Data isolation access method and device, equipment and medium

Abstract

The invention relates to the technical field of data analysis, can be applied to business system platforms of financial science and technology, medical health and the like, and discloses a data isolation access method, device, equipment and medium, the method comprises the following steps: obtaining an access request of a target request end, carrying out double-field authentication on the target request end to obtain a request end identity, generating a data source distinguishing value of the access request according to the identity of the request end, obtaining to-be-processed text data of the access request, generating an accessible range of the to-be-processed text data according to the data source distinguishing value, and performing access module screening on the to-be-processed text data according to the accessible range to obtain an accessible module, and if the identity of the request end is the preset sub-end, sharing the to-be-processed text data to a preset mother end by using the accessible module to obtain shared text data, and if the identity of the request end is the preset mother end, sending the to-be-processed text data to the accessible module to obtain the shared text data. According to the invention, the sub-terminal can effectively perform data interaction with the mother terminal.

Description

Technical Field

[0001] The present invention relates to the field of data analysis technology, and in particular to a data isolation access method, device, equipment and medium. Background Art

[0002] In traditional multi-terminal architecture designs, the system is divided into three terminals: the WeChat mini-program terminal (child terminal), the app and H5 terminal (parent terminal), and the backend system. WeChat mini-programs are one of the most commonly used mobile applications today, as they require no downloads, are lightweight, and are easy to use. The app and H5 terminals are responsible for most functions, especially the submission and viewing of daily summaries. The backend system is primarily responsible for data storage and processing, ensuring data synchronization and management across all terminals. However, in existing multi-terminal architectures, child terminals cannot interact with the parent terminal, resulting in an inability to fully utilize the commonly used child terminal platform, leading to inefficiencies and poor user experience.

[0003] In the healthcare sector, medical professionals often need to summarize and record daily patient information, such as treatment progress, changes in condition, and medication use. Medical professionals often need to quickly record patient information. Existing system designs require switching applications to submit summaries, which not only wastes time but can also lead to delayed or missed records. During treatment, if medical staff need to switch applications to record summaries, some information may not be recorded in a timely manner, affecting patient treatment tracking and subsequent decision-making.

[0004] In the fintech sector, users are required to submit regular summary reports to clients, documenting their investment portfolios, insurance needs, loan progress, and other relevant information. Financial advisors and agents often need to frequently update client information and submit summaries. Submitting summaries via the app or HTML5 platform requires exiting the WeChat mini-program and switching between apps. This not only adds steps but also easily leads to delayed or missed records, reducing work efficiency and impacting client satisfaction and business results.

[0005] In summary, the daily summary function can only be submitted and viewed on the app or H5 platform, forcing most users to frequently switch between apps, affecting work efficiency. While using WeChat, users must exit the WeChat mini-program and open the app or H5 platform to submit their summary. This not only increases operational complexity but also easily leads to information loss or forgotten entries. Furthermore, frequent switching results in a poor user experience, especially in scenarios where the summary function is frequently used, further reducing the overall system efficiency and workflow smoothness.

[0006] Therefore, in the current technology, there is a problem that the sub-end cannot exchange data with the mother-end in a multi-end architecture. Summary of the Invention

[0007] The present invention provides a data isolation access method, device, equipment and medium, the main purpose of which is to solve the problem that the sub-end cannot interact with the mother end in a multi-end architecture.

[0008] In a first aspect, to achieve the above-mentioned objectives, the present invention provides a data isolation access method, comprising:

[0009] Receive an access request from a target requesting end, perform double-field authentication on the target requesting end according to the access request, and obtain the identity of the requesting end;

[0010] Generating a data source distinguishing value corresponding to the access request according to the requesting end identity;

[0011] Obtaining the to-be-processed text data of the access request, and generating different accessible ranges of the to-be-processed text data according to the data source distinguishing value;

[0012] Performing access module screening on the text data to be processed according to the accessible range to obtain accessible modules, and determining whether the requesting end is a preset sub-end;

[0013] If the requesting end is a preset child end, the accessible module is used to share the text data to be processed with the preset mother end, and the shared text data is returned by the preset mother end;

[0014] If the requesting end is a preset mother end, the text data to be processed is sent to the accessible module to obtain the shared text data returned by the preset mother end.

[0015] In a second aspect, the present invention further provides a data isolation access device, comprising:

[0016] A dual-field authentication module is used to receive an access request from a target requester, perform dual-field authentication on the target requester according to the access request, and obtain the identity of the requester;

[0017] A distinguishing value generating module, configured to generate a data source distinguishing value corresponding to the access request according to the identity of the requesting end;

[0018] an access range acquisition module, configured to acquire the to-be-processed text data of the access request and generate different accessible ranges of the to-be-processed text data according to the data source distinguishing value;

[0019] an access module screening module, configured to screen the access modules of the text data to be processed according to the accessible range, obtain accessible modules, and determine whether the requesting end is a preset sub-end;

[0020] A child-end sharing module, configured to share the to-be-processed text data with a preset mother-end by using the accessible module if the requesting end is a preset child-end, and obtain the shared text data returned by the preset mother-end;

[0021] The mother-end sharing module is used to send the to-be-processed text data to the accessible module if the identity of the requesting end is a preset mother-end, and obtain the shared text data returned by the preset mother-end.

[0022] In a third aspect, the present invention further provides an electronic device, comprising:

[0023] at least one processor; and,

[0024] a memory communicatively connected to the at least one processor; wherein,

[0025] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the data isolation access method described above.

[0026] In a fourth aspect, the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores at least one computer program, and the at least one computer program is executed by a processor in an electronic device to implement the above-mentioned data isolation access method.

[0027] The present invention receives an access request from a target request end, performs a dual-field authentication on the target request end according to the access request, and obtains the identity of the request end. Through this dual-field authentication mechanism, not only can the identity of the request end be verified more comprehensively, but also when encountering an unstable cookie, the security and reliability of the authentication process can be enhanced through the token, thereby providing a more stable, reliable and secure identity authentication service. According to the identity of the request end, a data source distinguishing value corresponding to the access request is generated, and the to-be-processed text data of the access request is obtained. Different accessible ranges of the to-be-processed text data are generated according to the data source distinguishing value. By generating different accessible ranges of the to-be-processed text data according to the data source distinguishing value, refined authority control and data access management can be effectively achieved, and the to-be-processed text data can be authenticated according to the accessible range. This data is screened by access modules to obtain accessible modules, and it is determined whether the requesting end identity is the preset sub-end. If the requesting end identity is the preset sub-end, the accessible module is used to share the text data to be processed to the preset mother end, and the shared text data returned by the preset mother end is obtained. If the requesting end identity is the preset mother end, the text data to be processed is sent to the accessible module to obtain the shared text data returned by the preset mother end. Distinguishing the data transmission between the mother end and the sub-end can improve data security, avoid data from flowing back to the sub-end in an uncontrolled manner, and reduce the risk of data leakage or tampering. Through clear data flow control, not only can sensitive information be better protected, ensuring that data is only transmitted and processed within the authorized scope, but the sub-end can also safely interact with the mother end for data, thereby ensuring the compliance and stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0029] Figure 1 A schematic diagram of an application environment of a data isolation access method according to an embodiment of the present invention;

[0030] Figure 2 A schematic diagram of a flow chart of a data isolation access method provided by one embodiment of the present invention;

[0031] Figure 3 A schematic diagram of a process for generating a data source distinguishing value in a data isolation access method provided by one embodiment of the present invention;

[0032] Figure 4A schematic diagram of a module of a data isolation access device provided by one embodiment of the present invention;

[0033] Figure 5 A schematic structural diagram of an electronic device for implementing a data isolation access method provided by an embodiment of the present invention;

[0034] Figure 6 Another structural diagram of an electronic device for implementing a data isolation access method provided by an embodiment of the present invention.

[0035] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, and to fully understand and implement how the present disclosure applies technical means to solve technical problems and achieve the corresponding technical effects, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. The embodiments of the present disclosure and the various features in the embodiments can be combined with each other without conflict, and the technical solutions formed are all within the scope of protection of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present disclosure.

[0037] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, apparatus, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] An embodiment of the present application provides a data isolation access method, and the execution subject of the data isolation access method includes but is not limited to at least one of the electronic devices such as a server, a terminal, etc. that can be configured to execute the device provided by the embodiment of the present application. In other words, the data isolation access method can be executed by software or hardware installed in a terminal device or a server device. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc. The server can be an independent server, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0039] The embodiment of the present invention provides a data isolation access method, which can be applied to Figure 1application environment. Among them, the client communicates with the server through the network. The server can receive the access request of the target request end through the client, perform double-field authentication on the target request end according to the access request, and obtain the identity of the request end. Through this double-field authentication mechanism, not only can the identity of the request end be verified more comprehensively, but also when encountering unstable cookies, the security and reliability of the authentication process can be enhanced through tokens, providing a more stable, reliable and secure identity authentication service. According to the identity of the request end, a data source distinguishing value corresponding to the access request is generated, and the to-be-processed text data of the access request is obtained. Different accessible ranges of the to-be-processed text data are generated according to the data source distinguishing value. By generating different accessible ranges of the to-be-processed text data according to the data source distinguishing value, refined authority control and data access management can be effectively realized, and the to-be-processed text data can be accessed according to the accessible range. Module screening, obtains an accessible module, and determines whether the requesting end identity is a preset sub-end. If the requesting end identity is a preset sub-end, the accessible module is used to share the text data to be processed to the preset mother end, and the shared text data returned by the preset mother end is obtained. If the requesting end identity is a preset mother end, the text data to be processed is sent to the accessible module, and the shared text data returned by the preset mother end is obtained. The data transmission between the mother end and the sub-end is distinguished, which can improve the security of the data, avoid data from flowing back to the sub-end in an uncontrolled manner, and reduce the risk of data leakage or tampering. Through clear data flow control, not only can sensitive information be better protected, ensuring that data is only transmitted and processed within the authorized scope, but the sub-end can also safely interact with the mother end for data, ensuring the compliance and stability of the system, and finally outputting the shared text data back to the user client. Among them, the client can be but is not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices. The server can be implemented with an independent server or a server cluster composed of multiple servers. The present invention is described in detail below through specific embodiments.

[0040] The following is an explanation of the specification of the present invention. The present invention distinguishes the data transmission between the mother end and the child end, avoids the data from flowing back to the child end in an uncontrolled manner, reduces the risk of data leakage or tampering, and through clear data flow control, can not only better protect sensitive information and ensure that data is only transmitted and processed within the authorized scope, but also the child end can safely interact with the mother end for data, thereby ensuring the compliance and stability of the system.

[0041] Reference Figure 2 FIG. 1 is a flow chart of a data isolation access method provided by an embodiment of the present invention. In this embodiment, the data isolation access method includes:

[0042] S1. Receive an access request from a target requesting end, perform double-field authentication on the target requesting end according to the access request, and obtain the identity of the requesting end.

[0043] In an embodiment of the present invention, based on the access request received from the target request end, the system will parse the identity authentication identifier (such as Token, Cookie, etc.) in the request, and then authenticate the target request end through these identifiers. After the identity authentication is passed, the system will confirm the identity information of the request end. The target request end includes: a child end and a mother end, wherein the child end is, for example, a WeChat applet end, and the mother end is, for example, an APP and H5 end. The dual-field authentication mechanism of the cookie field and the token field can ensure that the login information processing method of the child end and the mother end is consistent, while avoiding the problem of instability of the child end when identifying the cookie field in the identity authentication identifier field.

[0044] In healthcare scenarios, patients can access personal health records, make appointments, or access remote consultations through WeChat mini-programs (sub-client) or hospital apps / H5 pages (main client). By using both cookie and token fields for dual-field authentication, the login verification logic across different terminals can be unified, ensuring identity continuity and data consistency when switching between multiple platforms. This specifically addresses the issue of unstable cookie handling in mini-programs, thereby ensuring the continuity of medical services and data security.

[0045] In specific FinTech scenarios, users may use the mini-program portal for daily payments (sub-end) or manage their accounts and investments through the app or webpage (main end). A dual-field authentication mechanism using cookies and tokens effectively identifies different request sources, ensuring consistent authentication logic across all terminals, improving user experience consistency, and enhancing account security. This is especially true when processing high-risk transactions or those involving sensitive financial data, avoiding security risks caused by unstable mini-program cookie recognition.

[0046] In an embodiment of the present invention, performing dual-field authentication on the target requester according to the access request to obtain the identity of the requester includes:

[0047] Extracting the identity authentication identification field of the access request;

[0048] Perform field parsing on the identity authentication identification field to obtain the field type;

[0049] Determining whether the field type is a first identification field type or a second identification field type;

[0050] If the field type is a first identification field type, extracting the identity information of the target requesting end according to the first identification field type;

[0051] If the field type is a second identification field type, identifying key field information of the second identification field type;

[0052] Detecting the correlation between the key field information and the target request end to obtain a correlation detection result;

[0053] Determining whether the association detection result indicates that the key field information is associated with the target request end;

[0054] If the key field information is not associated with the target requesting end, determining that the identity information verification of the target requesting end has failed;

[0055] If the key field information is associated with the target requesting end, identifying the identity information of the target requesting end according to the key field information;

[0056] Generate a requester identity of the target requester according to the identity information.

[0057] In detail, after receiving an access request, key information fields used for identity identification are parsed from the request message or data payload of the access request, such as user ID, token, digital certificate, public key information or other unique identity identification data, so as to be used for subsequent authentication, permission verification or data source tracking and other operations. It usually relies on a predefined data format or communication protocol, and the corresponding field position is fixed or can be identified by a label.

[0058] Based on preset format specifications or protocol rules, the extracted identity authentication identification fields are structured analyzed to identify the data type and purpose contained in the identity authentication identification fields, thereby determining the semantics and type of each subfield, providing an accurate basis for subsequent identity authentication and access control.

[0059] If the field type is the first identification field type, such as token, it means that the first identification field type contains an encrypted token used for identity authentication. The system will parse the token, usually including Base64 decoding, payload extraction, and digital signature verification, to obtain identity information fields such as user ID, permission level, and expiration time, and use this to identify the specific identity of the target requester, thereby realizing identity confirmation and access control of the requester.

[0060] If the field type is a second identification field type, such as a cookie, it means that the second identification field type indirectly carries identity association information. First, the cookie content is parsed to identify key field information in the cookie content, such as identification items such as session_id or user_token. Based on these key fields as indexes, the corresponding user identity information or login status is retrieved from the server-side session storage or authentication cache, thereby realizing the identification and verification of the requesting end identity.

[0061] If the key field information is not effectively associated with the target requester, that is, the identity record corresponding to the field information cannot be found in the session storage or identity authentication database, then the request may be a forged, expired or illegal request. Based on this, the system determines that the true identity of the requester cannot be confirmed, and thus returns a result of identity information verification failure, which is used to prevent subsequent access or trigger a security response mechanism.

[0062] If the key field information is effectively associated with the target request end, the system can identify the corresponding identity information from the authentication data, including account ID, bound device, role type, etc.; after obtaining the identity information, the system makes a judgment based on the role attributes of the identity information in the user system. If the identity information belongs to an independent registration entity or a main control account, it is identified as the parent end; if the identity information is an affiliated account or a controlled device authorized to log in under the parent end account, it is identified as a child end, thereby generating the request end identity type of the target request end in the current session.

[0063] By extracting the identity authentication identification field from the access request and parsing it, the field type is determined. If the field type is the first identification field type (such as a token), the identity information of the target requester is extracted; if the field type is the second identification field type (such as a cookie), the key field information is further identified and its association with the target requester is tested. This dual-field authentication mechanism not only allows for more comprehensive verification of the requester's identity, but also enhances the security and reliability of the authentication process through tokens in the event of cookie instability, providing a more stable, reliable, and secure identity authentication service.

[0064] S2. Generate a data source distinguishing value corresponding to the access request based on the requesting end identity.

[0065] In an embodiment of the present invention, a data source distinction value corresponding to the requesting end identity is generated based on the identified requesting end identity, which is used to identify the source channel of the requested data, thereby achieving accurate distinction in subsequent data processing, authority control or operation analysis.

[0066] In specific medical and health scenarios, data source differentiation values ​​are generated based on the key fields in the access request corresponding to the identity identifier of the requesting end (such as patient ID, department code, and device source code). This can accurately distinguish whether the medical record data comes from the outpatient system, inpatient system, or a third-party remote platform, thereby improving data traceability and sharing security.

[0067] In specific financial technology scenarios, data source differentiation values ​​can be generated based on key fields in the access request (such as terminal device ID, transaction channel code, and geographic location information) to identify whether the transaction request comes from mobile banking, ATM terminals, or third-party payment platforms, thereby supporting the risk control model to dynamically judge the credibility and risk level of the request.

[0068] Figure 3 A schematic diagram of a process for generating a data source distinguishing value in a data isolation access method provided by one embodiment of the present invention.

[0069] In an embodiment of the present invention, generating a data source distinguishing value corresponding to the access request based on the requesting end identity includes:

[0070] Generate corresponding key identity information fields according to the requesting end identity;

[0071] splicing the key identity information fields to obtain a key splicing field;

[0072] Encoding the key splicing fields to obtain an identity data feature set;

[0073] The identity data feature set is hashed and encrypted to obtain a data source distinguishing value of the access request corresponding to the requesting end identity.

[0074] Specifically, after identifying the identity type of the requesting party (e.g., child or parent), unique and representative fields are extracted from the identity information based on the identity type, such as user ID, role ID, permission level, device ID, authentication token, etc. These fields will serve as key identity information fields for subsequent authentication, access control, and permission management operations, ensuring that the system can accurately identify and authorize the requesting party.

[0075] Combine multiple key fields extracted from the requester's identity information (such as user ID, role ID, device ID, etc.) into a new string or data structure in a preset order or format. This splicing process usually forms a unique and structured identifier by connecting the values ​​of each field. It is used for subsequent authentication, data encryption or request identification to ensure that the requester's identity information can be uniquely and efficiently represented.

[0076] The previously concatenated key fields (such as user ID, role ID, and device ID) are converted into a format suitable for storage or transmission using an encoding algorithm (such as Base64, Hex, or URL encoding). The encoded identity data feature set represents the requester's identity information in a unified and compressed form, ensuring data security during network transmission or database storage while facilitating subsequent processing and verification.

[0077] In detail, the hash encryption of the identity data feature set to obtain the data source distinguishing value of the access request corresponding to the requesting end identity includes:

[0078] splicing the identity data feature set into an identity string;

[0079] Using a preset one-way hash function to one-way encrypt the identity string to obtain a hash value of the identity string;

[0080] The hash value is used as a data source distinguishing value for the access request corresponding to the requesting end identity.

[0081] Specifically, the previously encoded identity data feature set is combined according to a specific order or rule into a complete identity string, which serves as the unique identifier of the requesting party. This identity string is then one-way encrypted using a preset one-way hash function (such as SHA-256 or SM3) to generate a fixed-length hash value. The hash value is unique and irreversible, ensuring that the requesting party's identity can be quickly confirmed by comparing the hash value during identity verification, while also ensuring security and preventing identity data leakage.

[0082] The hash value is used as a unique identifier for the requester's identity, distinguishing different data sources. This hash value acts as an encrypted "tag" to help the system identify the source of the request. In subsequent access requests, the hash value can be used to track and verify the requester, thereby achieving precise access control, identity authentication, and data security management.

[0083] By generating a data source identification value for access requests based on the requesting party's identity, the authenticity and security of the requests can be effectively ensured. The concatenation of key identity information fields ensures the uniqueness of each request. The encoded identity data feature set further enhances the privacy of identity information, preventing the leakage of sensitive information. Hash encryption not only ensures data integrity and consistency, but also mitigates the risk of data tampering or forgery. This process accurately distinguishes different request sources, thereby enhancing system security, preventing malicious attacks and identity forgery, and ensuring the credibility of request data.

[0084] S3. Obtain the text data to be processed of the access request, and generate different accessible ranges of the text data to be processed according to the data source distinguishing value.

[0085] In an embodiment of the present invention, after obtaining the text data to be processed in the access request, different accessible ranges will be set for the text data to be processed based on the data source distinction value generated previously, ensuring that different types of request ends can only access data content that matches their identity and authority level, thereby achieving differentiated control and security isolation of data access.

[0086] In specific medical and health scenarios, the text data to be processed in the access request (such as electronic medical record notes, examination report conclusions) can be obtained, and different access scopes can be set according to the corresponding data source distinction values ​​(such as inpatient system, external remote platform). For example, in-hospital doctors can view the inpatient system data in full, while only some fields or desensitized content are open to the access platform to ensure patient privacy and data usage compliance.

[0087] In specific FinTech scenarios, access permissions can be set dynamically based on the text data in the access request (such as risk assessment reports, customer behavior analysis results) and its data source differentiation value (such as internal risk control system, external credit reporting agency). For example, account managers can view internal credit score details, while external partners can only access processed credit rating summaries, thereby preventing sensitive information leakage while ensuring business collaboration.

[0088] In an embodiment of the present invention, generating different accessible ranges of the text data to be processed according to the data source distinguishing value includes:

[0089] Performing structural analysis on the text data to be processed to obtain a plurality of information blocks to be processed;

[0090] Obtaining the access permission summary table of the target requesting end, matching the data source distinguishing value of each information block to be processed with the access permission summary table one by one, and obtaining the target access permission of each information block to be processed;

[0091] The target access rights are summarized to obtain an access range of each of the information blocks to be processed.

[0092] In detail, the original text data is analyzed and decomposed according to preset rules or formats to extract parts or paragraphs with independent meaning. The information blocks to be processed can be key data, fields, tags or other structured elements in the text. After parsing, they are divided into multiple independent parts to facilitate further processing, analysis and operation, so that the originally disordered or messy text data is transformed into content with a clear structure and operability.

[0093] An information table containing the access rights for each module is extracted from the rights management or access control database. The target requester's access rights summary table lists the access scopes and associated permissions for different modules. The data source distinguishing value for each block of information to be processed is matched against the information in the permission module table. The corresponding access rights scope for each block of information is determined based on the data source distinguishing value. Through this matching process, the system determines the target access rights for each block of information to be processed, ensuring that only requests with the appropriate access rights can access the corresponding module or resource.

[0094] All target access permissions previously obtained by matching each pending information block with the permission module table are integrated and summarized to form a complete set of access permissions. Through this aggregation process, the system defines a specific access scope for each pending information block, helping to clearly understand the operational permissions of each information block in different modules, ensuring the accuracy and security of access control.

[0095] By generating different accessible scopes for the text data to be processed based on the data source distinction value, refined permission control and data access management can be effectively achieved. By splitting the text data into multiple information blocks through structured parsing, it is helpful to perform separate access control for different information needs. By matching with the access permission summary table, the access permissions of each information block are dynamically adjusted according to its source, which improves flexibility and security. After summarizing the target access permissions, the access scope of each information block can be clearly defined, thereby ensuring that only authorized users can access the corresponding data, improving the security of the system and the compliance of the data, and avoiding the risk of unauthorized access or data leakage.

[0096] S4. Perform access module screening on the text data to be processed according to the accessible range to obtain accessible modules.

[0097] In an embodiment of the present invention, each functional module or content module accessible to the text data to be processed is screened, and only the modules within the access scope are retained as accessible modules, thereby ensuring that the requesting end can only access valid data or functions within its authority scope, thereby improving data security and service accuracy.

[0098] In specific medical and health scenarios, access modules for processed text data (such as case records and consultation opinions) are screened according to the accessible scope, and the module permissions for different roles to access content can be accurately controlled. For example, the attending physician can access the complete diagnosis and treatment record module, while the nurse can only access the nursing record module, and the third-party remote system can only access the desensitized summary module, ensuring that the sharing of sensitive information is minimized.

[0099] In specific financial technology scenarios, data such as customer investment preference analysis and anti-fraud text reports are filtered by modules based on the accessible scope. The system can only display the investment advice module to customers, open the transaction behavior and abnormal warning module to risk control personnel, and partner institutions can only access the encrypted risk assessment module, thereby achieving safe and hierarchical use of data among different business entities.

[0100] In an embodiment of the present invention, the step of filtering the access modules of the text data to be processed according to the accessible range to obtain accessible modules includes:

[0101] Acquire the functional modules of the target request end, divide the functional modules into access levels, and obtain an access control list for each functional module;

[0102] Labeling and classifying the text data to be processed according to sensitivity levels to obtain a plurality of labeled text data;

[0103] Matching the annotated text data with the accessible ranges one by one to obtain a target access range for each annotated text data;

[0104] Performing module screening on the access control table according to the target access scope to obtain access control information for each annotated text data;

[0105] An accessible module for each annotated text data is generated according to the access control information.

[0106] Specifically, the functional modules of the target request end are divided into sub-end functional modules and parent-end functional modules. For example, the sub-end functional modules include: summary module, coaching module, authorization module, and escrow module. The summary module includes daily summaries of insurance agents' daily visits to customers, records of the policy issuance process, and policy review summaries. The coaching module provides guidance and suggestions to the summary modules of the next-level insurance agents. The authorization module allows a leader-level agent to authorize another group of leader-level agents to view their summary modules. The escrow module allows a leader-level agent to escrow another group's summary modules and coaching modules. The parent-end functional modules include: summary module, coaching module, 18 Palm dashboard module, and weekly and monthly report module. The summary and coaching modules have the same functions as the sub-end. The 18 Palm dashboard module helps teams track and manage project progress, task assignments, and key indicators in real time. The weekly and monthly report module summarizes the project's weekly and monthly reports.

[0107] When assigning access levels to functional modules, different access rights should be set based on user roles and responsibilities. For example, data from the summary and coaching modules on the child side is fed into the master side, allowing the master side to read, write, and edit the data on the child side. Data from the summary and coaching modules on the master side is fed into the child side, but the child side cannot see, read, write, or edit the data on the master side. This division of permissions allows for the development of an access control list for each functional module, ensuring information security and confidentiality and preventing unauthorized access to sensitive data.

[0108] The content of each piece of text data to be processed is analyzed to identify any sensitive information it may contain, such as personal privacy, financial data, and company secrets. Based on the sensitivity of this information, the text is divided into different sensitivity levels (such as low, medium, and high). Each piece of text data is categorized by sensitivity level and labeled with the corresponding level. This approach allows for effective data management, ensuring that highly sensitive data receives stricter protection and processing, while also facilitating subsequent data reviews and compliance checks.

[0109] Check the sensitivity level of each annotated text data, and refer to the permission settings of each functional module in the access control table to filter out the functional modules that are allowed to access the annotated text data. Based on the filtered permission information, generate corresponding accessible modules for each annotated text to ensure that only users who meet the permission requirements can access the content in these modules. This helps to automatically adjust and restrict different users' access to different sensitive data, ensuring data security and compliance.

[0110] By labeling the sensitivity of the text data to be processed and filtering the modules of the access control table, we can ensure that different text data to be processed can only access the functional modules that match their permissions. This not only improves the security and compliance of data processing, but also optimizes resource allocation, avoids the leakage of sensitive data, and helps to achieve refined permission management and data protection.

[0111] S5. Determine whether the requesting end is a preset sub-end.

[0112] In an embodiment of the present invention, due to the need for data security, the pending text data of the mother end will not be displayed on the child end. The child end only displays its own pending text data, and the mother end will display the pending text data of the child end and the mother end. It flows in one direction and there is no privacy data leakage. Therefore, it is necessary to determine whether the requesting end identity is the child end or the mother end, and complete the corresponding data sharing display according to the requesting end identity.

[0113] In healthcare scenarios, the health data platform can receive and store patient health data from the parent end (such as a regional hospital or clinic) and the child end (the patient's own mini-program end), including medical records, test results, prescriptions, etc. When requesting to view a patient's health data, the system needs to identify the requesting end (parent end or child end) and provide different levels of data access permissions based on their identity.

[0114] In a specific fintech scenario, a fintech company provides a cross-platform financial management system (the parent client). Users have multiple accounts at different banks or financial institutions (sub-clients). When requesting to view their financial reports, the system needs to identify the requesting party (parent client or sub-client) to ensure that users can only see their account information across different sub-clients, while sub-clients only display the user's data on their own platform. The parent client system can integrate the user's data from multiple sub-clients, but it will not directly display the data to other sub-clients, ensuring that each sub-client can only access the data relevant to it.

[0115] If the requesting end is a preset sub-end, then S6 , using the accessible module to share the to-be-processed text data to a preset mother end, and obtaining the shared text data returned by the preset mother end.

[0116] In an embodiment of the present invention, if the requesting end is a sub-end, the text data to be processed is shared with the accessible module of the mother end, and the mother end uniformly manages and reviews the text data to be processed of the sub-end, while ensuring privacy and security during data transmission, avoiding unauthorized data leakage, and ensuring the one-way flow and security of data.

[0117] In the specific healthcare scenario, the parent end is a medical data center or large hospital, while the child end refers to primary healthcare institutions such as hospitals and clinics. After a patient undergoes an examination at a primary hospital (child end), the pending diagnostic text data (such as laboratory reports and test results) needs to be shared with the parent end for further analysis and review. The child end sends the pending text data to the accessible module of the parent end, which is centrally managed and reviewed by the parent end. Only after confirming the data's compliance and authorization will the parent end further process or share it with other hospitals.

[0118] In specific FinTech scenarios, the parent platform is a unified financial data management platform, while the child platform is a financial institution such as a bank or securities firm. When a user conducts a transaction or manages an account on a bank's child platform, pending transaction data (such as account balances, transaction history, and risk assessments) is sent to the parent platform for aggregation and analysis. Through the parent platform's accessible modules, the child platform can securely upload this data to the parent platform for centralized review. The parent platform can then aggregate or analyze the data according to regulations, ensuring that the data is not leaked to other child platforms without authorization.

[0119] In an embodiment of the present invention, the step of sharing the to-be-processed text data to a preset mother terminal using the accessible module and obtaining the shared text data returned by the preset mother terminal includes:

[0120] Performing desensitization processing on the annotated text data to obtain desensitized text data;

[0121] Obtaining a preset encapsulation protocol of the mother end, and encapsulating the desensitized text data according to the encapsulation protocol to obtain a standard data message;

[0122] Sending the standard data message to the accessible module of the preset mother end;

[0123] Performing integrity check on the standard data message received by the accessible module to obtain an integrity check result;

[0124] Determine whether the integrity check result is passed;

[0125] If the integrity check result is a check failure, an abnormality alarm is sent to the preset mother terminal;

[0126] If the integrity check result is passed, the received standard data message is used as the shared text data.

[0127] In detail, for the sensitive information in the identified annotated text data, character replacement, mask encryption, obfuscation processing or hashing are used to perform desensitization conversion to ensure that the sensitive information is effectively hidden or replaced without affecting the data structure and semantic integrity, and finally generate desensitized text data for subsequent data flow and secure sharing.

[0128] After obtaining the encapsulation protocol of the preset mother end, the data structure, field format, transmission encoding method and verification rules defined in the protocol are parsed to determine the message template and parameter configuration required for encapsulation. According to the specification requirements of the encapsulation protocol, the anonymized text data is field mapped and formatted, including field name adaptation, data type conversion, character encoding unification, special symbol escape and other operations. After completing the normalization of the data content, the processed anonymized text data is nested and organized according to the message hierarchy defined by the encapsulation protocol, and necessary metadata (such as version number, request ID, timestamp, signature information, etc.) is attached to finally generate a standard data message that meets the requirements of the preset mother end to ensure the accuracy and compatibility of subsequent data interactions.

[0129] After completing the encapsulation of the standard data message, the accessible module in the terminal device is called through the pre-established communication link, and the standard data message is sent to the preset mother end according to the mother end communication protocol (such as HTTP, HTTPS, MQTT or custom protocol) to ensure the integrity of the data during the transmission process and realize efficient docking between the standard data message and the preset mother end.

[0130] When the accessible module receives the standard data message returned by the preset mother end, it extracts the check field or signature information in the data message based on the preset integrity verification mechanism (such as CRC verification, hash value comparison, digital signature verification, etc.), calculates the received data according to the verification algorithm agreed upon in the protocol, and compares it with the check value attached to the message. According to the comparison result, it is judged whether the standard data message has been tampered with, lost or damaged during the transmission process. If the comparison is consistent, it is considered "verification passed", otherwise it is judged as "verification failed", and the subsequent normal processing or exception processing process is triggered according to the verification result to ensure the accuracy and security of data interaction.

[0131] After completing the integrity check of the standard data message, branch processing is performed according to the check result: if the check result is "verification failed", the abnormal alarm mechanism is immediately triggered, and the abnormal alarm information (including session ID, message number, error type and reason for verification failure, etc.) is sent to the preset mother end through the accessible module, so that the mother end can perceive the data abnormality in time and take corresponding remedial measures; if the check result is "verification passed", the received standard data message is identified as valid shared text data for subsequent data display, sharing or business application call, ensuring the security and reliability of the data transmission process, while ensuring the continuity and stability of the business process.

[0132] Desensitizing processing effectively avoids the risk of privacy leakage caused by the direct uploading of sensitive data by the sub-end. The standardized data encapsulation based on the mother-end encapsulation protocol improves the compatibility and docking efficiency between the sub-end and the mother-end. The integrity check and abnormal alarm mechanism ensure the accuracy and reliability of the data transmission process, ensuring that the sub-end can obtain the valid shared text data returned by the mother-end, avoiding interaction failures caused by data damage, loss or tampering, and fundamentally improving the data interaction capability between the sub-end and the mother-end and the overall stability of the system.

[0133] If the requesting end is a preset mother end, then S7: sending the text data to be processed to the accessible module to obtain the shared text data returned by the preset mother end.

[0134] In an embodiment of the present invention, if the requesting end is a mother end, there is no need for additional processing such as desensitization and encapsulation. The text data to be processed can be directly shared to the mother end through the accessible module, simplifying the data flow path, and strictly distinguishing the transmission direction of the mother end and the child end in data interaction, ensuring the unidirectionality of data flow, preventing data from flowing back or unauthorized sharing, and effectively improving the data security of the system and the controllability of business logic.

[0135] In healthcare scenarios, sensitive data such as patient medical records and test results can be centrally managed through a central system, ensuring that data flows only within a controlled environment and preventing unnecessary leakage or tampering. For example, a patient's medical records can be sent to a hospital's unified information system through an accessible module, and this system ensures that only authorized personnel can access the data.

[0136] In specific FinTech scenarios, user payment information can be sent directly to a payment gateway or bank's accessible module via a parent-side system, ensuring the security of the user's funds. For example, during a banking transaction, the transaction request is sent from the user's device to the bank's parent-side system, which then sends it to the payment gateway via the accessible module for processing. This ensures a one-way flow of data, preventing payment information leakage or transaction tampering.

[0137] Differentiating data transmission between the parent and child ends can improve data security, prevent data from flowing back to the child end in an uncontrolled manner, and reduce the risk of data leakage or tampering. Through clear data flow control, it can not only better protect sensitive information and ensure that data is only transmitted and processed within the authorized scope, but also the child end can safely interact with the parent end to ensure the compliance and stability of the system.

[0138] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0139] like Figure 4 FIG. 1 is a functional module diagram of a data isolation access device provided by an embodiment of the present invention.

[0140] In an embodiment of the present disclosure, a data isolation access device is provided, and the data isolation access device corresponds one-to-one to a data isolation access method in the above embodiment. Figure 4As shown, the data isolation access device 100 can be installed in an electronic device. According to the functions to be implemented, the data isolation access device 100 includes a dual-field authentication module 101, a distinguishing value generation module 102, an access range acquisition module 103, an access module screening module 104, a child-end sharing module 105, and a parent-end sharing module 106. The functional modules are described in detail as follows:

[0141] The dual-field authentication module 101 is configured to receive an access request from a target requesting end, perform dual-field authentication on the target requesting end according to the access request, and obtain the identity of the requesting end;

[0142] A distinguishing value generating module 102, configured to generate a data source distinguishing value corresponding to the access request according to the requesting end identity;

[0143] An access range acquisition module 103 is configured to acquire the text data to be processed of the access request and generate different accessible ranges of the text data to be processed according to the data source distinguishing value;

[0144] An access module screening module 104 is configured to screen the access modules of the text data to be processed according to the accessible range, obtain accessible modules, and determine whether the requesting end is a preset sub-end;

[0145] The child-end sharing module 105 is configured to share the to-be-processed text data with a preset mother-end by using the accessible module if the requesting end is a preset child-end, and obtain the shared text data returned by the preset mother-end;

[0146] The mother-end sharing module 106 is configured to send the to-be-processed text data to the accessible module if the requesting end is a preset mother-end, and obtain the shared text data returned by the preset mother-end.

[0147] In one embodiment, when performing dual-field authentication on the target requester according to the access request to obtain the identity of the requester, the dual-field authentication module 101 is configured to:

[0148] Extracting the identity authentication identification field of the access request;

[0149] Perform field parsing on the identity authentication identification field to obtain the field type;

[0150] Determining whether the field type is a first identification field type or a second identification field type;

[0151] If the field type is a first identification field type, extracting the identity information of the target requesting end according to the first identification field type;

[0152] If the field type is a second identification field type, identifying key field information of the second identification field type;

[0153] Detecting the correlation between the key field information and the target request end to obtain a correlation detection result;

[0154] Determining whether the association detection result indicates that the key field information is associated with the target request end;

[0155] If the key field information is not associated with the target requesting end, determining that the identity information verification of the target requesting end has failed;

[0156] If the key field information is associated with the target requesting end, identifying the identity information of the target requesting end according to the key field information;

[0157] Generate a requester identity of the target requester according to the identity information.

[0158] In one embodiment, when generating a data source distinguishing value corresponding to the access request based on the requesting end identity, the distinguishing value generating module 102 is configured to:

[0159] Generate corresponding key identity information fields according to the requesting end identity;

[0160] splicing the key identity information fields to obtain a key splicing field;

[0161] Encoding the key splicing fields to obtain an identity data feature set;

[0162] The identity data feature set is hashed and encrypted to obtain a data source distinguishing value of the access request corresponding to the requesting end identity.

[0163] In one embodiment, when performing hash encryption on the identity data feature set to obtain the data source distinguishing value of the access request corresponding to the requesting end identity, the distinguishing value generating module 102 is configured to:

[0164] splicing the identity data feature set into an identity string;

[0165] Using a preset one-way hash function to one-way encrypt the identity string to obtain a hash value of the identity string;

[0166] The hash value is used as a data source distinguishing value for the access request corresponding to the requesting end identity.

[0167] In one embodiment, when the access range acquisition module 103 generates different accessible ranges of the text data to be processed according to the data source distinguishing value, it is configured to:

[0168] Performing structural analysis on the text data to be processed to obtain a plurality of information blocks to be processed;

[0169] Obtaining the access permission summary table of the target requesting end, matching the data source distinguishing value of each information block to be processed with the access permission summary table one by one, and obtaining the target access permission of each information block to be processed;

[0170] The target access rights are summarized to obtain an access range of each of the information blocks to be processed.

[0171] In one embodiment, when the access module screening module 104 performs access module screening on the to-be-processed text data according to the accessible range to obtain accessible modules, it is configured to:

[0172] Acquire the functional modules of the target request end, divide the functional modules into access levels, and obtain an access control list for each functional module;

[0173] Labeling and classifying the text data to be processed according to sensitivity levels to obtain a plurality of labeled text data;

[0174] Matching the annotated text data with the accessible ranges one by one to obtain a target access range for each annotated text data;

[0175] Performing module screening on the access control table according to the target access scope to obtain access control information for each annotated text data;

[0176] An accessible module for each annotated text data is generated according to the access control information.

[0177] In one embodiment, when the slave-end sharing module 105 uses the accessible module to share the to-be-processed text data to the preset master-end and obtains the shared text data returned by the preset master-end, it is configured to:

[0178] Performing desensitization processing on the annotated text data to obtain desensitized text data;

[0179] Obtaining a preset encapsulation protocol of the mother end, and encapsulating the desensitized text data according to the encapsulation protocol to obtain a standard data message;

[0180] Sending the standard data message to the accessible module of the preset mother end;

[0181] Performing integrity check on the standard data message received by the accessible module to obtain an integrity check result;

[0182] Determine whether the integrity check result is passed;

[0183] If the integrity check result is a check failure, an abnormality alarm is sent to the preset mother terminal;

[0184] If the integrity check result is passed, the received standard data message is used as the shared text data.

[0185] In the present invention, for a data isolation access device, first, the present invention receives an access request from a target request end, performs a dual-field authentication on the target request end according to the access request, and obtains the identity of the request end. Through this dual-field authentication mechanism, not only can the identity of the request end be verified more comprehensively, but also when encountering unstable cookies, the security and reliability of the authentication process can be enhanced through tokens, providing a more stable, reliable and secure identity authentication service. According to the identity of the request end, a data source distinguishing value corresponding to the access request is generated, and the to-be-processed text data of the access request is obtained. According to the data source distinguishing value, different accessible ranges of the to-be-processed text data are generated. By generating different accessible ranges of the to-be-processed text data according to the data source distinguishing value, refined authority control and data access management can be effectively achieved. According to the accessible The scope of the text data to be processed is screened by the access module to obtain an accessible module, and then the identity of the requesting end is judged to be the preset sub-end. If the identity of the requesting end is the preset sub-end, the accessible module is used to share the text data to the preset mother end, and the shared text data returned by the preset mother end is obtained. If the identity of the requesting end is the preset mother end, the text data to be processed is sent to the accessible module, and finally the shared text data returned by the preset mother end is obtained. The data transmission between the mother end and the sub-end is distinguished, which can improve the security of the data, avoid the data from flowing back to the sub-end in an uncontrolled manner, and reduce the risk of data leakage or tampering. Through clear data flow control, not only can sensitive information be better protected, ensuring that data is only transmitted and processed within the authorized scope, but also the sub-end can safely interact with the mother end to ensure the compliance and stability of the system. For the specific definition of a data isolation access device, please refer to the definition of a data isolation access method above, which will not be repeated here. The various modules in the above-mentioned data isolation access device can be fully or partially implemented by software, hardware and their combination. The above modules may be embedded in or independent of the processor in the computer device in the form of hardware, or may be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0186] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor, memory, network interface and database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client via a network connection. When the computer program is executed by the processor, it implements the functions or steps on the server side of a data isolation access method.

[0187] In one embodiment, a computer device is provided. The computer device may be a client, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, memory, network interface, display screen, and input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the functions or steps on the client side of a data isolation access method.

[0188] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are performed:

[0189] Receive an access request from a target requesting end, perform double-field authentication on the target requesting end according to the access request, and obtain the identity of the requesting end;

[0190] Generating a data source distinguishing value corresponding to the access request according to the requesting end identity;

[0191] Obtaining the to-be-processed text data of the access request, and generating different accessible ranges of the to-be-processed text data according to the data source distinguishing value;

[0192] Performing access module screening on the text data to be processed according to the accessible range to obtain accessible modules, and determining whether the requesting end is a preset sub-end;

[0193] If the requesting end is a preset child end, the accessible module is used to share the text data to be processed with the preset mother end, and the shared text data is returned by the preset mother end;

[0194] If the requesting end is a preset mother end, the text data to be processed is sent to the accessible module to obtain the shared text data returned by the preset mother end.

[0195] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and apparatuses can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the module division is merely a logical function division, and actual implementation may employ other division methods.

[0196] In addition, the functional modules in various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or hardware plus software functional modules.

[0197] Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims rather than the foregoing description, and all changes that come within the meaning and range of equivalents of the claims are intended to be embraced therein. Any reference to a figure in a claim should not be construed as limiting the claim to which it relates.

[0198] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0199] In some implementations of this embodiment, a computer-readable storage medium is provided, on which a computer program is stored, characterized in that when the computer program is executed by a processor, the steps of the method described in the above embodiment are implemented.

[0200] The readable storage medium of the present invention stores a computer program, which, when executed by a processor of an electronic device, can implement:

[0201] Receive an access request from a target requesting end, perform a double-field authentication on the target requesting end according to the access request, and obtain the identity of the requesting end;

[0202] Generating a data source distinguishing value corresponding to the access request according to the requesting end identity;

[0203] Obtaining the to-be-processed text data of the access request, and generating different accessible ranges of the to-be-processed text data according to the data source distinguishing value;

[0204] Performing access module screening on the text data to be processed according to the accessible range to obtain accessible modules, and determining whether the requesting end is a preset sub-end;

[0205] If the requesting end is a preset child end, the accessible module is used to share the text data to be processed with the preset mother end, and the shared text data is returned by the preset mother end;

[0206] If the requesting end is a preset mother end, the text data to be processed is sent to the accessible module to obtain the shared text data returned by the preset mother end.

[0207] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can be found in the relevant descriptions of the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0208] The computer-readable storage medium may also store at least one computer-executable program / instruction, such as a computer-readable instruction. Computer-readable storage media include, but are not limited to, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Computer-readable storage media may include, for example, read-only memory (ROM), a hard disk, a flash memory, etc. For example, a non-transitory computer-readable storage medium may be connected to a computing device such as a computer, and then, when the computing device executes the computer-readable instructions stored on the computer-readable storage medium, the various methods described above may be performed.

[0209] In addition, the computer device may also include (but is not limited to) a data bus, an input / output (I / O) bus, a display, and input / output devices (eg, keyboard, mouse, speaker, etc.).

[0210] The processor can communicate with external devices via an I / O bus via a wired or wireless network.

[0211] In one embodiment, the at least one computer executable instruction may also be compiled into or constitute a software product / computer program product, wherein one or more computer executable instructions are executed by a processor to perform the various functions and / or method steps in the embodiments described in the present technology.

[0212] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0213] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0214] In the embodiments provided in the present disclosure, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a portion of code, and the above-mentioned module, program segment or a portion of code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0215] It should be noted that, in this disclosure, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element limited by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0216] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

[0217] It should be noted that if software tools or components other than those of our company appear in the embodiments of this application, they are only used for illustration and do not represent actual use.

Claims

1. A data isolation access method, characterized in that: The method comprises: Receive an access request from a target requesting end, perform double-field authentication on the target requesting end according to the access request, and obtain the identity of the requesting end; Generating a data source distinguishing value corresponding to the access request according to the requesting end identity; Obtaining the to-be-processed text data of the access request, and generating different accessible ranges of the to-be-processed text data according to the data source distinguishing value; Performing access module screening on the text data to be processed according to the accessible range to obtain accessible modules, and determining whether the requesting end is a preset sub-end; If the requesting end is a preset child end, the accessible module is used to share the text data to be processed with the preset mother end, and the shared text data is returned by the preset mother end; If the requesting end is a preset mother end, the text data to be processed is sent to the accessible module to obtain the shared text data returned by the preset mother end.

2. The data isolation access method according to claim 1, wherein: The performing double-field authentication on the target requester according to the access request to obtain the identity of the requester includes: Extracting the identity authentication identification field of the access request; Perform field parsing on the identity authentication identification field to obtain the field type; Determining whether the field type is a first identification field type or a second identification field type; If the field type is a first identification field type, extracting the identity information of the target requesting end according to the first identification field type; If the field type is a second identification field type, identifying key field information of the second identification field type; Detecting the correlation between the key field information and the target request end to obtain a correlation detection result; Determining whether the association detection result indicates that the key field information is associated with the target request end; If the key field information is not associated with the target requesting end, determining that the identity information verification of the target requesting end has failed; If the key field information is associated with the target requesting end, identifying the identity information of the target requesting end according to the key field information; Generate a requester identity of the target requester according to the identity information.

3. The data isolation access method according to claim 1, wherein: Generating a data source distinguishing value corresponding to the access request according to the requesting end identity includes: Generate corresponding key identity information fields according to the requesting end identity; splicing the key identity information fields to obtain a key splicing field; Encoding the key splicing fields to obtain an identity data feature set; The identity data feature set is hashed and encrypted to obtain a data source distinguishing value of the access request corresponding to the requesting end identity.

4. The data isolation access method according to claim 3, wherein: The hashing of the identity data feature set to obtain a data source distinguishing value of the access request corresponding to the requesting end identity includes: splicing the identity data feature set into an identity string; One-way encryption of the identity string is performed using a preset one-way hash function to obtain a hash value of the identity string; The hash value is used as a data source distinguishing value for the access request corresponding to the requesting end identity.

5. The data isolation access method according to claim 1, wherein: Generating different accessible ranges of the text data to be processed according to the data source distinguishing value includes: Performing structural analysis on the text data to be processed to obtain a plurality of information blocks to be processed; Obtaining the access permission summary table of the target requesting end, matching the data source distinguishing value of each information block to be processed with the access permission summary table one by one, and obtaining the target access permission of each information block to be processed; The target access rights are summarized to obtain an access range of each of the information blocks to be processed.

6. The data isolation access method according to claim 1, wherein: The step of screening the to-be-processed text data for access modules according to the accessible range to obtain accessible modules includes: Acquire the functional modules of the target request end, divide the functional modules into access levels, and obtain an access control list for each functional module; Labeling and classifying the text data to be processed according to sensitivity levels to obtain a plurality of labeled text data; Matching the annotated text data with the accessible ranges one by one to obtain a target access range for each annotated text data; Performing module screening on the access control table according to the target access scope to obtain access control information for each annotated text data; An accessible module for each annotated text data is generated according to the access control information.

7. The data isolation access method according to claim 6, wherein: The step of using the accessible module to share the to-be-processed text data to a preset mother terminal and obtaining the shared text data returned by the preset mother terminal includes: Performing desensitization processing on the annotated text data to obtain desensitized text data; Obtaining a preset encapsulation protocol of the mother end, and encapsulating the desensitized text data according to the encapsulation protocol to obtain a standard data message; Sending the standard data message to the accessible module of the preset mother end; Performing integrity check on the standard data message received by the accessible module to obtain an integrity check result; Determine whether the integrity check result is passed; If the integrity check result is a check failure, an abnormality alarm is sent to the preset mother terminal; If the integrity check result is passed, the received standard data message is used as the shared text data.

8. A data isolation access device, characterized in that: The device comprises: A dual-field authentication module is used to receive an access request from a target requester, perform dual-field authentication on the target requester according to the access request, and obtain the identity of the requester; A distinguishing value generating module, configured to generate a data source distinguishing value corresponding to the access request according to the requesting end identity; an access range acquisition module, configured to acquire the to-be-processed text data of the access request and generate different accessible ranges of the to-be-processed text data according to the data source distinguishing value; an access module screening module, configured to screen the access modules of the text data to be processed according to the accessible range, obtain accessible modules, and determine whether the requesting end is a preset sub-end; A child-end sharing module, configured to share the to-be-processed text data with a preset mother-end by using the accessible module if the requesting end is a preset child-end, and obtain the shared text data returned by the preset mother-end; The mother-end sharing module is used to send the text data to be processed to the accessible module if the identity of the requesting end is a preset mother-end, and obtain the shared text data returned by the preset mother-end.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform a data isolation access method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the data isolation access method according to any one of claims 1 to 7 is implemented.

Images