method, device, equipment, medium and program product, first receiving a data access request sent by a user; then obtaining the user's field-level data access rights according to the data access request; wherein the data access rights include: one or more target data tables that the user has the right to access and one or more target fields in each target data table; then controlling the user's access to each target field in each target data table according to the field-level data access rights. That is to say, in the technical solution of the present application, the user's data access rights can be field-level granularity, so the user can only access a part of the fields in a certain data table. In the prior art, the user can only access the entire data table. Since the granularity of the physical table is relatively large, it is impossible to perform fine control on data access, the risk of data leakage is relatively large, and it is impossible to achieve maximum data sharing. Therefore, compared with the prior art, the data access control method, device, equipment, medium and program product proposed in the embodiment of the present application can perform fine control on data access, reduce the risk of data leakage, and achieve maximum data sharing; and the technical solution of the embodiment of the present application is simple and convenient to implement, easy to popularize, and has a wider scope of application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flowchart of a data access control method provided in one embodiment of the present application;

[0021] Figure 2 A flowchart of a data access control method provided by another embodiment of the present application;

[0022] Figure 3 A flowchart of a data access control method provided in yet another embodiment of the present application;

[0023] Figure 4 A schematic diagram of the structure of a data access control device provided in one embodiment of the present application;

[0024] Figure 5 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0025] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for ease of description, only the parts related to the present application, rather than all structures, are shown in the accompanying drawings.

[0026] Figure 1This is a flow chart of a data access control method provided by an embodiment of the present application. The method can be executed by a data access control device or electronic device. The device or electronic device can be implemented by software and / or hardware. The device or electronic device can be integrated into any smart device with network communication function. Figure 1 As shown, the data access control method may include the following steps:

[0027] S101: Receive a data access request sent by a user.

[0028] In one embodiment, the data query statement submitted by the user can be directly received, and then the data query statement can be rewritten into a data access request. In this case, the user can directly enter an SQL query statement or other structured query language. The system needs to ensure: 1) Security: prevent security risks such as SQL injection, and ensure that all inputs are properly escaped or use parameterized queries. 2) Syntax verification: check whether the query statement meets the expected syntax specifications. 3) Permission control: confirm that the user has the authority to execute specific types of queries and limit access to sensitive data. 4) Performance optimization: analyze the query and possibly optimize it to improve efficiency. Once the query statement passes the above checks, it can be sent directly to the database for processing, or slightly modified as needed to adapt to the internal data model and structure.

[0029] In another embodiment, the data query statement input by the user can also be received through the intelligent question-answering system, and the data query statement can be rewritten into a data access request through the intelligent question-answering system. This process is more complicated because it involves natural language processing technology to understand the user's intention and convert it into a valid data access request. This step usually includes: 1) Natural language parsing: using natural language processing algorithms to understand the user's query intention. This may involve technologies such as word segmentation, part-of-speech tagging, entity recognition, and syntactic analysis. 2) Intent recognition: determining the type of operation the user wants to perform, such as retrieval, update, deletion, etc. 3) Query rewriting: constructing one or more candidate queries based on user intent. This may require mapping to a predefined pattern or template to generate the correct SQL or other forms of query statements. 4) Context management: maintaining the dialogue state to handle continuous queries in multiple rounds of interaction, such as when the user gradually refines his needs in a series of related questions.

[0030] S102. Obtaining field-level data access rights of the user according to the data access request; wherein the data access rights include: one or more target data tables that the user has access rights to and one or more target fields in each target data table.

[0031] In this step, the user's basic information and the basic information of one or more target data tables that the user has permission to access can be first extracted from the data access request; then the user's field-level data access permissions are generated based on the pre-built data registration form and the user's basic information and the basic information of one or more target data tables that the user has permission to access.

[0032] S103. Control the user's access to each target field in each target data table according to the field-level data access permission.

[0033] In one embodiment, user authorization control parameter information can be first extracted from the field-level data access permission control; if the information storage format of each target data table is a horizontal table, each target data table can be associated with the user authorization control parameter information to generate a temporary view corresponding to each target data table in the horizontal table format; then, the temporary view corresponding to each target data table in the horizontal table format is used to control the user's access to each target field in each target data table.

[0034] In another embodiment, the user authorization control parameter information can be first extracted from the field-level data access permission control; if the information storage format of each target data table is in the form of a vertical table, each target data table can be associated with the user authorization control parameter information to generate a temporary view corresponding to each target data table in the form of a vertical table; then the temporary view corresponding to each target data table in the form of a vertical table is used to control the user's access to each target field in each target data table.

[0035] The data access control method proposed in the embodiment of the present application first receives a data access request sent by a user; then obtains the user's field-level data access rights according to the data access request; wherein the data access rights include: one or more target data tables that the user has the right to access and one or more target fields in each target data table; and then controls the user's access to each target field in each target data table according to the field-level data access rights. That is to say, in the technical solution of the present application, the user's data access rights can be field-level granularity, so the user can only access a part of the fields in a certain data table. In the prior art, the user can only access the entire data table. Since the granularity of the physical table is relatively large, it is impossible to perform fine control on data access, the risk of data leakage is relatively large, and it is impossible to achieve maximum data sharing. Therefore, compared with the prior art, the data access control method proposed in the embodiment of the present application can perform fine control on data access, reduce the risk of data leakage, and achieve maximum data sharing; and the technical solution of the embodiment of the present application is simple and convenient to implement, easy to popularize, and has a wider range of applications.

[0036] Figure 2 This is a flow chart of a data access control method provided by another embodiment of the present application. It is further optimized and expanded based on the above technical solution and can be combined with the above optional implementation methods. Figure 2 As shown, the data access control method may include the following steps:

[0037] S201: Receive a data access request sent by a user.

[0038] In one embodiment, data query statements submitted by users can be directly received and then rewritten into data access requests. Users can directly express complex query requirements without being restricted by predefined query formats or options. For users who are familiar with SQL or other query languages, directly writing query statements can obtain the required information faster and avoid the interaction process with the question-answering system. Users can accurately specify query conditions, sorting rules, aggregation functions, etc. to ensure that the data obtained is completely in line with expectations.

[0039] In another embodiment, the data query statement input by the user can also be received through the intelligent question-and-answer system, and the data query statement can be rewritten into a data access request through the intelligent question-and-answer system. For non-technical personnel or users who are not familiar with the query language, the natural language processing-driven intelligent question-and-answer system provides a more friendly interface and lowers the user's usage threshold; the intelligent question-and-answer system can help users build correct query statements through functions such as context understanding and grammar checking, thereby reducing query failures caused by grammatical or logical errors; the system can gradually guide users to complete query construction based on user input, especially when users are not sure how to accurately express query intent, and provide useful prompts and suggestions. In addition, the intelligent question-and-answer system can automatically optimize queries and recommend the most commonly used query modes based on historical records and user behavior to improve work efficiency.

[0040] S202. Obtain field-level data access rights of the user according to the data access request; wherein the data access rights include: one or more target data tables that the user has access rights to and one or more target fields in each target data table.

[0041] In this step, the basic information of the user and the basic information of one or more target data tables that the user has access to can be extracted from the data access request; then the user's field-level data access permissions are generated based on the pre-built data registration form and the basic information of the user and the basic information of one or more target data tables that the user has access to. Field-level access control allows administrators to provide precise access permissions to different users, ensuring that users can only see the data they should see, which can reduce the risk of sensitive data leakage. For companies that need to comply with strict regulations, field-level permission control helps ensure that the company only processes personal data when permitted by law, thereby helping to meet compliance requirements. In addition, limiting user access to specific fields can also reduce the amount of data returned by database queries, thereby improving system response speed and efficiency.

[0042] Furthermore, based on the basic information of the user and the basic information of one or more target data tables that the user has the right to access, one or more target fields that the user has the right to access in each target data table can be obtained in the data registration table; then, based on the one or more target fields that the user has the right to access in each target data table, the user's field-level data access permissions can be generated. By strictly limiting users to only the minimum range of fields required for their work, the risk of sensitive data exposure is minimized. Even if the system is attacked, it is difficult for attackers to obtain complete information. For data tables containing personally identifiable information or other sensitive information, field-level permissions ensure that only authorized personnel can access this information, which helps to comply with privacy regulations and internal policies. Users with different roles can be given different field access permissions to ensure that the principle of separation of duties is implemented and reduce the possibility of misoperation or malicious behavior.

[0043] S203: Extract user authorization control parameter information from field-level data access permission control.

[0044] In field-level data access permission control, extracting user authorization control parameter information is a key step to ensure that the system can correctly perform permission checks. These parameter information usually include but are not limited to: 1) User identity: user ID or user name; user role or user group. 2) Target resource: data table name, field name. 3) Operation type: read, write, delete. 4) Permission level: whether the operation is allowed (Allow / Deny), the scope of the permission (global, specific record, specific time period, etc.). 5) Conditions and constraints: There may be additional conditions, such as time-based validity, certain attribute values ​​of data rows, etc.

[0045] S204: If the information storage format of each target data table is a horizontal table format, then associate each target data table with the user authorization control parameter information to generate a temporary view corresponding to each target data table in the horizontal table format.

[0046] The horizontal table in the embodiment of the present application refers to a data table structure in which each record (row) contains multiple fields (columns). This structure is suitable for situations where the number of attributes of each row of records is relatively fixed and small. A horizontal table usually contains a large number of fields, and uses indicators or label names related to multiple business topics as field names. Each row of data contains all relevant attributes and is stored in the same data table. By associating the physical table in the query sql with the user authorization control parameter information to form a temporary view, and replacing the access to the original physical table in Sql with the temporary view, user field-level access permission control can be achieved. The rewritten example is as follows:

[0047] Database1.M01_AAA_BBB (horizontal table) corresponding to the temporary view

[0048] Select

[0049] CASE WHEN UPPER(T2.ColName)='ASSET_IN'THEN T1.ASSET_IN ELSE'*'END ASASSET_IN

[0050] ,CASE WHEN UPPER(T2.ColName)='ASSET_OUT'THEN T1.ASSET_OUT'*'END ASASSET_OUT

[0051] ,T1.DATA_DT

[0052] From Database1.M01_AAA_BBB T1

[0053] inner join

[0054] (SELECT

[0055] CONCAT_WS('#',COLLECT_SET(ColName))AS ColName

[0056] FROM USER_CTRL / *User authorization control parameter information table* /

[0057] WHERE DataBaseType = 'HADOOP'

[0058] AND DataBase = 'Database1'

[0059] AND TABLE_NAME='M01_AAA_BBB'

[0060] AND UserID=current_user() / *userID* /

[0061] )T2

[0062] ON 1=1.

[0063] S205 . Use the temporary views corresponding to the target data tables in the horizontal table format to control the user to access the target fields in the target data tables.

[0064] Temporary views can be used to precisely restrict users to access only the fields and records they are authorized to access. Even if the underlying database structure changes or sensitive data exists, temporary views ensure that users only see specific data sets, thereby enhancing data security. Temporary views can optimize query logic as needed to reduce unnecessary data processing and transmission. For example, views can pre-calculate some aggregate results or filter out irrelevant rows, thereby speeding up queries and improving system performance. For scenarios where complex queries need to be executed, such as joins and subqueries involving multiple tables, views can encapsulate these complex logics to make end-user queries simpler and clearer. In addition, temporary views can be dynamically generated based on user roles, containing only fields that the user has permission to access, implementing fine-grained field-level access control, and further improving security and privacy protection.

[0065] The data access control method proposed in the embodiment of the present application first receives a data access request sent by a user; then obtains the user's field-level data access rights according to the data access request; wherein the data access rights include: one or more target data tables that the user has the right to access and one or more target fields in each target data table; and then controls the user's access to each target field in each target data table according to the field-level data access rights. That is to say, in the technical solution of the present application, the user's data access rights can be field-level granularity, so the user can only access a part of the fields in a certain data table. In the prior art, the user can only access the entire data table. Since the granularity of the physical table is relatively large, it is impossible to perform fine control on data access, the risk of data leakage is relatively large, and it is impossible to achieve maximum data sharing. Therefore, compared with the prior art, the data access control method proposed in the embodiment of the present application can perform fine control on data access, reduce the risk of data leakage, and achieve maximum data sharing; and the technical solution of the embodiment of the present application is simple and convenient to implement, easy to popularize, and has a wider range of applications.

[0066] Figure 3 A flowchart of a data access control method provided by another embodiment of the present application is shown below. The above technical solution is further optimized and expanded, and can be combined with the above optional implementation methods. Figure 3 As shown, the data access control method may include the following steps:

[0067] S301: Receive a data access request sent by a user.

[0068] In one embodiment, the data query statement submitted by the user can be directly received, and then the data query statement can be rewritten into a data access request. In another embodiment, the data query statement input by the user can also be received through the intelligent question-answering system, and the data query statement can be rewritten into a data access request through the intelligent question-answering system.

[0069] S302. Obtain field-level data access permissions of the user according to the data access request; wherein the data access permissions include: one or more target data tables that the user has permission to access and one or more target fields in each target data table.

[0070] In this step, the user's basic information and the basic information of one or more target data tables that the user has permission to access can be first extracted from the data access request; then the user's field-level data access permissions are generated based on the pre-built data registration form and the user's basic information and the basic information of one or more target data tables that the user has permission to access.

[0071] Furthermore, based on the basic information of the user and the basic information of one or more target data tables that the user has access rights to, one or more target fields that the user has access rights to in each target data table can be obtained in the data registration table; then, based on the one or more target fields that the user has access rights to in each target data table, the user's field-level data access rights can be generated.

[0072] S303: Extract user authorization control parameter information from field-level data access permission control.

[0073] In field-level data access permission control, extracting user authorization control parameter information is a key step to ensure that the system can correctly perform permission checks. These parameter information usually include but are not limited to: 1) User identity: user ID or user name; user role or user group. 2) Target resource: data table name, field name. 3) Operation type: read, write, delete. 4) Permission level: whether the operation is allowed (Allow / Deny), the scope of the permission (global, specific record, specific time period, etc.). 5) Conditions and constraints: There may be additional conditions, such as time-based validity, certain attribute values ​​of data rows, etc.

[0074] S304: If the information storage form of each target data table is a vertical table form, then associate each target data table with the user authorization control parameter information to generate a temporary view corresponding to each target data table in the vertical table form.

[0075] The vertical table in the embodiment of the present application refers to a data table structure that splits multiple attributes originally in the same row into multiple rows. This structure is common in situations where attributes need to be added flexibly or the number of attributes is very large. The vertical table is an unconventional table structure design, which is characterized by storing attributes as rows rather than columns. The vertical table usually includes three fields: entity ID, attribute name, and attribute value. By associating the physical table in the query sql with the user authorization control parameter information to form a temporary view, replacing the access to the original physical table in Sql with a temporary view, and replacing the access to the original physical table in Sql with a temporary view, user field-level access permission control can be achieved. The rewritten example is as follows:

[0076] The temporary view corresponding to Database3.M01_CCC_DD (vertical table):

[0077] SELECT

[0078] Index_Name / *Attribute name* /

[0079] ,Index_Value / *attribute value* /

[0080] ,data_dt

[0081] FROM Database2.M01_CCC_DDD T1

[0082] inner join

[0083] (SELECT

[0084] ColName

[0085] FROM user_ctrl / *User authorization control parameter information table* /

[0086] WHERE DataBaseType = 'HADOOP'

[0087] AND DataBase = 'Database2'

[0088] AND Table_Name='M01_CCC_DDD'

[0089] AND UserID=current_user() / *userID* / )T2

[0090] ON T1.Index_Name=T2.ColName.

[0091] S305 . Use the temporary views corresponding to the target data tables in the form of vertical tables to control the user to access the target fields in the target data tables.

[0092] Field-level data authorization capabilities can meet most data authorization needs in the big data service field and realize the needs of business personnel for refined data control. On the one hand, it effectively implements the consistency between accounts and actual data in data management to ensure that the data used by users is consistent with the data they are permitted to use. On the other hand, in scenarios where users actually only need to use a few fields in the physical table, through the implementation of refined authorization, it can avoid the business directly rejecting the user's data authorization application due to concerns about expanding data usage rights, which helps to achieve maximum data sharing.

[0093] The data access control method proposed in the embodiment of the present application first receives a data access request sent by a user; then obtains the user's field-level data access rights according to the data access request; wherein the data access rights include: one or more target data tables that the user has the right to access and one or more target fields in each target data table; and then controls the user's access to each target field in each target data table according to the field-level data access rights. That is to say, in the technical solution of the present application, the user's data access rights can be field-level granularity, so the user can only access a part of the fields in a certain data table. In the prior art, the user can only access the entire data table. Since the granularity of the physical table is relatively large, it is impossible to perform fine control on data access, the risk of data leakage is relatively large, and it is impossible to achieve maximum data sharing. Therefore, compared with the prior art, the data access control method proposed in the embodiment of the present application can perform fine control on data access, reduce the risk of data leakage, and achieve maximum data sharing; and the technical solution of the embodiment of the present application is simple and convenient to implement, easy to popularize, and has a wider range of applications.

[0094] Figure 4 This is a schematic diagram of the structure of a data access control device provided by an embodiment of the present application. Figure 4 As shown, the data access control device includes: a request receiving module 401, a permission obtaining module 402 and an access control module 403; wherein,

[0095] The request receiving module 401 is used to receive a data access request sent by a user;

[0096] The permission acquisition module 402 is used to acquire the field-level data access permission of the user according to the data access request; wherein the data access permission includes: one or more target data tables that the user has permission to access and one or more target fields in each target data table;

[0097] The access control module 403 is used to control the user's access to each target field in each target data table according to the field-level data access permission.

[0098] The above data access control device can execute the method provided by any embodiment of the present application, and has the corresponding functional modules and beneficial effects of the execution method. For technical details not described in detail in this embodiment, please refer to the data access control method provided by any embodiment of the present application.

[0099] An embodiment of the present invention also provides a computer program product.

[0100] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer program products, which can include one or more computer programs, which can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor, which can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0101] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, referring to Figure 5 , Figure 5 The electronic device 12 shown is only an example and should not limit the functions and scope of use of the embodiments of the present application. Figure 5 As shown, the electronic device 12 is in the form of a general purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0102] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0103] The electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0104] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical medium) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present application.

[0105] A program / utility 40 having a set (at least one) of program modules 46 may be stored, for example, in the memory 28, such program modules 46 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 46 generally perform the functions and / or methods of the embodiments described herein.

[0106] The electronic device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), may communicate with one or more devices that enable a user to interact with the electronic device 12, and / or may communicate with any device that enables the electronic device 12 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the electronic device 12 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with other modules of the electronic device 12 via the bus 18. It should be understood that although Figure 5 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0107] The processing unit 16 executes various functional applications and data processing by running the program stored in the system memory 28, for example, implementing a data access control method provided in an embodiment of the present invention: receiving a data access request sent by a user; obtaining the field-level data access rights of the user according to the data access request; wherein the data access rights include: one or more target data tables that the user has the right to access and one or more target fields in each target data table; and controlling the user's access to each target field in each target data table according to the field-level data access rights.

[0108] The embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, a data access control method provided by all the embodiments of the present invention is implemented: receiving a data access request sent by a user; obtaining the field-level data access rights of the user according to the data access request; wherein the data access rights include: one or more target data tables that the user has the right to access and one or more target fields in each target data table; and controlling the user to access each target field in each target data table according to the field-level data access rights. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electronic device, device or device of electrical, magnetic, optical, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer readable storage medium may be any tangible medium that can contain or store a program for use by or in connection with an instruction executing electronic device, apparatus, or device.

[0109] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction-executing electronic device, apparatus, or device.

[0110] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0111] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0112] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A data access control method, characterized in that: The method comprises: Receive data access requests sent by users; Acquire the field-level data access permission of the user according to the data access request; wherein the data access permission includes: one or more target data tables that the user has permission to access and one or more target fields in each target data table; The user's access to each target field in each target data table is controlled according to the field-level data access authority.

2. The method according to claim 1, characterized in that Acquiring the user's field-level data access permission according to the data access request includes: Extracting basic information of the user and basic information of one or more target data tables that the user has the authority to access from the data access request; The field-level data access permission of the user is generated according to the pre-built data registration table, the basic information of the user, and the basic information of one or more target data tables that the user has the permission to access.

3. The method according to claim 2, characterized in that Generate field-level data access permissions for the user according to the pre-built data registration form, the basic information of the user, and the basic information of one or more target data tables that the user has permission to access, including: According to the basic information of the user and the basic information of one or more target data tables that the user has the right to access, obtaining one or more target fields that the user has the right to access in each target data table in the data registration table; The field-level data access permission of the user is generated according to the one or more target fields in each target data table that have access permission.

4. The method according to claim 1, characterized in that: Receive data access requests from users, including: Receive the data query statement submitted by the user, and rewrite the data query statement into the data access request; or, receive the data query statement input by the user through an intelligent question-answering system, and rewrite the data query statement into the data access request through the intelligent question-answering system.

5. The method according to claim 1, characterized in that Controlling the user's access to each target field in each target data table according to the field-level data access authority includes: Extracting user authorization control parameter information from the field-level data access permission control; If the information storage form of each target data table is a horizontal table form, then each target data table is associated with the user authorization control parameter information to generate a temporary view corresponding to each target data table in the horizontal table form; The temporary views corresponding to the target data tables in the horizontal table format are used to control the user's access to the target fields in the target data tables.

6. The method according to claim 1, characterized in that Controlling the user's access to each target field in each target data table according to the field-level data access authority includes: Extracting user authorization control parameter information from the field-level data access permission control; If the information storage form of each target data table is a vertical table form, then each target data table is associated with the user authorization control parameter information to generate a temporary view corresponding to each target data table in the vertical table form; The temporary views corresponding to the target data tables in the form of vertical tables are used to control the user to access the target fields in the target data tables.

7. A data access control device, characterized in that: The device comprises: a request receiving module, a permission obtaining module and an access control module; wherein, The request receiving module is used to receive a data access request sent by a user; The permission acquisition module is used to acquire the field-level data access permission of the user according to the data access request; wherein the data access permission includes: one or more target data tables that the user has permission to access and one or more target fields in each target data table; The access control module is used to control the user's access to each target field in each target data table according to the field-level data access permission.

8. An electronic device, characterized in that: include: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the data access control method according to any one of claims 1 to 6.

9. A storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data access control method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the data access control method according to any one of claims 1 to 6.

Images