Access control method and device for low-code platform, equipment and storage medium

Abstract

The invention relates to the technical field of information security of low-code platforms, and provides an access control method and device for a low-code platform, equipment and a storage medium, and the method comprises the steps: intercepting an access request of a user; obtaining a union set of function authorization and function group authorization of the user; judging whether the union set meets an access function corresponding to the access request or not; if the union set meets the access function corresponding to the access request, acquiring data authorization of the user; generating an SQL query condition according to the data authorization; and obtaining return data for the access request according to the SQL query condition. According to the embodiment of the invention, the access security and access control flexibility of the low-code platform can be improved.

Description

Technical Field

[0001] This specification relates to the field of information security technology of low-code platforms, and in particular to an access control method, device, equipment and storage medium for a low-code platform. Background Art

[0002] Low-Code Development Platform (LCDP) is a tool that enables rapid application development through visual programming and a small amount of code, mainly for business personnel and IT personnel. Traditional access control of low-code platforms mainly includes authorization based on user groups and roles, authorization based on objects, authorization based on data classification, and authorization based on access requests. However, the access security and access control flexibility of these four access control modes need to be improved. Summary of the invention

[0003] The purpose of the embodiments of this specification is to provide an access control method, device, equipment and storage medium for a low-code platform to improve the access security and access control flexibility of the low-code platform.

[0004] To achieve the above objectives, on the one hand, an embodiment of this specification provides an access control method for a low-code platform, including:

[0005] Intercept user access requests;

[0006] Obtaining the union of the user's function authorization and function group authorization;

[0007] Determining whether the union satisfies the access function corresponding to the access request;

[0008] If the union satisfies the access function corresponding to the access request, obtaining data authorization of the user;

[0009] Generate SQL query conditions according to the data authorization;

[0010] The returned data for the access request is obtained according to the SQL query condition.

[0011] In the access control method of the low-code platform of the embodiment of this specification, judging whether the union satisfies the access function corresponding to the access request includes:

[0012] Determine whether the user's function authorization or function group authorization includes the current interface;

[0013] If the function authorization of the user includes the current interface, or the function group authorization of the user includes the current interface, confirming that the union satisfies the access function corresponding to the access request;

[0014] If the function authorization of the user does not include the current interface, and the function group authorization of the user does not include the current interface, it is confirmed that the union does not satisfy the access function corresponding to the access request.

[0015] In the access control method of the low-code platform of the embodiment of this specification, after determining whether the union satisfies the access function corresponding to the access request, it also includes:

[0016] If the union does not satisfy the access function corresponding to the access request, the access request is rejected.

[0017] In the access control method of the low-code platform of the embodiment of this specification, the SQL query condition is generated according to the data authorization, including:

[0018] Obtain a triple consisting of an operation field, an operator, and an operation value attribute of the data authorization;

[0019] The triples are converted into SQL query conditions.

[0020] In the access control method of the low-code platform of the embodiment of this specification, obtaining the return data for the access request according to the SQL query condition includes:

[0021] Identifying a data access type corresponding to the access request;

[0022] If the data access type corresponding to the access request is a data list query, adding the SQL query condition to the SQL statement corresponding to the access request;

[0023] Execute the SQL statement to obtain return data that meets the SQL query condition.

[0024] In the access control method of the low-code platform of the embodiment of this specification, after identifying the data access type corresponding to the access request, it also includes:

[0025] If the data access type corresponding to the access request is single data access, combining the SQL query condition with the data ID of the single data into a new SQL query condition;

[0026] Adding the new SQL query condition to the SQL statement corresponding to the access request;

[0027] Execute the SQL statement and determine whether the returned data is empty;

[0028] If the returned data is not empty, confirm that the returned data that meets the new SQL query condition is obtained;

[0029] If the returned data is empty, the access request is rejected.

[0030] On the other hand, the embodiment of this specification also provides an access control device for a low-code platform, including:

[0031] An interception module is used to intercept user access requests;

[0032] A first acquisition module, used to acquire the union of the function authorization and the function group authorization of the user;

[0033] A judging module, used to judge whether the union satisfies the access function corresponding to the access request;

[0034] A second acquisition module, configured to acquire data authorization of the user if the union satisfies the access function corresponding to the access request;

[0035] A generation module, used to generate SQL query conditions according to the data authorization;

[0036] The third acquisition module is used to acquire the return data for the access request according to the SQL query condition.

[0037] On the other hand, an embodiment of the present specification further provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein when the computer program is executed by the processor, the instructions of the above method are executed.

[0038] On the other hand, an embodiment of the present specification further provides a computer storage medium on which a computer program is stored. When the computer program is executed by a processor of a computer device, the instructions of the above method are executed.

[0039] On the other hand, an embodiment of the present specification further provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor of a computer device, the computer program executes instructions of the above method.

[0040] It can be seen from the technical solutions provided by the above embodiments of this specification that after intercepting the user's access request, the embodiments of this specification can obtain the union of the user's function authorization and function group authorization. If the union does not satisfy the access function corresponding to the access request, access is denied. If the union satisfies the access function corresponding to the access request, SQL query conditions can be further generated according to the user's data authorization, and then the return data for the access request can be obtained according to the SQL query conditions; in this way, the access security and access control flexibility are improved through the combination of function access control and data access control; not only that, the flexibility of function authorization control can be further improved by introducing the user's function authorization and function group authorization. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0042] Figure 1 A schematic diagram of an access control system of a low-code platform in some embodiments of this specification is shown;

[0043] Figure 2 A flowchart of an access control method for a low-code platform in some embodiments of this specification is shown;

[0044] Figure 3 Shows Figure 2 A flowchart of the method for determining whether a union satisfies an access function corresponding to an access request;

[0045] Figure 4 Shows Figure 2 A flowchart of obtaining return data for an access request according to SQL query conditions in the method shown;

[0046] Figure 5 Shows Figure 2 A schematic diagram of a rights management table in the method shown;

[0047] Figure 6 A structural block diagram of an access control device of a low-code platform in some embodiments of this specification is shown;

[0048] Figure 7 The structure block diagram of the computer device in some embodiments of the present specification is shown.

[0049] [Description of Reference Numerals]

[0050] 10. Client;

[0051] 20. Server;

[0052] 61. Interception module;

[0053] 62. A first acquisition module;

[0054] 63. Judgment module;

[0055] 64. Second acquisition module;

[0056] 65. Generate module;

[0057] 66. The third acquisition module;

[0058] 702. Computer equipment;

[0059] 704, processor;

[0060] 706. Memory;

[0061] 708, driving mechanism;

[0062] 710, input / output interface;

[0063] 712. Input devices;

[0064] 714. Output devices;

[0065] 716. Presentation equipment;

[0066] 718. Graphical user interface;

[0067] 720, network interface;

[0068] 722. Communication link;

[0069] 724. Communication bus. DETAILED DESCRIPTION

[0070] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0071] It should be noted that in the embodiments of this specification, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user and fully authorized by all parties, that is, the acquisition, transmission, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0072] A low-code development platform is a development platform that can quickly generate applications without coding or with a small amount of code. Through a visual method of application development (refer to visual programming language), developers with different experience levels can use a graphical user interface to use drag-and-drop components and model-driven logic to develop web pages, mobile applications, etc. At present, common low-code development platforms include: digital process automation, public cloud, low-code development platforms for professional developers, low-code development platforms for business developers, AI / machine learning, process automation robots (RPA), collaborative management and digital operation platforms, etc.

[0073] Traditional access control of low-code platforms mainly includes authorization based on user groups and roles, authorization based on objects, authorization based on data classification, and authorization based on access requests. However, the access security and access control flexibility of these four access control modes need to be improved. In view of this, in order to improve the access security and access control flexibility of low-code platforms, the embodiments of this specification provide an improved access control solution for low-code platforms.

[0074] Figure 1 A schematic diagram of the access control system of the low-code platform in some embodiments of this specification is shown; the access control system includes a client 10 and a server 20. The client 10 can initiate an access request based on the user's operation; the server 20 can intercept the user's access request; obtain the union of the user's function authorization and function group authorization; determine whether the union satisfies the access function corresponding to the access request; if the union satisfies the access function corresponding to the access request, obtain the user's data authorization; generate SQL query conditions based on the data authorization; obtain the return data for the access request based on the SQL query conditions. The embodiments of this specification can improve the access security and access control flexibility of the low-code platform.

[0075] In some embodiments of the present specification, the client 10 may be a self-service terminal device, a mobile terminal (i.e., a smart phone), a display, a desktop computer, a tablet computer, a laptop computer, a digital assistant, or a smart wearable device, etc. Among them, the smart wearable device may include a smart bracelet, a smart watch, smart glasses, or a smart helmet, etc. Of course, the client 10 is not limited to the above-mentioned electronic devices with a certain entity, and it may also be software running in the above-mentioned electronic devices.

[0076] In some embodiments of the present specification, the server 20 may be an electronic device with computing and network interaction functions; or may be software running in the electronic device and providing business logic for data processing and network interaction.

[0077] In addition, it should be noted that Figure 1What is shown is only an application environment provided by this specification. In actual application, there may be multiple clients 10 and multiple servers 20, and this specification does not impose any limitation.

[0078] This specification embodiment provides an access control method for a low-code platform, which can be applied to the above-mentioned server side, refer to Figure 2 As shown, in some embodiments of this specification, the access control method of the low-code platform may include the following steps:

[0079] Step 201: Intercept the user's access request.

[0080] Step 202: Obtain the union of the user's function authorization and function group authorization.

[0081] Step 203: Determine whether the union satisfies the access function corresponding to the access request. If the union satisfies the access function corresponding to the access request, execute step 203; otherwise, execute step 207.

[0082] Step 204: Obtain data authorization from the user.

[0083] Step 205: Generate SQL query conditions according to the data authorization.

[0084] Step 206: Acquire return data for the access request according to the SQL query condition.

[0085] Step 207: Reject the access request.

[0086] In the embodiments of the present specification, after intercepting the user's access request, the union of the user's function authorization and function group authorization can be obtained. If the union does not satisfy the access function corresponding to the access request, access is denied. If the union satisfies the access function corresponding to the access request, SQL query conditions can be further generated based on the user's data authorization, and then the return data for the access request can be obtained based on the SQL query conditions. In this way, access security and access control flexibility are improved through the combination of function access control and data access control. Moreover, the flexibility of function authorization control can be further improved by introducing the user's function authorization and function group authorization.

[0087] In some embodiments of the present specification, an interface permission interceptor can be pre-configured to intercept user access requests. Among them, user refers to a user of the low-code platform; the user, as the authorization subject, can be a designated natural person, organization, in-application role, business role, etc. Functional authorization refers to access authorization to a single function of the low-code platform (such as menus, pages, buttons, and other components that can trigger interfaces); function group authorization refers to: access authorization to a series of functions of the low-code platform. Function authorization and function group authorization determine the scope of users or user groups that use the corresponding functions. In some embodiments of the present specification, a function group can be a set of customized functions to improve the convenience of function authorization.

[0088] In some embodiments of this specification, obtaining the union of the function authorization and function group authorization of the user may include: obtaining the user attributes of the user (such as user ID, organization, user role, custom attributes, etc.); querying the function authorization and function group authorization of the user from the permission management table according to the user attributes of the user. The permission management table contains not only function authorization and function group authorization, but also data authorization. In an exemplary embodiment of this specification, the permission management table may be as follows: Figure 5 shown.

[0089] exist Figure 5 The permission management table shown includes function permission management and data permission management. Among them, function permission management can include FunctionGrant function authorization information, FunctionGroup function group information, Function function information, etc. Administrators can grant functions or function groups to individual users, users under organizations or roles, and users under third-party system roles, and can also maintain the functions included in the function group, meeting various authorization scenarios. Among them:

[0090] (1) Functional authorization information: In the functional authorization information, the administrator grants permissions to various types of authorized subjects. It can be directly authorized to users or authorized to roles, organizations, and custom extension rules. The authorization content can be functions or function groups.

[0091] (2) Function group management: If multiple functions are often authorized to different authorized entities, these functions can be added to a function group. Function group authorization can make it easier to maintain permissions.

[0092] (3) Function management: Function is the basic unit of authorized content, and a function can correspond to a menu or button.

[0093] Data permission management can include DataGrant data authorization information. Specifically, different data access and operation permissions are assigned to different users through personnel scope management, data operation authorization management, data visibility scope authorization management, and field permission authorization management, ensuring that users can only access the resources and functions they need and preventing access to unauthorized or sensitive data and system resources.

[0094] (1) Personnel scope management: Data administrators can use the personnel search box to select personnel or personnel groups that meet the requirements. The personnel scope can be selected by specifying individuals, organizations, roles within the application, business roles, or everyone.

[0095] (2) Visible scope management

[0096] Data authorization generates filtering conditions by combining {rule fields, operators, and rule values} to control the visible scope of data, where: rule fields represent the fields involved in the rule type, such as the initiator's ID number, initiator's organization, etc. Operators represent the operation logic between the rule field and the selected field, such as equal to, belongs to, etc. Rule values ​​can be customized to select specific values ​​or based on business logic. For example, select the initiator organization field rule and select the "belongs to" operator, and select the login value for the rule value.

[0097] In other embodiments of this specification, third parties may be allowed to customize authorization functions, thereby further improving the scalability and flexibility of system function authorization and data authorization. Among them, when third parties customize authorization functions, they may include:

[0098] (1) Authorization subject ID: The authorization subject ID mainly defines the unique ID of the authorization subject, which is used to distinguish different authorization subjects. For example, the designated person can select users according to the user ID configuration, the personnel in the form are users with the permission of the form, the personnel in the approval flow are the personnel involved in the approval flow, and the personnel in the application are users with the permission of the application.

[0099] (2) Authorization Subject Type: In addition to providing designated persons, personnel in forms, approval flow personnel, and personnel in applications, the authorization subject type also provides a custom extension strategy. By defining the name, option pull interface, personnel acquisition interface, and whether to support multiple selection, it supports the flexible customization of personnel selection strategies by third parties when the selected personnel provided cannot meet specific needs. Among them: the authorization subject type is the name of the authorization subject type, which is used to distinguish different authorization subject types. The option pull interface provides a custom personnel group, such as a certain attribute belonging to a person. Through a third party providing a custom option pull interface that supports special scenarios, the personnel selection strategy for the scenario is supported. The personnel group query interface provides the personnel groups owned by the user. For example, in the role grant extension (RoleGrantExtention), the interface provides all the roles owned by the user. For example, taking the personnel position as an extended authorization method, the getGrantType method returns the string "position" representing the position type authorization; the listItem method returns a list of position options, which is used to select the authorization object for permission management; listItemByUser returns the position corresponding to the user id, which is used to obtain the user's extended attributes when the user is authorized.

[0100] refer to Figure 3 As shown, in some embodiments of this specification, judging whether the union satisfies the access function corresponding to the access request may include the following steps:

[0101] Step 301: Determine whether the user's function authorization or function group authorization includes the current interface. If the user's function authorization includes the current interface, or the user's function group authorization includes the current interface, execute step 302; otherwise, execute step 303.

[0102] Step 302: Confirm that the union satisfies the access function corresponding to the access request.

[0103] When it is confirmed that the union satisfies the access function corresponding to the access request, the current interface will release the access request, and the access request can enter subsequent processing.

[0104] Step 303: confirm that the union does not satisfy the access function corresponding to the access request.

[0105] When it is confirmed that the union does not satisfy the access function corresponding to the access request, the current interface will reject the access request, thereby achieving access control over functional permissions.

[0106] In some embodiments of the present specification, obtaining the data authorization of the user may include: querying the data authorization of the user from the authority management table according to the user attributes of the user; and then using the data authority parser to parse the user data authority into corresponding SQL filter conditions, that is, one or more SQL query conditions may be generated according to the data authorization, specifically, obtaining a triple consisting of the operation field, operator, and operation value attributes of the data authorization, and converting the triple into an SQL query condition. Obviously, the triple {operation field, operator, operation value} here corresponds to the above-mentioned {rule field, operator, rule value}.

[0107] For example, in an exemplary embodiment, the obtained triple is {operateField:'dept',operator:'belong',operatorValue:'001'}, which can be converted into where dept in (sub-organization of organization 001); wherein, the SQL query condition generated by data authorization can be connected by or or and according to specific needs, and thus added to the SQL statement corresponding to the access request.

[0108] refer to Figure 4 As shown, in some embodiments of this specification, obtaining the return data for the access request according to the SQL query condition may include the following steps:

[0109] Step 401 , identifying the data access type corresponding to the access request. If the data access type corresponding to the access request is single data access, then executing step 402 ; if the data access type corresponding to the access request is data list query, then executing step 407 .

[0110] By querying the authority management table, the data access type corresponding to the access request can be confirmed. Data authorization can specifically include data viewing, data addition, data operation record, data modification, data printing, data export, data deletion, etc.

[0111] Step 402: Combine the SQL query condition and the data ID of the single piece of data into a new SQL query condition.

[0112] Step 403: Add the new SQL query condition to the SQL statement corresponding to the access request.

[0113] Step 404: execute the SQL statement and determine whether the returned data is empty. If the returned data is not empty, execute step 405; otherwise, execute step 406.

[0114] Step 405: Confirm that the returned data that meets the new SQL query condition is obtained.

[0115] Step 406: Deny the access request.

[0116] When the returned data is empty, it indicates that there is no returned data that meets the new SQL query condition. In other words, the user corresponding to the access request does not have the authority to access the corresponding data. Therefore, the access request can be rejected.

[0117] Step 407: Add the SQL query condition to the SQL statement corresponding to the access request.

[0118] Step 408: Execute the SQL statement to obtain return data that meets the SQL query condition.

[0119] By generating SQL query conditions according to the user's data authorization and acquiring return data for the access request according to the SQL query conditions, access control of data permissions is achieved.

[0120] Although the process flows described above include multiple operations that occur in a particular order, it should be clearly understood that the processes may include more or fewer operations, which may be performed sequentially or in parallel (eg, using parallel processors or a multi-threaded environment).

[0121] Corresponding to the access control method of the low-code platform described above, the embodiment of this specification also provides an access control device of the low-code platform, which can be configured on the above-mentioned server, referring to Figure 6 As shown, in some embodiments of this specification, the access control device of the low-code platform may include:

[0122] An interception module 61, used to intercept a user's access request;

[0123] A first acquisition module 62, used to acquire the union of the function authorization and the function group authorization of the user;

[0124] A judging module 63, configured to judge whether the union satisfies the access function corresponding to the access request;

[0125] A second acquisition module 64, configured to acquire data authorization of the user if the union satisfies the access function corresponding to the access request;

[0126] A generating module 65, used to generate SQL query conditions according to the data authorization;

[0127] The third acquisition module 66 is used to acquire the return data for the access request according to the SQL query condition.

[0128] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0129] The embodiments of this specification also provide a computer device. Figure 7 As shown, in some embodiments of this specification, the computer device 702 may include one or more processors 704, such as one or more central processing units (CPUs) or graphics processing units (GPUs), and each processing unit may implement one or more hardware threads. The computer device 702 may also include any memory 706, which is used to store any kind of information such as code, settings, data, etc. In a specific embodiment, the computer program on the memory 706 and can be run on the processor 704, when the computer program is run by the processor 704, the instructions of the access control method of the low-code platform described in any of the above embodiments can be executed. Non-limiting, for example, the memory 706 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 702. In one case, when the processor 704 executes an associated instruction stored in any memory or combination of memories, the computer device 702 can perform any operation of the associated instruction. The computer device 702 also includes one or more drive mechanisms 708 for interacting with any storage, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0130] The computer device 702 may also include an input / output interface 710 (I / O) for receiving various inputs (via input device 712) and for providing various outputs (via output device 714). A specific output mechanism may include a presentation device 716 and an associated graphical user interface 718 (GUI). In other embodiments, the input / output interface 710 (I / O), input device 712, and output device 714 may not be included, and the computer device 702 may be used as a computer device in a network. The computer device 702 may also include one or more network interfaces 720 for exchanging data with other devices via one or more communication links 722. One or more communication buses 724 couple the components described above together.

[0131] The communication link 722 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 722 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0132] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), computer-readable storage media, and computer program products of some embodiments of the present specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processor to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processor generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0133] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processor to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0134] These computer program instructions can also be loaded onto a computer or other programmable data processor so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0135] In a typical configuration, a computer device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0136] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0137] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computer device. As defined in this specification, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0138] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, the embodiments of this specification may take the form of complete hardware embodiments, complete software embodiments or embodiments combining software and hardware. Moreover, the embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0139] The present specification embodiments may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present specification embodiments may also be practiced in distributed computing environments where tasks are performed by remote processors connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0140] It should also be understood that in the embodiments of this specification, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0141] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0142] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiments of this specification. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0143] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for access control of a low-code platform, characterized in that: include: Intercept user access requests; Obtaining the union of the user's function authorization and function group authorization; Determining whether the union satisfies the access function corresponding to the access request; If the union satisfies the access function corresponding to the access request, obtaining data authorization of the user; Generate SQL query conditions according to the data authorization; The returned data for the access request is obtained according to the SQL query condition.

2. The access control method for a low-code platform according to claim 1, characterized in that: Determining whether the union satisfies the access function corresponding to the access request includes: Determine whether the user's function authorization or function group authorization includes the current interface; If the function authorization of the user includes the current interface, or the function group authorization of the user includes the current interface, confirming that the union satisfies the access function corresponding to the access request; If the function authorization of the user does not include the current interface, and the function group authorization of the user does not include the current interface, it is confirmed that the union does not satisfy the access function corresponding to the access request.

3. The access control method for a low-code platform according to claim 1, characterized in that: After determining whether the union satisfies the access function corresponding to the access request, the method further includes: If the union does not satisfy the access function corresponding to the access request, the access request is rejected.

4. The access control method for a low-code platform according to claim 1, characterized in that: Generate SQL query conditions based on the data authorization, including: Obtain a triple consisting of an operation field, an operator, and an operation value attribute of the data authorization; The triples are converted into SQL query conditions.

5. The access control method for a low-code platform as claimed in claim 4, characterized in that: Acquiring return data for the access request according to the SQL query condition, including: Identifying a data access type corresponding to the access request; If the data access type corresponding to the access request is a data list query, adding the SQL query condition to the SQL statement corresponding to the access request; Execute the SQL statement to obtain return data that meets the SQL query condition.

6. The access control method for a low-code platform as claimed in claim 5, characterized in that: After identifying the data access type corresponding to the access request, the method further includes: If the data access type corresponding to the access request is single data access, combining the SQL query condition with the data ID of the single data into a new SQL query condition; Adding the new SQL query condition to the SQL statement corresponding to the access request; Execute the SQL statement and determine whether the returned data is empty; If the returned data is not empty, confirm that the returned data that meets the new SQL query condition is obtained; If the returned data is empty, the access request is rejected.

7. An access control device for a low-code platform, characterized in that: include: An interception module is used to intercept user access requests; A first acquisition module, used to acquire the union of the function authorization and the function group authorization of the user; A judging module, used to judge whether the union satisfies the access function corresponding to the access request; A second acquisition module, configured to acquire data authorization of the user if the union satisfies the access function corresponding to the access request; A generation module, used to generate SQL query conditions according to the data authorization; The third acquisition module is used to acquire the return data for the access request according to the SQL query condition.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that: When the computer program is executed by the processor, the computer program executes the instructions of the method according to any one of claims 1 to 6.

9. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor of a computer device, the computer program executes instructions of the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor of a computer device, the computer program executes instructions of the method according to any one of claims 1 to 6.

Images