Fine-grained account permission control method, device and equipment based on access channel

Abstract

The invention relates to the related technical field of permission control, in particular to a fine-grained account permission control method, device and equipment based on an access channel. The method comprises the following steps: registering a data service interface in an application; the application loads the data service interface, and the data service interface loads an original data access interface when being started; after the data service interface receives a data service request sent by an application, a user sending the data service request is obtained, the received data service request is analyzed, and a target data object to be accessed and a target operation type to be requested are obtained; querying a permission list of the user for the target data object through a permission service function in a data service interface, and checking whether the target operation type is authorized or not according to the permission list; and if so, responding to the data service request.

Description

Technical Field

[0001] The present application relates to the technical field related to permission management, and specifically to a method, device and equipment for fine-grained account permission management based on access channels. Background Art

[0002] In today's digital information management field, permission control is crucial to ensure data security and compliance. With the rapid development of information technology, the business systems within enterprises and organizations are becoming increasingly complex and diverse, and the management and access control of data resources are facing many challenges.

[0003] Existing permission management technologies have met some of the needs to a certain extent, but there are still obvious limitations. Most existing technologies tend to only focus on the management of permission data and the provision of permission policy data when implementing unified permission management, but lack effective means to actually implement these policies. For example, the traditional database permission management method is usually to allocate database accounts and authorize the accounts. However, this method can only achieve coarse-grained authorization at the database level, such as authorization of database tables, etc., and it is difficult to achieve detailed and accurate permission control for specific user accounts in the business system. The data operations involved in the business system often require more fine-grained permission management to meet different business scenarios and security requirements, but the existing technology does not provide sufficient support in this regard. Summary of the invention

[0004] In view of this, the embodiments of the present application are committed to providing a method, apparatus and device for fine-grained account permission management based on access channels.

[0005] This application provides a fine-grained account permission management method based on access channels, including:

[0006] Registering a data service interface in an application; the application loading the data service interface, and the data service interface loading the original data access interface when starting;

[0007] After receiving the data service request from the application, the data service interface obtains the user who issued the data service request, analyzes the received data service request, and obtains the target data object to be accessed and the target operation type to be requested;

[0008] Through the permission service function in the data service interface, query the user's permission list for the target data object, and check whether the target operation type is authorized according to the permission list;

[0009] If authorized, respond to the data service request.

[0010] In some embodiments, it also includes:

[0011] Record relevant information about operations running in the data service interface.

[0012] In some embodiments, it also includes:

[0013] Based on preset audit rules, audit the relevant information of the operations running in the data service interface;

[0014] If there is any non-compliant related information, a violation report will be generated and an alarm will be issued.

[0015] In some embodiments, it also includes:

[0016] Configure the permission service function.

[0017] In some embodiments, the configuration authority service function includes:

[0018] Import or create accessible users;

[0019] Manage different users' data operation permissions and viewable data levels.

[0020] In some embodiments, it also includes:

[0021] Perform hierarchical management of data within the database.

[0022] In some embodiments, it also includes:

[0023] Scan the data in the database to determine the data structure and data category of the data in the database.

[0024] In some embodiments, it also includes:

[0025] Identify sensitive data in the database and provide different management and control strategies for the sensitive data.

[0026] The present application provides a fine-grained account authority management and control device based on access channels, including:

[0027] A registration module, used to register a data service interface in an application; the application loads the data service interface, and the data service interface loads the original data access interface when it is started;

[0028] An acquisition module is used to acquire the user who issued the data service request after the data service interface receives the data service request issued by the application, analyze the received data service request, and acquire the target data object to be accessed and the target operation type to be requested;

[0029] A checking module, used to query the user's permission list for the target data object through the permission service function in the data service interface, and check whether the target operation type is authorized according to the permission list;

[0030] The response module is used to respond to the data service request if authorized.

[0031] The present application provides an electronic device, including:

[0032] A processor, and a memory for storing a program executable by the processor;

[0033] The processor is used to implement the above-mentioned fine-grained account authority management method based on access channels by running the program in the memory.

[0034] The present application provides a fine-grained account permission control method based on access channel, first registering a data service interface in an application; the application loads the data service interface, and the data service interface loads the original data access interface at startup; after receiving the data service request issued by the application, the data service interface obtains the user who issued the data service request, analyzes the received data service request, and obtains the target data object to be accessed and the target operation type to be requested; through the permission service function in the data service interface, the user's permission list for the target data object is queried, and the target operation type is checked according to the permission list. If authorized, the data service request is responded. In this way, the data access interface provided by the system is consistent with the original data access interface, which means that the existing business application can directly connect to the data service interface without any modification or adjustment to the application itself. Since there is no need to modify the application code, the deployment of the new system can be faster and more convenient, reducing the cost of upgrading and maintenance. By analyzing the data service request, the system can accurately identify the data object and operation type requested by the user to access, thereby realizing fine-grained control of data access. Fine-grained permission management can reduce the risk of unauthorized access, improve data security, and ensure that only authorized users can perform specific data operations. By registering and loading data service interfaces in applications, fine-grained control and real-time permission verification of data access requests are achieved, thereby improving data security, system efficiency and compliance, while reducing the cost of application transformation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0036] Figure 1It is a flowchart of a fine-grained account permission management method based on access channels provided by an embodiment of the present application.

[0037] Figure 2 It is a partial flow chart of a method provided by an embodiment of the present application.

[0038] Figure 3 It is a partial flow chart of a method provided in another embodiment of the present application.

[0039] Figure 4 It is a partial flow chart of a method provided in another embodiment of the present application.

[0040] Figure 5 It is a partial flow chart of a method provided in another embodiment of the present application.

[0041] Figure 6 It is a partial flow chart of a method provided in another embodiment of the present application.

[0042] Figure 7 It is a structural diagram of a fine-grained account authority management device based on access channels provided by an embodiment of the present application.

[0043] Figure 8 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] Application Overview

[0046] Existing permission management technologies have met some of the needs to a certain extent, but there are still obvious limitations. Most existing technologies tend to only focus on the management of permission data and the provision of permission policy data when implementing unified permission management, but lack effective means to actually implement these policies. For example, the traditional database permission management method is usually to allocate database accounts and authorize the accounts. However, this method can only achieve coarse-grained authorization at the database level, such as authorization of database tables, etc., and it is difficult to achieve detailed and accurate permission control for specific user accounts in the business system. The data operations involved in the business system often require more fine-grained permission management to meet different business scenarios and security requirements, but the existing technology does not provide sufficient support in this regard.

[0047] In order to solve the above problems, the present application provides a solution, which embeds a management and control module in the data access interface layer of the application, directly independent of the application, so that access to data can be controlled without modifying the application, and at the same time provides detailed analysis of the request and fine-grained management and control.

[0048] After introducing the basic principles of the present application, various non-limiting embodiments of the present application will be described in detail with reference to the accompanying drawings.

[0049] Exemplary Methods

[0050] Figure 1 1 is a flow chart of a method for fine-grained account permission management based on access channels provided by an embodiment of the present application. Figure 1 As shown, the method includes the following contents.

[0051] Step S110, registering a data service interface in an application; the application loads the data service interface, and the data service interface loads an original data access interface when it is started;

[0052] Specifically, registering an interface: This step involves registering a new data service interface in the business application. This interface is a new channel for communication between the business system and the data source (such as a database).

[0053] Loading interface: When the application starts, it will load the newly registered data service interface. This interface is designed to be compatible with the original data access interface to ensure seamless integration.

[0054] Load the original interface: When the new data service interface is started, it will load the original data access interface. The purpose of this is to be able to communicate with the original data source through the new interface proxy.

[0055] Step S120, after receiving the data service request sent by the application, the data service interface obtains the user who sent the data service request, analyzes the received data service request, and obtains the target data object to be accessed and the target operation type to be requested;

[0056] Specifically, the data service interface receives data service requests from business applications. The interface first needs to determine which user initiated the request. This is usually achieved by checking the context of the request, such as session information or security tokens. The request is analyzed to determine the data object the user wants to access (such as a table or field in a database) and the type of operation they want to perform (such as read, write, delete, etc.).

[0057] Step S130, querying the user's permission list for the target data object through the permission service function in the data service interface, and checking whether the target operation type is authorized according to the permission list;

[0058] In this step, the permission service function in the data service interface is used to query the permission list of a specific user for a specific data object. This list defines what operations the user can perform on the data. Based on the query permission list, the system checks whether the operation requested by the user is authorized. This is done by comparing the operation requested by the user with the entries in the permission list.

[0059] Step S140: respond to the data service request if authorized.

[0060] Specifically, if the operation requested by the user is authorized in the permission list, the system will respond to the data service request. This means that the system will allow the user to perform the requested operation, such as querying the database or updating a record. The system will forward the request to the data source through the original data access interface and perform the actual data operation. In some cases, the system will also record the detailed information of the operation for subsequent auditing and monitoring.

[0061] These steps together constitute a fine-grained permission management process, which allows the system to achieve precise control over data access without modifying existing business applications. In this way, data security can be improved to ensure that only authorized users can access or operate sensitive data, while also simplifying the complexity of permission management.

[0062] In some embodiments, it also includes: recording relevant information of operations running in the data service interface.

[0063] Specifically, by recording the relevant information of the running operations in the data service interface, it is possible to clearly identify the initiator of each data operation, the operation time, the operation location (reflected by the IP address), and the data content and type of the operation. This provides a detailed basis for subsequent possible problem troubleshooting and data tracking, so that any data operation can be traced, which helps to accurately find the source of the operation in a complex business environment, making it easier to trace normal business processes or investigate abnormal situations.

[0064] In some embodiments, it also includes: based on preset audit rules, auditing the relevant information of the operations running in the data service interface; if there is non-compliant relevant information, generating a violation report and issuing an alarm.

[0065] Specifically, according to the preset permission rules, check whether the user has the corresponding permissions when performing the operation. For example, obtain the user's operation permission list for a specific data object from the permission service, and check whether the actual operation (such as data reading, writing, modifying, deleting, etc.) is within the scope of the permission during the audit. If the user is authorized to only read the data in a database table, but the operation record shows that he tried to modify the table, this violates the permission rules.

[0066] Check whether the data content involved in the operation is compliant according to industry standards and internal corporate data policies. For example, for data operations involving personal sensitive information (such as ID card number, bank card number, etc.), audit rules may require encryption or specific data desensitization rules. If sensitive data is found not to be processed according to regulations during the operation, it will be judged as non-compliant.

[0067] Set frequency limits for specific operations within a certain period of time to prevent abnormally frequent operations from causing data risks. For example, if a query operation on key data exceeds the preset query limit (such as 100 times) within a short period of time (such as within one minute), it may be regarded as an abnormal operation and trigger an audit. This helps prevent malicious attacks or data abuse, such as trying to obtain sensitive information through a large number of queries or stress testing the system.

[0068] In some business scenarios, there are specific requirements for the time of data operation. For example, the company stipulates that it is prohibited to modify core business data during non-working hours (such as 10 pm to 6 am). During the audit process, it will be checked whether the operation time complies with such time limit rules. If an illegal operation occurs during the prohibited time period, it will be recorded as a non-compliant operation.

[0069] When non-compliant operation-related information is detected, the generated violation report will record the violation in detail, including the time when the violation occurred, the user account involved, the data object of the operation (such as database table name, file name, etc.), the specific violation operation type (such as permission overstepping, data violation processing, abnormal operation frequency, etc.) and related data operation context information (such as SQL statements or other operation instructions involved in the operation), providing comprehensive data support for subsequent problem investigation and responsibility tracing.

[0070] The alarm mechanism uses a variety of methods to ensure that relevant personnel are aware of violations in a timely manner. Common alarm methods include sending emails to system administrators or relevant security managers, which contain summary information and detailed links of violation reports; pushing instant message notifications in the company's internal management system, such as pop-up eye-catching alarm pop-ups; for serious violations, SMS notifications may also be sent to the mobile phones of relevant personnel. The recipients of the alarm are usually the persons in charge of data security management, system operation and maintenance, and related business departments. They can quickly take measures based on the alarm information, such as suspending the accounts of violating users, initiating security incident investigation processes, and assessing data leakage risks, so as to reduce the potential losses caused by illegal operations.

[0071] After receiving the alert, the relevant personnel will start the violation investigation process based on the information in the violation report. First, verify the authenticity and scope of the violation operation to determine whether there are risks such as data leakage and system damage. Then, take appropriate measures based on the investigation results. For minor violations, the relevant users may be warned and required to correct the operation immediately; for serious violations, such as malicious data theft or destruction, legal means may be taken to investigate the responsibility, and the system will be fully reinforced and data recovery operations will be performed to ensure data security and business continuity.

[0072] In some embodiments, it also includes: configuring the permission service function. The configuration permission service function includes: importing or creating accessible users; managing different users' operation permissions on data and the data levels that can be viewed. In some embodiments, it also includes: performing level management on the data in the database.

[0073] When configuring the permission service function, an enterprise or organization must first import existing user information into the permission management system, or create new accessible users based on business needs. This user information may include basic information such as user name, user ID, department, position, etc., which will be integrated into the permission management system through a unified format and interface to lay the foundation for subsequent permission allocation and management. For example, a company imports user information from its employees' human resources system into the permission service system in batches to ensure that each employee is within the scope of permission management, facilitating precise control of employees' data access in the business system.

[0074] With the development of corporate business and personnel changes, there are often new employees joining, employees adjusting their positions or leaving. The new user creation function can promptly open system access rights for new employees to ensure that they can carry out their work normally; for employee position changes, their permissions can be adjusted according to the responsibilities of the new position; and for resigned employees, their accounts can be deleted or disabled in a timely manner to prevent the resigned personnel from continuing to access corporate data and bring security risks. For example, if an employee is transferred from the marketing department to the R&D department, the permission management system can quickly adjust the employee's data access rights based on the pre-set position permission template, so that the employee can only access R&D-related data resources and no longer has data access rights to the marketing department.

[0075] Different operation permissions are assigned to users according to their roles and responsibilities in the enterprise. For example, ordinary employees may only have read permissions to some business data so that they can carry out their daily work; while data administrators have higher-level permissions such as read, write, modify, and delete data for data maintenance and management. Permission management can be refined to specific data objects and operation types. For example, for a specific field in a database table, some users can only read, while other users can modify it. This fine-grained permission management can effectively ensure the security and integrity of data and prevent unauthorized operations from causing damage or leakage to data.

[0076] The data in the database is divided into different levels, such as public data, internal sensitive data, confidential data, etc., and corresponding access rights are set for data of different levels. For example, public data can be viewed by all employees, internal sensitive data (such as company financial statements, customer contact information, etc.) can only be viewed and processed by specific personnel in relevant departments, and confidential data (such as corporate strategic planning, core technical information, etc.) is only open to senior management. By matching user permissions with data levels, it is ensured that users can only access data within the scope of their authorized data levels, realizing hierarchical management and access control of data, and meeting the diverse needs of enterprises in data security and business operations.

[0077] Enterprises formulate detailed data classification and grading standards based on their own business characteristics and data importance. Classification can be based on factors such as the business field of the data (such as sales data, financial data, human resources data, etc.), data type (such as structured data, unstructured data), etc.; grading is based on the sensitivity of the data, the impact of leakage, etc., such as categorizing data into ordinary, sensitive, confidential, top secret, etc. For example, a financial institution may classify customer transaction records, account balances and other data as confidential, and general marketing materials as ordinary, so as to adopt different security protection measures and management strategies for different levels of data.

[0078] Each data record in the database is marked according to its classification and level. This marking information is stored in the metadata of the database or in a separate permission management database, which is used to quickly identify the level of data during data access in order to verify permissions. At the same time, in terms of data storage and management, different storage methods and security measures are adopted according to different data levels. For example, confidential data may be stored in an encrypted storage area, which requires additional identity authentication and authorization when accessed, while ordinary data is stored in an ordinary storage area, improving the balance between the efficiency and security of data storage and management.

[0079] As the business of an enterprise develops and the external environment changes, the importance and sensitivity of data may change, so it is necessary to establish a dynamic adjustment mechanism for data levels. Regularly re-evaluate the data and adjust the data level and corresponding access rights based on the evaluation results. At the same time, monitor the changes in data levels and data access, and record all data level adjustment operations and data access logs so that they can be traced and audited in time when problems arise, ensuring the effectiveness and compliance of data level management and ensuring the security and rational use of enterprise data assets.

[0080] Scan the data in the database to determine the data structure and data category of the data in the database.

[0081] Understanding the data structure (such as field name, type, length, etc.) and data category (such as text, value, date, etc.) of the data in the database helps enterprises manage data more efficiently. For example, by identifying the data structure, database administrators can optimize data storage methods and improve data query and processing efficiency. For data categories, enterprises can formulate targeted processing strategies based on different categories, such as statistical analysis of numerical data and text mining of text data, so as to better utilize data resources.

[0082] The scanning implementation process includes: first, you need to establish a connection with the user database or big data system to obtain basic information such as the catalog, schema, and table of the data, which is the entry point for scanning data. With this information, the system can locate the location of the data to be scanned and prepare for subsequent detailed scanning. For example, for a relational database, after a successful connection, you can obtain the names and structure information of all tables, views and other objects contained in the database. This information will guide the subsequent scanning operation of each specific data object. According to the obtained catalog, schema, and table information, the data structure scanning task is assigned to the task engine. The task engine will start multiple scanning threads or processes to scan the data tables of each table in parallel to obtain detailed information for each field, including field name, type (such as integer, character, date, etc.), length (the maximum data length that the field can store), and remarks (explanation of the meaning or purpose of the field). This parallel processing method can greatly improve the scanning efficiency, especially for large databases, and can significantly shorten the scanning time. For example, in a database containing multiple large data tables, the task engine may assign the scanning task of each table to different threads, scan multiple tables at the same time, and quickly obtain the field structure information of all tables. Similarly, based on catalog, schema, and table information, data category scanning tasks are assigned to the task engine. After obtaining a certain amount of data from each field in the table, the task engine determines the data type according to the preset recognition rules. These recognition rules can be based on factors such as the format, value range, and statistical characteristics of the data. For example, data that conforms to the date format (such as YYYY-MM-DD) is identified as a date type; data that has a value within a certain range and conforms to the numerical characteristics is identified as a numerical type. By analyzing part of the data, the data category of the entire field can be inferred, providing basic information for subsequent data management and processing. For example, when performing data analysis, appropriate analysis methods and tools can be selected according to the data category.

[0083] Furthermore, the data structure and category information obtained by scanning provide an important basis for the policy management module. Based on this information, managers can more accurately confirm the data structure and data type found in data discovery, confirm the identified data categories, and configure corresponding access policies for different data structures and categories. For example, for data tables that store user privacy information (determined to contain sensitive information through data category scanning), more stringent access rights can be configured to restrict access to users with specific roles, and detailed audit records of access operations can be made to ensure data security. This helps to further improve the data discovery process and gain a more comprehensive understanding of the distribution and characteristics of data resources in the database. Enterprises can discover potential problems in the data based on the scanning results, such as data redundancy, inconsistent data formats, etc., and take corresponding measures to optimize them. At the same time, in data management operations such as data backup and migration, accurate data structure and category information can ensure the accuracy and integrity of operations, avoid management errors caused by unclear data, and improve the overall level of enterprise data management and data quality.

[0084] In some embodiments, it also includes: identifying sensitive data in the database and providing different management and control strategies for the sensitive data.

[0085] The data in the database is scanned comprehensively. During the scanning process, various features of the data are extracted, such as data format, value range, text pattern, etc. For example, for the ID card number, it has a specific 18-digit format and contains the date of birth and check digit information; the bank card number usually has a certain number of digits and a specific starting number of the issuing bank's logo. By identifying these features, the fields and records that may contain sensitive data can be preliminarily screened out. According to the pre-set identification rules and algorithms, the extracted features are analyzed and judged. These rules and algorithms can be formulated based on industry standards, legal and regulatory requirements, and internal corporate security policies. For example, according to financial industry specifications, any field containing information such as bank card numbers and credit card CVV codes is considered sensitive data; in the medical industry, patients' medical records, ID numbers, diagnosis results, etc. are all sensitive information. In terms of algorithms, pattern matching algorithms, regular expressions, and other technologies can be used to identify sensitive data. For example, if a regular expression is used to match the format of the ID card number, if the data in a field meets the regular expression pattern of the ID card number, it will be identified as sensitive data.

[0086] For the identified sensitive data, set strict access rights. Only authorized specific users or user roles can access this data, and the access method may be restricted. For example, ordinary employees may not be able to access sensitive information such as customer ID numbers. Only customer service personnel or managers who have undergone security background checks and special authorization can view it in specific business scenarios (such as customer identity verification, compliance audits, etc.), and additional identity verification steps may be required when viewing, such as entering dynamic verification codes, fingerprint recognition, etc.

[0087] In some cases, sensitive data that needs to be provided externally or used in non-sensitive environments can be desensitized. Through data desensitization technology, some key information in sensitive data is blurred or replaced to generate a desensitized data set, which can not only meet business needs (such as data analysis, testing, etc.), but also protect the security of the original sensitive data. For example, when performing data analysis, the date of birth part of the customer's ID number is replaced with a specific symbol, and some key information is retained for statistical analysis, while avoiding the risk of sensitive information leakage.

[0088] In combination with the above preferred embodiments, Figure 2-Figure 6 Further explanation of the solution provided in this application:

[0089] The solution provided in this application mainly consists of several core components: data access interface, interface proxy, data operation audit, fine-grained data permissions, policy management, and data discovery.

[0090] Data access interface: the data access interface used by the business system when using data, such as accessing the database through the JDBC interface. The present invention provides services by providing a business data access interface that is consistent with the original business system.

[0091] Interface proxy: The main part of the present invention is to establish a data access interface proxy object and replace the original interface, obtain the data object that the user is about to operate in real time during data access, obtain the management information through the permission service, verify the user's authority to the data, and dynamically modify the user's request information and returned data.

[0092] Data operation audit: that is, record the user of each data operation, the time of the operation, and what operations were performed on which data. This paper provides some industry audit standards for compliance checks.

[0093] Data discovery: By scanning business data, we can obtain the metadata of business data (including structure, type, length, etc.), as well as some actual data. Through data identification, we can find sensitive data types that comply with certain industry specifications and provide them to managers to assist in the configuration of management and control strategies.

[0094] Fine-grained permission policy: unified data permission information storage and policy data access service independent of third parties of applications.

[0095] Rough management: Manually confirm the data provided in data discovery and configure policies for corresponding personnel roles. Manage the data operation permissions of each role.

[0096] The present invention implements the data access interface used by the original business application, and implements the same external interface to replace the original data access interface in the application. For example, if the original application uses the JDBC interface to access data, a JDBC interface implementation can be implemented to replace the JDBC driver used in the original application, and the new proxy driver implementation can be connected to the original driver, that is, an intermediate layer is added to realize data connection and authority management.

[0097] Specific. Figure 3 , the data interface implementation process includes:

[0098] Register a new data service interface in the application. For example, in a Java application, place a new data access service interface such as a JDBC driver in the application's load library list.

[0099] Use the new database driver name in the application, and the application automatically loads the new data service interface when loading.

[0100] The new service interface loads the original data access interface at startup.

[0101] Reference Figure 4 , the data access request processing flow includes:

[0102] The new data service interface receives the data service request sent by the application.

[0103] First, get the user of this request, obtain the user name through the added service request filter object and add it to the request parameters.

[0104] Analyze the received data request to obtain the data object to be accessed and the type of operation to be requested.

[0105] Query the user's permission list for this data through the permission service interface

[0106] The user's operation permission list for this data is checked to see whether the user's current operation is authorized. If authorized, the operation is allowed to be executed; if not, the operation is prohibited.

[0107] Access the processed request through the original data interface.

[0108] The relevant information of this operation is recorded in the audit log storage, including time, location (IP), person (user name), operation data, operation type, and operation result.

[0109] Among them, "Getting the current user" specifically includes:

[0110] Add a new filter module using the application's Filter configuration.

[0111] When requesting data, when processing the front-end request, the user name of the application is obtained through the session object and Cookie object.

[0112] Add a data item to the request and set the data item to the user name.

[0113] The "Request Analysis" process includes:

[0114] Parse the request, such as parsing a SQL statement.

[0115] Analyze the data to be accessed, such as the name of the table to be read.

[0116] Obtain operation requests for data, such as reading, and implement standardization of various read operations, such as reading, adding, modifying, deleting, renaming, modifying structure, etc., to provide fine-grained management and control.

[0117] Arrange into a list of operations and corresponding data, such as read table A, read table B.

[0118] The process of "Access Rights Service Obtaining User's Access Rights to Data" specifically includes:

[0119] Arrange the user name X obtained in the previous step.

[0120] Arrange the list of objects analyzed previously, for example: Table A, Table B.

[0121] Access the data permission service and request {user is X, permission A of object table, permission B of object table}.

[0122] Get the permission list, request {user is X, object table A permission: readable, insertable, deleteable, modifiable. Object table B permission: readable}.

[0123] The process of "verifying user permissions" includes:

[0124] For the requested object and operation, verify that they are included in the obtained permission list.

[0125] If all are included, the original request is sent through the original service interface.

[0126] If some permissions are not available, no request is made and an exception message is directly returned to the application, telling the application that it does not have data access permissions.

[0127] In summary, in the solution provided by this application, the operating user of the application is obtained through the Filter object, the operating permissions are uniformly managed through the permission service, and the data service is provided using the interface proxy method.

[0128] The data operation audit processing steps are as follows:

[0129] Organize audit records: obtain the operating user, operation time, IP address of the operating user's terminal, data type of operation, data number, and SQL statement type of operation.

[0130] Put audit records into message queues and use asynchronous mode for performance reasons.

[0131] The data storage thread saves audit messages to the log storage separately.

[0132] The audit service combines audit logs with compliance policies, audits each operation log, generates violation reports for illegal operations, and issues alerts.

[0133] Furthermore, data discovery is the process of scanning and identifying data sources that have been pre-managed. It mainly achieves the acquisition and identification of data structures and data categories. Figure 5 , the processing steps are as follows:

[0134] Connect to the user's data storage, such as a database or big data system, and obtain the catalog / schema / table of the data.

[0135] Assign a certain number of structure scanning tasks to the task engine based on catalog / schema / table

[0136] The task engine scans and obtains the field name, type, length, and remarks of each table.

[0137] Assign a certain number of data recognition tasks to the task engine based on catalog / schema / table

[0138] The task engine scans to obtain a certain amount of data from each field in the table and identifies the data type according to the identification rules.

[0139] Furthermore, the solution provided by the present application also includes: formulating fine-grained data strategies, and the storage device for managing and controlling the strategies can use a database system or a big data system.

[0140] Specifically, policy management is a system management module that provides confirmation of the data structure and data type found by data discovery, confirmation of the identified data category, and configuration of corresponding access policies for access users.

[0141] Reference Figure 6 , policy management includes:

[0142] Import or create access users and user roles.

[0143] Manage the role's permissions for operating data and the level of data that can be viewed.

[0144] Confirm the data structure in data discovery and confirm the data to be included in management.

[0145] Confirm the data category and security level in data identification.

[0146] In summary, in the solution provided by this application, the data access interface provided is consistent with the original data access interface, so that applications can be directly connected without modifying the application. The access rights of data are uniformly externalized to the application, and centralized management is used to implement fine-grained account permission control based on access channels.

[0147] Exemplary Devices

[0148] The device embodiments of the present application can be used to execute the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

[0149] Figure 7 FIG. 1 is a block diagram of a fine-grained account permission control device based on access channels provided by an embodiment of the present application. Figure 7 As shown, the device comprises:

[0150] A registration module 71 is used to register a data service interface in an application; the application loads the data service interface, and the data service interface loads the original data access interface when it is started;

[0151] An acquisition module 72 is used for acquiring the user who issued the data service request after the data service interface receives the data service request issued by the application, analyzing the received data service request, and acquiring the target data object to be accessed and the target operation type to be requested;

[0152] A checking module 73, configured to query the user's permission list for the target data object through the permission service function in the data service interface, and check whether the target operation type is authorized according to the permission list;

[0153] The response module 74 is used to respond to the data service request if authorized.

[0154] Exemplary Electronic Devices

[0155] Below, reference Figure 8 To describe an electronic device according to an embodiment of the present application. Figure 8 A block diagram of an electronic device according to an embodiment of the present application is illustrated.

[0156] like Figure 8 As shown, electronic device 800 includes one or more processors 810 and memory 820 .

[0157] The processor 810 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 800 to perform desired functions.

[0158] The memory 820 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 810 may run the program instructions to implement the access channel-based fine-grained account authority management method and / or other desired functions of the various embodiments of the present application described above. Various contents such as category correspondences may also be stored in the computer-readable storage medium.

[0159] In one example, the electronic device 800 may further include: an input device 830 and an output device 840 , and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0160] In addition, the input device 830 may also include, for example, a keyboard, a mouse, an interface, etc. The output device 840 may output various information to the outside, including analysis results, etc. The output device 840 may include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, etc.

[0161] Of course, to simplify, Figure 8 Only some of the components in the electronic device related to the present application are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, the electronic device may further include any other appropriate components according to specific application conditions.

[0162] Exemplary computer program products and computer-readable storage media

[0163] In addition to the above-mentioned methods and devices, an embodiment of the present application may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the access channel-based fine-grained account authority management method according to various embodiments of the present application described in the above "Exemplary Method" section of this specification.

[0164] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0165] In addition, an embodiment of the present application may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the steps of the fine-grained account authority management method based on access channels according to various embodiments of the present application described in the above "Exemplary Method" section of this specification.

[0166] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0167] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present application to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A fine-grained account authority management method based on access channels, characterized in that: include: Registering a data service interface in an application; the application loading the data service interface, and the data service interface loading the original data access interface when starting; After receiving the data service request from the application, the data service interface obtains the user who issued the data service request, analyzes the received data service request, and obtains the target data object to be accessed and the target operation type to be requested; Through the permission service function in the data service interface, query the user's permission list for the target data object, and check whether the target operation type is authorized according to the permission list; If authorized, respond to the data service request.

2. According to the access channel-based fine-grained account authority management method of claim 1, it is characterized in that: Also includes: Record relevant information about operations running in the data service interface.

3. According to the access channel-based fine-grained account authority management method of claim 1, it is characterized in that: Also includes: Based on preset audit rules, audit the relevant information of the operations running in the data service interface; If there is any non-compliant related information, a violation report will be generated and an alarm will be issued.

4. According to the access channel-based fine-grained account authority management method of claim 1, it is characterized in that: Also includes: Configure the permission service function.

5. According to the access channel-based fine-grained account authority management method of claim 4, it is characterized in that: The configuration authority service function includes: Import or create accessible users; Manage different users' data operation permissions and viewable data levels.

6. The method for fine-grained account authority management based on access channels according to claim 5 is characterized in that: Also includes: Perform hierarchical management of data within the database.

7. The method for fine-grained account authority management based on access channels according to claim 5 is characterized in that: Also includes: Scan the data in the database to determine the data structure and data category of the data in the database.

8. The method for fine-grained account authority management based on access channels according to claim 1 is characterized in that: Also includes: Identify sensitive data in the database and provide different management and control strategies for the sensitive data.

9. A fine-grained account authority management and control device based on access channels, characterized in that: include: Registration module, used to register data service interface in the application; The application loads the data service interface, and the data service interface loads the original data access interface when starting; An acquisition module is used to acquire the user who issued the data service request after the data service interface receives the data service request issued by the application, analyze the received data service request, and acquire the target data object to be accessed and the target operation type to be requested; A checking module, used to query the user's permission list for the target data object through the permission service function in the data service interface, and check whether the target operation type is authorized according to the permission list; The response module is used to respond to the data service request if authorized.

10. An electronic device, characterized in that: include: A processor, and a memory for storing a program executable by the processor; The processor is used to implement the access channel-based fine-grained account authority management method as described in any one of claims 1 to 8 by running the program in the memory.

Images