Authority management method and device, equipment, medium and program product

Abstract

The invention relates to the field of distributed technologies, and discloses an authority management method and device, equipment, a medium and a program product. The method comprises the steps that when a data viewing request of a target user is detected, target data assets corresponding to the target user are acquired according to tenant division configuration and the data viewing request; obtaining hierarchical management and control configuration, and according to the hierarchical management and control configuration, obtaining the viewing permission of the target user to the target data assets; and encrypting the target data assets according to the viewing permission to obtain encrypted data assets, and displaying the encrypted data assets to the target user. According to the scheme of the embodiment, two-stage permission control is realized based on the tenant division configuration and the layered control configuration, and unified permission control can be realized when a plurality of federated learning platforms are used.

Description

Technical Field

[0001] The present invention relates to the field of distributed technology, and in particular to a permission management method, device, equipment, medium and program product. Background Art

[0002] Federated learning is a distributed machine learning technology. Its core idea is to build a global model under virtual fusion data by performing distributed model training among multiple data sources with local data, without the need to exchange local individual or sample data, only by exchanging model parameters or intermediate results, thereby achieving a balance between data privacy protection and data sharing computing, that is, a new application paradigm in which data is available but invisible and the data is fixed but the model is movable.

[0003] With the continuous development of federated learning technology, more and more manufacturers have launched their own federated learning platforms. For large groups, due to their wide range of business scenarios, multiple federated learning platforms will be involved to handle the needs of different scenarios. At the same time, for scenarios such as federated modeling by data analysts, a lot of sensitive data will be involved. It is particularly important to control the security of asset and data permissions. If there are no restrictions, it is easy to cause data leakage risks.

[0004] At present, different federated learning platforms have independent permission management methods. However, for large groups that need to use multiple federated learning platforms for scenario implementation, independent permission management cannot better manage data security and cannot meet the group's permission security unified management requirements. Secondly, the control granularity of permissions on different federated learning platforms is not uniform, and it is impossible to achieve good unified management when the group uses multiple federated learning platforms. Summary of the invention

[0005] The present invention provides a permission management method, apparatus, device, medium and program product, which can realize unified permission management when using multiple federated learning platforms.

[0006] According to one aspect of the present invention, there is provided a rights management method, comprising:

[0007] When a data viewing request of a target user is detected, the target data asset corresponding to the target user is obtained according to the tenant partition configuration and the data viewing request;

[0008] Obtaining a hierarchical control configuration, and obtaining the viewing permission of the target user to the target data asset according to the hierarchical control configuration;

[0009] The target data asset is encrypted according to the viewing authority to obtain an encrypted data asset, and the encrypted data asset is displayed to the target user.

[0010] According to another aspect of the present invention, there is provided a rights management device, comprising:

[0011] A target data asset acquisition module is used to acquire the target data asset corresponding to the target user according to the tenant partition configuration and the data viewing request when a data viewing request of the target user is detected;

[0012] A viewing permission acquisition module is used to acquire a hierarchical management and control configuration, and acquire the viewing permission of the target user to the target data asset according to the hierarchical management and control configuration;

[0013] The data asset encryption module is used to encrypt the target data asset according to the viewing authority to obtain the encrypted data asset, and display the encrypted data asset to the target user.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the permission management method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable a processor to implement the permission management method described in any embodiment of the present invention when executed.

[0019] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the permission management method described in any embodiment of the present invention is implemented.

[0020] The technical solution of the embodiment of the present invention is as follows: when a data viewing request of the target user is detected, the target data asset corresponding to the target user is obtained according to the tenant division configuration and the data viewing request; the hierarchical management and control configuration is obtained, and the viewing authority of the target user to the target data asset is obtained according to the hierarchical management and control configuration; the target data asset is encrypting according to the viewing authority to obtain the encrypted data asset, and the encrypted data asset is displayed to the target user; by realizing two-level authority management based on the tenant division configuration and the hierarchical management and control configuration, unified authority management can be realized when using multiple federated learning platforms.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flowchart of a permission management method provided according to Embodiment 1 of the present invention;

[0024] Figure 2 This is a schematic diagram of tenant division provided according to the first embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram of viewing permissions for data assets provided according to the first embodiment of the present invention;

[0026] Figure 4 This is a schematic diagram of the structure of a rights management device provided according to Embodiment 2 of the present invention;

[0027] Figure 5 It is a structural schematic diagram of an electronic device for implementing the rights management method of an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", "target", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment 1

[0031] Figure 1 A flowchart of a permission management method is provided for the first embodiment of the present invention. This embodiment can be applied to the case of unified management of permission security when using multiple federated learning platforms for scene implementation. The method can be executed by a permission management device, which can be implemented in the form of hardware and / or software. Typically, the permission management device can be configured in an electronic device, such as a computer device or a server. Figure 1 As shown, the method includes:

[0032] S110: When a data viewing request of a target user is detected, a target data asset corresponding to the target user is obtained according to the tenant partition configuration and the data viewing request.

[0033] The target user may be a user of the federated learning platform. In this embodiment, for users who use the federated learning platform for federated modeling, tenant division configuration needs to be performed, that is, division is performed according to the concept of tenants. Different tenants are pre-associated with different data assets, such as Figure 2 As shown, a user applies for a corresponding tenant role to obtain access rights to data assets associated with the tenant role. Data assets between different tenants are not visible to each other.

[0034] Among them, tenants may include tenant administrators, modelers and / or operation and maintenance personnel. The tenant administrator is mainly responsible for the management of all tenants, including adding operation and maintenance personnel, modelers, etc., and has the greatest authority; modelers are mainly used to perform operations such as federated modeling, and operation and maintenance personnel are mainly used to perform production and operation related work. In this embodiment, after the user successfully applies for a tenant, the authority management system can generate a correspondence between the user name and the tenant identifier, and store the correspondence in the local database to generate a tenant division configuration.

[0035] Specifically, after receiving the data viewing request of the target user, the data assets currently requested by the target user can be obtained according to the data viewing request; then, the data assets that the target user has the right to view can be obtained according to the tenant division configuration. If it is determined that the data assets that the target user has the right to view include the data assets currently requested to view, the data assets currently requested to view can be determined as the target data assets. If it is determined that the data assets that the target user has the right to view do not include the data assets currently requested to view, a prompt message indicating that the target user has no right to view can be fed back to the user.

[0036] Optionally, obtaining the target data asset corresponding to the target user according to the tenant partition configuration and the data viewing request may include:

[0037] According to the data viewing request, obtaining the requested data asset corresponding to the target user;

[0038] According to the tenant division configuration, the tenant corresponding to the target user and the data assets corresponding to the tenant are obtained;

[0039] It is determined whether the requested data asset corresponding to the target user is included in the data asset corresponding to the tenant. If so, the requested data asset is used as the target data asset.

[0040] Specifically, the data viewing request can be parsed to obtain the requested data assets corresponding to the target user; then, the correspondence between the user name and the tenant identifier can be obtained according to the tenant division configuration, and the matching target correspondence can be found according to the user name of the target user, and the tenant in the target correspondence can be used as the tenant corresponding to the target user; at the same time, the data assets corresponding to the current tenant can be obtained according to the pre-set data assets associated with each tenant. Finally, if it is detected that the requested data assets corresponding to the target user are included in the data assets corresponding to the tenant, the requested data assets can be used as the target data assets.

[0041] The advantage of the above settings is that it can achieve the isolation of data assets and improve the security of data assets.

[0042] S120: Obtain a hierarchical management and control configuration, and obtain the viewing permission of the target user to the target data asset according to the hierarchical management and control configuration.

[0043] It should be noted that through tenant division, different applications or departments cannot see each other's asset data on the federated learning platform. However, all modelers in the same tenant see the same assets and actual data, which will cause different modelers to see the same data, that is, it is impossible to achieve more detailed hierarchical management and control, which is not conducive to data security.

[0044] In response to the above problems, this embodiment further performs hierarchical management and control configuration on the basis of tenant division configuration, mainly for different management and control of the data range that different users belonging to the same tenant can see. Specifically, for each user belonging to the same tenant, the viewing authority of the data assets associated with the tenant is pre-set to generate a corresponding relationship between the user and the viewing authority as the hierarchical management and control authority.

[0045] The viewing permissions may include table-level permissions, row-level permissions, and / or column-level permissions. For example, the viewing permissions for data assets may be as follows: Figure 3 As shown. In this embodiment, when the data asset is a table, it can be divided into three levels: table level, row level and column level. The table level has the highest authority, and different modelers can view data assets of different levels according to the level. For example, in a national consumption data table, some modelers can see the entire table data, some modelers can only see part of the row data, such as data of a certain region, and some modelers can only see certain column data, and other column data may be sensitive data to them.

[0046] Optionally, the viewing permission may also include field-level permission, that is, for each user, the table fields that the user can view are set, and other fields in the table are sensitive data for the user.

[0047] The advantage of the above settings is that it can improve the flexibility of permission control and refine the granularity of permission control.

[0048] Specifically, a preset hierarchical management and control configuration may be read from a local database, and a target user may be searched in the hierarchical management and control configuration to obtain the target user's permission to view the target data asset.

[0049] Optionally, according to the hierarchical management and control configuration, obtaining the viewing permission of the target user to the target data asset may include:

[0050] According to the hierarchical management and control configuration, the corresponding relationship between the user and the viewing permission is obtained, and according to the corresponding relationship between the user and the viewing permission, the viewing permission of the target user to the target data asset is obtained.

[0051] Specifically, the hierarchical control configuration can be parsed to obtain the corresponding relationship between the user and the viewing permission; then, the target corresponding relationship matching the target user can be found, and the viewing permission in the target corresponding relationship is used as the viewing permission corresponding to the target user. Since the data asset to which the target user has access rights is the target data asset, the current viewing permission is the viewing permission of the target user on the target data asset.

[0052] The advantage of the above settings is that it can achieve efficient and accurate acquisition of viewing permissions, which can improve the efficiency of permission management.

[0053] S130. Encrypt the target data asset according to the viewing authority to obtain an encrypted data asset, and display the encrypted data asset to the target user.

[0054] In this embodiment, when the target data asset is encrypted according to the viewing permission, part of the data that the target user has the viewing permission can be extracted from the target data asset, and the extracted part of the data can be used as the encrypted data asset; or part of the data in the target data asset that the target user does not have the viewing permission can be hidden to obtain the encrypted data asset. Then, the encrypted data asset can be visually displayed to the target user.

[0055] The solution of this embodiment can achieve data security management across heterogeneous engines by introducing a unified permission management method, which can solve the problem of unified permission management within the enterprise across products. At the same time, it can penetrate heterogeneous products and perform unified permission control according to the upper-level business system to facilitate data security management. Secondly, through the concept of tenant plus hierarchical management, data permissions can be managed more flexibly.

[0056] Optionally, encrypting the target data asset according to the viewing authority to obtain the encrypted data asset may include:

[0057] According to the viewing permission, determining in the target data asset sensitive data that the target user has no permission to view;

[0058] The sensitive data in the target data asset is hidden to obtain an encrypted data asset.

[0059] Specifically, based on the viewing permissions, the target user can determine the part of the data that he or she has the permission to view in the target data asset, and other data in the target data asset can be determined as sensitive data; then, the sensitive data in the target data asset can be hidden to obtain an encrypted data asset. The hiding method can include replacing with blank content or replacing with preset specified content.

[0060] The advantage of the above settings is that it can achieve permission management without user awareness, which can improve the user experience.

[0061] Optionally, hiding the sensitive data in the target data asset to obtain an encrypted data asset may include:

[0062] Obtaining the content type corresponding to the sensitive data and the setting content corresponding to the content type;

[0063] The sensitive data in the target data asset is replaced with the set content to obtain the encrypted data asset.

[0064] The content type may include tables, text, pictures, etc. In this embodiment, corresponding setting contents may be preset for different content types. For example, when the content type is text, the setting contents may be specified characters (e.g., *, etc.); and when the content type is picture, the setting contents may be preset pictures.

[0065] Specifically, first, the content type corresponding to the current sensitive data can be clarified, and the set content corresponding to the content type can be obtained; then, the sensitive data can be replaced with the set content in the target data asset to obtain the encrypted data asset.

[0066] The advantage of the above settings is that it can improve the flexibility of data hiding processing and meet the needs of users in different scenarios.

[0067] The technical solution of the embodiment of the present invention is as follows: when a data viewing request of the target user is detected, the target data asset corresponding to the target user is obtained according to the tenant division configuration and the data viewing request; the hierarchical management and control configuration is obtained, and the viewing authority of the target user to the target data asset is obtained according to the hierarchical management and control configuration; the target data asset is encrypting according to the viewing authority to obtain the encrypted data asset, and the encrypted data asset is displayed to the target user; by realizing two-level authority management based on the tenant division configuration and the hierarchical management and control configuration, unified authority management can be realized when using multiple federated learning platforms.

[0068] Embodiment 2

[0069] Figure 4 This is a schematic diagram of the structure of a rights management device provided by Embodiment 2 of the present invention. Figure 4 As shown, the device includes: a target data asset acquisition module 210, a viewing permission acquisition module 220 and a data asset encryption module 230; wherein,

[0070] The target data asset acquisition module 210 is used to acquire the target data asset corresponding to the target user according to the tenant partition configuration and the data viewing request when a data viewing request of the target user is detected;

[0071] A viewing permission acquisition module 220 is used to acquire a hierarchical management and control configuration, and acquire the viewing permission of the target user to the target data asset according to the hierarchical management and control configuration;

[0072] The data asset encryption module 230 is used to encrypt the target data asset according to the viewing authority to obtain an encrypted data asset, and display the encrypted data asset to the target user.

[0073] The technical solution of the embodiment of the present invention is as follows: when a data viewing request of the target user is detected, the target data asset corresponding to the target user is obtained according to the tenant division configuration and the data viewing request; the hierarchical management and control configuration is obtained, and the viewing authority of the target user to the target data asset is obtained according to the hierarchical management and control configuration; the target data asset is encrypting according to the viewing authority to obtain the encrypted data asset, and the encrypted data asset is displayed to the target user; by realizing two-level authority management based on the tenant division configuration and the hierarchical management and control configuration, unified authority management can be realized when using multiple federated learning platforms.

[0074] Optionally, the target data asset acquisition module 210 is specifically configured to acquire the requested data asset corresponding to the target user according to the data viewing request;

[0075] According to the tenant division configuration, the tenant corresponding to the target user and the data assets corresponding to the tenant are obtained;

[0076] It is determined whether the requested data asset corresponding to the target user is included in the data asset corresponding to the tenant. If so, the requested data asset is used as the target data asset.

[0077] Optionally, the viewing permission acquisition module 220 is specifically used to obtain the corresponding relationship between users and viewing permissions according to the hierarchical management and control configuration, and obtain the viewing permission of the target user to the target data asset according to the corresponding relationship between the user and the viewing permission.

[0078] Optionally, a data asset encryption module 230 is specifically configured to determine, in the target data asset, sensitive data that the target user is not authorized to view, according to the viewing permission;

[0079] The sensitive data in the target data asset is hidden to obtain an encrypted data asset.

[0080] Optionally, the data asset encryption module 230 is specifically used to obtain the content type corresponding to the sensitive data and the setting content corresponding to the content type;

[0081] The sensitive data in the target data asset is replaced with the set content to obtain the encrypted data asset.

[0082] Optionally, the tenant includes a tenant administrator, a modeler and / or an operation and maintenance personnel, and the viewing permissions include table-level permissions, row-level permissions and / or column-level permissions.

[0083] The rights management device provided in the embodiment of the present invention can execute the rights management method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0084] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0085] Embodiment 3

[0086] Figure 5 A schematic diagram of the structure of an electronic device 30 that can be used to implement an embodiment of the present invention is shown. The electronic device 30 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device 30 can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0087] like Figure 5 As shown, the electronic device 30 includes at least one processor 31, and a memory connected to the at least one processor 31, such as a read-only memory (ROM) 32, a random access memory (RAM) 33, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 31 can perform various appropriate actions and processes according to the computer program stored in the read-only memory 32 or the computer program loaded from the storage unit 38 to the random access memory 33. In the RAM 33, various programs and data required for the operation of the electronic device 30 can also be stored. The processor 31, the ROM 32 and the RAM 33 are connected to each other through a bus 34. The input / output (I / O) interface 35 is also connected to the bus 34.

[0088] A number of components in the electronic device 30 are connected to the I / O interface 35, including: an input unit 36, such as a keyboard, a mouse, etc.; an output unit 37, such as various types of displays, speakers, etc.; a storage unit 38, such as a disk, an optical disk, etc.; and a communication unit 39, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 39 allows the electronic device 30 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0089] The processor 31 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 31 include, but are not limited to, a central processing unit, a graphics processing unit, various special artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any appropriate processors, controllers, microcontrollers, etc. The processor 31 executes the various methods and processes described above, such as the rights management method.

[0090] In some embodiments, the rights management method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 38. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 30 via the ROM 32 and / or the communication unit 39. When the computer program is loaded into the RAM 33 and executed by the processor 31, one or more steps of the rights management method described above may be performed. Alternatively, in other embodiments, the processor 31 may be configured to execute the rights management method in any other appropriate manner (e.g., by means of firmware).

[0091] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays, application specific integrated circuits, application specific standard products, systems on a chip, load programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0092] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0093] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0094] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device 30 having: a display device (e.g., a cathode ray tube or a liquid crystal display) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which the user can provide input to the electronic device 30. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0095] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local area networks, wide area networks, blockchain networks, and the Internet.

[0096] A computing system may include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other. The server may be a cloud server.

[0097] This embodiment may also include a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the rights management method provided by any embodiment of the present invention.

[0098] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0099] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A rights management method, characterized in that: include: When a data viewing request of a target user is detected, the target data asset corresponding to the target user is obtained according to the tenant partition configuration and the data viewing request; Obtaining a hierarchical control configuration, and obtaining the viewing permission of the target user to the target data asset according to the hierarchical control configuration; The target data asset is encrypted according to the viewing authority to obtain an encrypted data asset, and the encrypted data asset is displayed to the target user.

2. The method according to claim 1, characterized in that: According to the tenant division configuration and data viewing request, the target data assets corresponding to the target user are obtained, including: According to the data viewing request, obtaining the requested data asset corresponding to the target user; According to the tenant division configuration, the tenant corresponding to the target user and the data assets corresponding to the tenant are obtained; It is determined whether the requested data asset corresponding to the target user is included in the data asset corresponding to the tenant. If so, the requested data asset is used as the target data asset.

3. The method according to claim 1, characterized in that According to the hierarchical control configuration, obtaining the target user's permission to view the target data asset includes: According to the hierarchical management and control configuration, the corresponding relationship between the user and the viewing permission is obtained, and according to the corresponding relationship between the user and the viewing permission, the viewing permission of the target user to the target data asset is obtained.

4. The method according to claim 1, characterized in that: The target data asset is encrypted according to the viewing authority to obtain an encrypted data asset, including: According to the viewing permission, determining in the target data asset sensitive data that the target user has no permission to view; The sensitive data in the target data asset is hidden to obtain an encrypted data asset.

5. The method according to claim 4, characterized in that The sensitive data in the target data asset is hidden to obtain an encrypted data asset, including: Obtaining the content type corresponding to the sensitive data and the setting content corresponding to the content type; The sensitive data in the target data asset is replaced with the set content to obtain the encrypted data asset.

6. The method according to any one of claims 1 to 5, characterized in that Tenants include tenant administrators, modelers, and / or operations personnel, and viewing permissions include table-level permissions, row-level permissions, and / or column-level permissions.

7. A rights management device, characterized in that: include: A target data asset acquisition module is used to acquire the target data asset corresponding to the target user according to the tenant partition configuration and the data viewing request when a data viewing request of the target user is detected; A viewing permission acquisition module is used to acquire a hierarchical management and control configuration, and acquire the viewing permission of the target user to the target data asset according to the hierarchical management and control configuration; The data asset encryption module is used to encrypt the target data asset according to the viewing authority to obtain the encrypted data asset, and display the encrypted data asset to the target user.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor, and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the rights management method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to enable a processor to implement the rights management method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the rights management method according to any one of claims 1 to 6 when executed by a processor.

Images