Data access method, electronic device and storage medium

Abstract

The embodiment of the present application provides a data access method, an electronic device and a storage medium. Among them, the data access method includes: according to the data access request of the accessing user, obtaining the role type of the accessing user and the first access rule corresponding to the accessing user; determining the credit data requested to be accessed by the data access request, and configuring the data interface corresponding to the access permission for the accessing user in combination with the role type and the first access rule; according to the data interface and the credit data requested to be accessed, determining the type of accessible credit data and the access policy for the type of credit data for the accessing user; accessing the matching credit data based on the access policy, and feeding back the data access result to the accessing user. Through the embodiment of the present application, the security of the credit data is guaranteed while meeting the needs of the accessing user.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data processing, and in particular to a data access method, an electronic device, and a storage medium. Background Art

[0002] Credit data is not only the basis for evaluating individual credit status, but also an important reference for credit decision-making, playing a vital role in the modern social credit system. Since credit data contains a large amount of sensitive information, its security issues have become a focus of increasing concern.

[0003] Under the existing mechanism, credit reporting agencies use different data interface services to share credit reporting data when managing credit reporting data. However, due to the lack of clear authority management, when providing credit information to the outside world, it is easy to cause credit reporting data to be leaked or maliciously used. Summary of the invention

[0004] In view of this, embodiments of the present application provide a data access method, an electronic device, and a storage medium to at least partially solve the above problems.

[0005] According to a first aspect of an embodiment of the present application, a data access method is provided, which is applied to a credit reporting system, comprising:

[0006] According to a data access request of the accessing user, obtaining a role type of the accessing user and a first access rule corresponding to the accessing user, wherein the first access rule is used to indicate the accessing user's access rights to the credit reporting data in the credit reporting system;

[0007] Determine the credit information data requested by the data access request, and configure a data interface corresponding to the access permission for the access user in combination with the role type and the first access rule;

[0008] Determining, for the accessing user, the type of credit information data accessible and the access policy for the type of credit information data, according to the data interface and the credit information data requested for access;

[0009] The matching credit data is accessed based on the access policy, and the data access result is fed back to the accessing user.

[0010] In an optional embodiment, determining the credit information data requested by the data access request, and configuring a data interface corresponding to the access permission for the access user in combination with the role type and the first access rule, includes:

[0011] Determine the accessible data interface type of the accessing user according to the role type; wherein the accessible data interface types include multiple types, and each accessible data interface type includes multiple accessible data interfaces;

[0012] The accessible data interface is screened based on the credit information data requested to be accessed by the data access request and the first access rule to determine a data interface corresponding to the access permission.

[0013] In an optional embodiment, the first access rule includes: a first range of data interfaces that the credit reporting system allows the accessing user to access;

[0014] The step of screening the accessible data interface based on the credit information data requested to be accessed by the data access request and the first access rule to determine the data interface corresponding to the access permission includes:

[0015] Acquire the data subject to which the credit information data requested to be accessed belongs, and acquire the second range of the data interface that the data subject allows the access user to access;

[0016] The accessible data interfaces are screened based on the first range and the second range to determine the data interfaces corresponding to the access rights that the accessing user is allowed to access during this access.

[0017] In an optional embodiment, determining the type of credit data accessible to the accessing user and the access policy for the type of credit data according to the data interface and the credit data requested for access, includes:

[0018] Screening the credit data requested for access according to the credit data corresponding to the access of the data interface to determine the credit data accessible to the accessing user;

[0019] Determining the type of credit information data that can be accessed and the access policy for the type of credit information data;

[0020] Among them, the types of accessible credit data include: authorized data, desensitized data and private data; the authorized data, the desensitized data and the private data are encrypted data.

[0021] In an optional embodiment, when the type of the accessible credit data is authorized data, the matching credit data is accessed based on the access policy, and the data access result is fed back to the accessing user.

[0022] include:

[0023] Obtaining a unique identifier of the data subject to which the accessible credit information data belongs, and an authorization association table storing user information of an authorized user authorized by the data subject to access the data;

[0024] Based on the unique identifier, query in the authorization association table whether the access user is an authorized user of the data subject;

[0025] If the access user is an authorized user of the data subject, a key is obtained from the authorization association table to decrypt the authorization data, and the decrypted authorization data is fed back to the access user.

[0026] In an optional embodiment, when the type of the accessible credit information data is desensitized data, the matching credit information data is accessed based on the access policy, and the data access result is fed back to the accessing user.

[0027] include:

[0028] Obtain the data to be queried provided by the accessing user, and encrypt the data to be queried using an encryption algorithm for desensitized data;

[0029] A query is performed in the desensitized data according to the encrypted data to be queried, and the query result is fed back to the accessing user.

[0030] In an optional embodiment, when the type of the accessible credit data is private data, the matching credit data is accessed based on the access policy, and the data access result is fed back to the accessing user.

[0031] include:

[0032] Combining multiple preset authentication methods to authenticate the data subject of the access user;

[0033] When it is confirmed through authentication that the accessing user is the data subject to which the private data belongs, a query is performed in the private data based on a query command of the accessing user, and the query result is fed back to the accessing user.

[0034] In an optional embodiment, the first access rule further includes: the credit reporting system allows the access user to access a third range of report interfaces; the method further includes:

[0035] receiving a report access request from the access user;

[0036] confirming the accessible reporting interface of the accessing user according to the role type of the accessing user;

[0037] Acquire the data subject to which the credit information data used by the accessible reporting interface belongs, and acquire the fourth scope of the reporting interface that the data subject allows the accessing user to access;

[0038] According to the third range and the fourth range, the accessible report interface is screened to determine the report interface corresponding to the access permission that the access user is allowed to access in this access;

[0039] Calling the report interface to generate a report corresponding to the report access request; wherein the data used by the report interface to generate the report includes: a data access result obtained by calling a data interface corresponding to the access permission;

[0040] The report is fed back to the access user.

[0041] According to a second aspect of an embodiment of the present application, an electronic device is provided, comprising a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, a method as described in any one of the first aspects is implemented.

[0042] According to a third aspect of an embodiment of the present application, there is provided a computer storage medium configured to store computer program instructions, wherein the computer program instructions are used to execute any one of the methods according to the first aspect.

[0043] According to the solution provided in the embodiment of the present application, based on the data access request of the accessing user, the role type of the accessing user and the first access rule corresponding to the accessing user are obtained; the credit data requested to be accessed by the data access request is determined, and in combination with the role type and the first access rule, a data interface corresponding to the access permission is configured for the accessing user, thereby implementing interface permission access management for the accessing user and reducing the security risk of permission abuse; based on the data interface and the credit data requested to be accessed, the type of accessible credit data and the access policy for this type of credit data are determined for the accessing user, and the security and availability of the credit data are enhanced by classifying and managing the credit data; matching credit data is accessed based on the access policy, and the data access result is fed back to the accessing user, thereby ensuring the security of the credit data while meeting the needs of the accessing user. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0045] Figure 1A flowchart of a data access method according to an embodiment of the present application;

[0046] Figure 2 It is a structural diagram of a data access device according to an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0048] A credit reporting agency is a third-party agency established in accordance with the law and independent of both parties to a credit transaction. It mainly operates credit reporting business, provides diversified credit reporting services, and plays a vital role in the credit reporting market. The credit reporting system of a credit reporting agency stores a large amount of credit information. Visitors can query the required credit information through the credit reporting system to understand the credit status of the other party or themselves.

[0049] The specific implementation of the embodiment of the present application is further explained below in conjunction with the accompanying drawings of the embodiment of the present application.

[0050] See also Figure 1 As shown, the embodiment of the present application provides a data access method, comprising the following steps:

[0051] Step S102. According to the data access request of the accessing user, the role type of the accessing user and the first access rule corresponding to the accessing user are obtained, where the first access rule is used to indicate the access rights of the accessing user to the credit data in the credit reporting system.

[0052] In one feasible way, the accessing user needs to log in before accessing the credit reporting system. For users who access the credit reporting system for the first time, the credit reporting system needs to create the accessing user based on the information provided by the user and set login credentials for the accessing user, such as user name and password. The accessing user can then log in to the credit reporting system with the login credentials. Furthermore, the credit reporting system configures a role for the accessing user based on the information provided by the accessing user. In one feasible way, the credit reporting system confirms the characteristics of the accessing user and the usage scenario of the credit reporting data in combination with the credit reporting institution to which the credit reporting system belongs and the accessing user, configures a role for the accessing user, and completes the creation of the accessing user.

[0053] In order to better classify access users and strengthen access rights management for access users, in one feasible approach, multiple types of access user roles are pre-designed based on data usage scenarios and user characteristics. For example, the pre-designed types of access user roles include: financial institutions, external credit reporting agencies, data companies, and data subjects. Among them, financial institutions are institutions that provide financial services such as savings and investments, such as banks, insurance companies, securities companies, etc.; external credit reporting agencies are institutions engaged in credit reporting business other than the credit reporting agencies to which the credit reporting system belongs; data companies are companies that provide data services such as data collection, processing, and analysis, such as companies that provide big data collection, data mining, and other services; data subjects are the data subjects to whom the credit data collected by the credit reporting system belongs. When a credit reporting agency owns the credit data of a certain customer, the customer to whom the credit data belongs is the source and owner of the data and is regarded as the data subject of the data.

[0054] After logging into the credit reporting system, the accessing user sends a data access request to the credit reporting system based on demand. When receiving the data access request, the credit reporting system obtains user information including the role type of the accessing user. Furthermore, the credit reporting system obtains the first access rule corresponding to the accessing user. The first access rule is used to indicate the access rights of the accessing user to the credit data in the credit reporting system, which is based on the agreement or contract signed in advance between the credit reporting agency to which the credit reporting system belongs and the accessing user.

[0055] Step S104: Determine the credit information data requested by the data access request, and configure a data interface corresponding to the access permission for the access user in combination with the role type and the first access rule.

[0056] In order to enhance the security of credit data, strengthen the management efficiency of credit data and improve the availability of credit data, credit data is classified and managed. In one feasible approach, the types of credit data include authorized data, desensitized data and privacy data.

[0057] Among them, the authorized data is the data authorized by a designated institution to use by a data subject such as an enterprise, such as: business information, financial and tax information, business stability and risk indicator information of processing, supply chain and industrial chain information of processing enterprises, etc. When storing the authorized data in the credit reporting system, in a feasible way, a distributed storage system is used to integrate Hbase technology and Hadoop technology to store the authorized data. Specifically, a key-value storage architecture is used to store the authorized data. Among them, key is a unique identifier, which is a unique identifier of a data subject such as an enterprise, such as: a corporate tax number or name; value is the authorized data. In a feasible way, the authorized data is encrypted data, for example, encrypted data encrypted by symmetric encryption to protect the security of the authorized data. In a feasible way, the key of the authorized data is stored in the authorization association table, which includes: the unique identifier of the data subject such as the enterprise, the user information of the authorized user authorized by the data subject to access the data, and the encryption and decryption key. Therefore, the authorization data is stored and encrypted and decrypted on a household basis, that is, all the authorization data of a specific data subject is stored in a unified location in the credit reporting system, which is convenient for unified management and quick access to data, and all the authorization data of a specific data subject is uniformly encrypted or decrypted during storage and transmission, ensuring the integrity and security of the authorization data.

[0058] Desensitized data is sensitive data that can be verified but not exported, that is, data that cannot be directly exported. It is used for verification services, such as two-factor verification of name and mobile phone number operator, supply chain relationship verification, etc. In a feasible way, sensitive data such as ID card number, mobile phone number, card number, customer number, etc. are desensitized to obtain desensitized data. After the sensitive data is desensitized, it cannot be restored or output as sensitive data with practical significance. Therefore, desensitized data can still be used for verification, but the original sensitive data cannot be directly obtained by attackers, ensuring that sensitive data will not be leaked during the data verification process. When storing desensitized data in the credit reporting system, in a feasible way, the relational database PostgreSQL is used to store desensitized data. PostgreSQL supports data encryption, and encryption algorithms can be used to encrypt and store sensitive data to ensure the security of credit reporting data during storage and transmission. Further, in order to ensure the security of credit reporting data, in a feasible way, the sensitive data is encrypted and stored, for example, MD5 (Message Digest Algorithm 5, message digest algorithm version 5) is used to encrypt the sensitive data, obtain desensitized data and store it.

[0059] Private data is credit reporting data that only serves the data subject and does not provide services to external organizations. When storing private data in the credit reporting system, in one feasible way, the relational database PostgreSQL is used to store private data and encrypt the private data. A third-party plug-in that provides PGP (Pretty Good Privacy) encryption function is used, such as the encryption extension plug-in pgcrypto of PostgreSQL, or TDE (Transparent Data Encryption) is used to encrypt the entire table file storing the private data of the data subject in the database.

[0060] In a feasible manner, the types of credit investigation data also include public data. Public data refers to data that is disclosed to the public or disclosed to specific objects, such as enterprise disclosure information, basic industrial and commercial information, administrative licenses / penalties, judicial information, industry information processed based on public disclosure information, statistical information, classified information, etc. When storing public data in the credit investigation system, in a feasible manner, a distributed storage system is used to integrate Hbase technology and Hadoop technology to store public data.

[0061] Therefore, the security and availability of credit data can be enhanced by classifying, managing, storing separately, and encrypting credit data according to the types of authorized data, desensitized data, privacy data, and public data.

[0062] In the embodiment of the present application, based on the user-role-resource design theory, the association between access users, role types and credit data is defined to achieve fine management of access rights of access users. The user concept in this embodiment is the access user, who is the actual user in the credit system, and accesses and operates the credit data in the credit system by logging into the credit system; the role concept in this embodiment is the role type, which represents a set of access users with the same permissions; the resource concept in this embodiment is the credit data, which is accessed through the data interface.

[0063] In the credit reporting system, interface services are pre-packaged based on business needs to access credit data in the database. In one feasible manner, the encapsulated interface service adopts the RESTful interface specification. For example, in one feasible manner, a data interface is encapsulated, and the credit data in the credit reporting system can be accessed through the data interface to realize the exchange and sharing of credit data. Specifically, the data interface types include: authorization interface, desensitizing interface, and privacy interface. The authorization interface, desensitizing interface, and privacy interface access different types of credit data respectively. In a feasible manner, the data interface type also includes: public interface.

[0064] In one feasible approach, the public interface corresponds to accessing public data in the credit reporting system, the authorization interface corresponds to accessing authorized data in the credit reporting system, the desensitized interface corresponds to accessing desensitized data in the credit reporting system, and the privacy interface corresponds to accessing private data in the credit reporting system.

[0065] Furthermore, in a feasible manner, for each role type, the data interface type that can be accessed is pre-assigned to the role type. For example, the Spring Security framework is used to establish an accessibility association between the role type and the accessible data interface type, so as to grant accessible data interface types to each role type. For example, the data subject is granted the permission to access the public interface, authorization interface, desensitized interface, and privacy interface, the financial institution is granted the permission to access the public interface, authorization interface, and desensitized interface, the external credit reporting agency is granted the permission to access the public interface and desensitized interface, the data company is granted the permission to access the public interface, etc.

[0066] In one feasible manner, the accessible data interface types of the accessing user are confirmed based on the role type of the accessing user. Each role type corresponds to at least one data interface type that can be accessed. Correspondingly, the accessible data interface types include multiple types, and each accessible data interface type includes multiple accessible data interfaces. Thus, different accessible data interface types are confirmed based on different role types, and all data interface types that each user can access if permitted by the credit reporting system are confirmed, thereby reducing security risks.

[0067] Furthermore, the accessible data interfaces are screened based on the credit information data requested to be accessed by the data access request and the first access rule to determine the data interface corresponding to the access permission.

[0068] Specifically, the credit reporting system determines the credit reporting data requested by the accessing user in the data access request. Furthermore, in a feasible manner, the data subject to which the credit reporting data requested by the data access request belongs is obtained, and the second range of data interfaces that the data subject allows the accessing user to access is obtained. Combined with the first range of data interfaces that the credit reporting system allows the accessing user to access, which is included in the first access rule corresponding to the accessing user, that is, based on the first range and the second range, the accessible data interfaces are screened, thereby determining the data interfaces corresponding to the access rights that the accessing user is allowed to access in this access. Therefore, the authority constraints of the credit reporting system and the data subject on the accessing user are comprehensively considered to ensure that each accessing user only has the minimum set of permissions required to complete the data access request, thereby reducing the security risk of authority abuse and ensuring the security of credit reporting data.

[0069] Step S106. According to the data interface and the credit information data requested for access, determine the type of credit information data that can be accessed and the access policy for the type of credit information data for the accessing user.

[0070] In order to remove the credit data requested by the data access request that does not comply with the access permission regulations, in a feasible way, according to the credit data corresponding to the data interface corresponding to the access permission that the access user is allowed to access in this access, the credit data requested by the access user is screened, and the data that the access user does not have the permission to access in this access is removed to determine the credit data that the access user can access. In this way, it is ensured that each access user will not obtain the credit data that does not comply with the access permission regulations, and the security of the credit data is guaranteed.

[0071] Furthermore, the type of credit information data that can be accessed and the access policy for the credit information data of that type are determined.

[0072] Among them, in one feasible approach, different access strategies need to be implemented when accessing different types of credit data.

[0073] Step S108: Access the matching credit data based on the access policy, and feedback the data access result to the accessing user.

[0074] In one feasible method, when accessing authorized data, matching credit data is accessed based on the access policy, and the data access results are fed back to the accessing user, including:

[0075] Obtain the unique identifier of the data subject to which the accessible credit data belongs, and the user information authorization association table storing the user information of the authorized user authorized by the data subject to access the data; used to confirm whether the accessing user is authorized by the data subject.

[0076] Based on the unique identifier, the access user is queried in the authorization association table to see if he is the authorized user of the data subject. If the access user is found to be the authorized user of the data subject, the encryption and decryption key of the data subject in the authorization association table is obtained, the encrypted authorization data is obtained from the authorization data table of the data subject's authorization data, and the encryption and decryption key is used to decrypt the authorization data of the data subject, and the decrypted authorization data is fed back to the access user. In this way, the security of credit data is guaranteed while meeting the needs of the access user.

[0077] Furthermore, the access is implemented by using an interface in Java for calling native code.

[0078] In one feasible approach, when accessing desensitized data, matching credit data is accessed based on the access policy, and the data access results are fed back to the accessing user, including:

[0079] Obtain the data to be queried provided by the access user, and encrypt the data to be queried using an encryption algorithm for desensitized data; for example, encrypt the data to be queried using an MD5 encryption algorithm for desensitized data;

[0080] In the database storing the desensitized data, the desensitized data is queried using structured query language based on the encrypted data to be queried, and the query results are fed back to the accessing user. This ensures that the original sensitive data will not be leaked during the data verification process, and guarantees the security of the credit data while meeting the needs of the accessing user.

[0081] In one feasible approach, when accessing private data, matching credit data is accessed based on the access policy, and the data access results are fed back to the accessing user, including:

[0082] By combining multiple preset authentication methods, such as facial recognition and enterprise four-factor authentication, the accessing user is authenticated as the data subject, and it is determined whether the accessing user is the data subject of the private data requesting access, ensuring that private data only serves the data subject to which it belongs, thereby maximizing control over the data subject's use of private data.

[0083] The entire table file storing the privacy data of the data subject in the database is decrypted, and a query is performed in the privacy data based on the query command of the accessing user, and the query result is fed back to the accessing user.

[0084] In one feasible approach, hierarchical permission control is adopted to ensure the security of private data; for example, a two-level permission control is adopted: the database storing private data only opens the query permission of private data to machine A with a fixed IP (Internet Protocol) in the intranet;

[0085] Furthermore, a privacy interface is encapsulated on machine A, and machine A only enables physical access rights to application services involving the data subject in the machine's internal system.

[0086] This further ensures that private data only serves the data subject to which it belongs, thus guaranteeing the security of private data.

[0087] In one feasible method, when accessing public data, an interface in Java for calling local code is used to implement access, and the credit reporting system feeds back the public data requested to be accessed to the accessing user.

[0088] In a feasible manner, the interface service is pre-packaged in the credit reporting system based on business needs, and further includes: a packaged report interface. The credit reporting system includes multiple preset report interfaces for obtaining reports containing multi-dimensional credit reporting data.

[0089] Specifically, after receiving the report access request from the accessing user, the credit reporting system confirms the accessible report interface of the accessing user according to the role type of the accessing user. In the embodiment of the present application, the association between different role types and different report interfaces is pre-established to confirm the report interface accessible to each role type.

[0090] Furthermore, the data subject to whom the credit data used by the accessible reporting interface belongs is obtained, and the fourth scope of the reporting interface that the data subject allows the accessing user to access is obtained, so as to prevent the accessing user from obtaining reports that do not comply with the access rights.

[0091] The fourth range is combined with the third range of the reporting interface that the credit reporting system allows the accessing user to access in the first access rule to jointly screen the accessible reporting interfaces to determine the reporting interface corresponding to the access permission that the accessing user is allowed to access in this visit.

[0092] The report interface is called to generate a report corresponding to the report access request, and the report is fed back to the accessing user. The data used by the report interface to generate the report includes: the data access result obtained by calling the data interface corresponding to the access permission. Therefore, quickly obtaining the report through the report interface helps the accessing user to fully understand the credit status of the data subject.

[0093] Therefore, through the method of the embodiment of the present application, according to the data access request of the access user, the role type of the access user and the first access rule corresponding to the access user are obtained, the credit data requested to be accessed by the data access request is determined, and in combination with the role type and the first access rule, the data interface corresponding to the access permission is configured for the access user, thereby realizing the interface permission access management of the access user, comprehensively considering the permission constraints of the credit system and the data subject on the access user, ensuring that each access user only has the minimum permission set required to complete the data access request, thereby reducing the security risk of permission abuse and ensuring the security of the credit data; according to the data interface and the credit data requested for access, the type of accessible credit data and the access policy for the type of credit data are determined for the access user, wherein the classification and governance of credit data enhances the security of credit data, strengthens the management efficiency of credit data, and improves the availability of credit data; based on the access policy, the matching credit data is accessed, and the data access result is fed back to the access user, wherein different access policies are set for each type of credit data to ensure that it will not be leaked during the data access process, and the security of the credit data is guaranteed while meeting the needs of the access user.

[0094] The present application also provides a data access device for use in a credit reporting system, see Figure 2 As shown, including:

[0095] The first acquisition unit is used to acquire the role type of the accessing user and the first access rule corresponding to the accessing user according to the data access request of the accessing user, and the first access rule is used to indicate the accessing user's access rights to the credit data in the credit reporting system.

[0096] A configuration unit, used to determine the credit information data requested by the data access request, and configure a data interface corresponding to the access permission for the access user in combination with the role type and the first access rule;

[0097] In one feasible manner, the accessible data interface types of the accessing user are confirmed based on the role type of the accessing user. Each role type corresponds to at least one data interface type that can be accessed. Correspondingly, the accessible data interface types include multiple types, and each accessible data interface type includes multiple accessible data interfaces. Thus, different accessible data interface types are confirmed based on different role types, and all data interface types that each user can access if permitted by the credit reporting system are confirmed, thereby reducing security risks.

[0098] Further, based on the credit information data requested to be accessed by the data access request and the first access rule, the accessible data interface is screened to determine the data interface corresponding to the access permission;

[0099] Specifically, the credit reporting system determines the credit reporting data requested by the accessing user in the data access request, and further, in a feasible manner, obtains the data subject to which the credit reporting data requested by the data access request belongs, and obtains the second range of data interfaces that the data subject allows the accessing user to access. Combined with the first range of data interfaces that the credit reporting system allows the accessing user to access, which is included in the first access rule corresponding to the accessing user, that is, based on the first range and the second range, the accessible data interfaces are screened, thereby determining the data interface corresponding to the access permission that the accessing user is allowed to access in this access.

[0100] A second acquisition unit, configured to determine, for the accessing user, the type of credit information data accessible and the access policy for the credit information data of that type, according to the data interface and the credit information data requested for access;

[0101] In order to remove the credit information data requested by the data access request that does not comply with the access permission regulations, in a feasible manner, according to the credit information data corresponding to the data interface corresponding to the access permission that the access user is allowed to access in this access, the credit information data requested by the access user is screened, and the data that the access user does not have the permission to access in this access is removed to determine the credit information data that the access user can access;

[0102] Furthermore, the type of credit information data that can be accessed and the access policy for the credit information data of that type are determined.

[0103] The access unit is used to access the matching credit data based on the access policy and feedback the data access results to the accessing user.

[0104] The information interaction, execution process, etc. between the units in the above-mentioned device are based on the same concept as the embodiment of the method of the present application. For specific contents, please refer to the description in the embodiment of the method of the present application, and will not be repeated here.

[0105] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the data access method in any embodiment of the present invention is implemented.

[0106] The present application also provides a computer storage medium configured to store computer program instructions for executing the method described in any of the above method embodiments. The computer storage medium includes, but is not limited to, a compact disc read-only memory (CD-ROM), a random access memory (RAM), a floppy disk, a hard disk, or a magneto-optical disk.

[0107] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0108] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (such as an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA)). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., a random access memory (RAM), a read-only memory (ROM), a flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the method shown here, the execution of the code converts the general-purpose computer into a dedicated computer for executing the method shown here.

[0109] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for specific applications, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0110] The above implementation methods are only used to illustrate the embodiments of the present application, and are not limitations on the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application. The scope of patent protection of the embodiments of the present application should be limited by the claims.

Claims

1. A data access method, applied to a credit reporting system, characterized in that: include: According to a data access request of the accessing user, obtaining a role type of the accessing user and a first access rule corresponding to the accessing user, wherein the first access rule is used to indicate the accessing user's access rights to the credit reporting data in the credit reporting system; Determine the credit information data requested by the data access request, and configure a data interface corresponding to the access permission for the access user in combination with the role type and the first access rule; Determining, for the accessing user, the type of credit information data accessible and the access policy for the type of credit information data, according to the data interface and the credit information data requested for access; The matching credit data is accessed based on the access policy, and the data access result is fed back to the accessing user.

2. The method according to claim 1, characterized in that The determining the credit information data requested by the data access request, and configuring a data interface corresponding to the access permission for the access user in combination with the role type and the first access rule, includes: Determine the accessible data interface type of the accessing user according to the role type; wherein the accessible data interface types include multiple types, and each accessible data interface type includes multiple accessible data interfaces; The accessible data interface is screened based on the credit information data requested to be accessed by the data access request and the first access rule to determine a data interface corresponding to the access permission.

3. The method according to claim 2, characterized in that The first access rule includes: a first range of data interfaces that the credit reporting system allows the accessing user to access; The step of screening the accessible data interface based on the credit information data requested to be accessed by the data access request and the first access rule to determine the data interface corresponding to the access permission includes: Acquire the data subject to which the credit information data requested to be accessed belongs, and acquire the second range of the data interface that the data subject allows the access user to access; The accessible data interfaces are screened based on the first range and the second range to determine the data interfaces corresponding to the access rights that the accessing user is allowed to access during this access.

4. The method according to claim 3, characterized in that The step of determining the type of credit information data accessible to the accessing user and the access policy for the type of credit information data according to the data interface and the credit information data requested for access includes: Screening the credit data requested for access according to the credit data corresponding to the access of the data interface to determine the credit data accessible to the accessing user; Determining the type of credit information data that can be accessed and the access policy for the type of credit information data; Among them, the types of accessible credit data include: authorized data, desensitized data and private data; the authorized data, the desensitized data and the private data are encrypted data.

5. The method according to claim 4, characterized in that When the type of the accessible credit data is authorized data, the matching credit data is accessed based on the access policy, and the data access result is fed back to the accessing user. include: Obtaining a unique identifier of the data subject to which the accessible credit information data belongs, and an authorization association table storing user information of an authorized user authorized by the data subject to access the data; Based on the unique identifier, query in the authorization association table whether the access user is an authorized user of the data subject; If the access user is an authorized user of the data subject, a key is obtained from the authorization association table to decrypt the authorization data, and the decrypted authorization data is fed back to the access user.

6. The method according to claim 4, characterized in that When the type of the accessible credit information data is desensitized data, the matching credit information data is accessed based on the access policy, and the data access result is fed back to the accessing user. include: Obtain the data to be queried provided by the accessing user, and encrypt the data to be queried using an encryption algorithm for desensitized data; A query is performed in the desensitized data according to the encrypted data to be queried, and the query result is fed back to the accessing user.

7. The method according to claim 4, characterized in that When the type of the accessible credit data is private data, the matching credit data is accessed based on the access policy, and the data access result is fed back to the accessing user. include: Combining multiple preset authentication methods to authenticate the data subject of the access user; When it is confirmed through authentication that the accessing user is the data subject to which the private data belongs, a query is performed in the private data based on a query command of the accessing user, and the query result is fed back to the accessing user.

8. The method according to claim 3, characterized in that The first access rule further includes: a third range of report interfaces that the credit reporting system allows the access user to access; the method further includes: receiving a report access request from the access user; confirming the accessible reporting interface of the accessing user according to the role type of the accessing user; Acquire the data subject to which the credit information data used by the accessible reporting interface belongs, and acquire the fourth scope of the reporting interface that the data subject allows the accessing user to access; According to the third range and the fourth range, the accessible report interface is screened to determine the report interface corresponding to the access permission that the access user is allowed to access in this access; Calling the report interface to generate a report corresponding to the report access request; wherein the data used by the report interface to generate the report includes: a data access result obtained by calling a data interface corresponding to the access permission; The report is fed back to the access user.

9. An electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

10. A computer storage medium, characterized in that: The device is configured to store computer program instructions for executing the method according to any one of claims 1 to 8.

Images