Service data authority control method, terminal equipment and storage medium

Abstract

The invention is suitable for the field of data processing, and discloses a business data authority control method, terminal equipment and a storage medium. The business data permission control method comprises the following steps: determining a filtering field library needing permission control; configuring a filtering condition for each service field in the filtering field library to obtain a condition set; combining each filtering condition in the condition set to obtain a composite condition set; and when a service data processing request is detected, executing an authority control operation on the service data processing request according to the composite condition set. Through the dynamic combination of the condition sets, the authority control can flexibly adapt to the dynamic requirements of organizational structure adjustment, business role change and the like, and the flexibility of the authority control is improved.

Description

Technical Field

[0001] The present invention belongs to the field of data processing, and in particular relates to a method for controlling authority of business data, a terminal device, and a storage medium. Background Art

[0002] Permission control is a core component of ensuring data confidentiality and integrity. Traditional data permission management relies primarily on the role-based access control (RBAC) model. While this achieves a certain degree of permission isolation, it exhibits significant limitations when faced with complex and ever-changing business scenarios.

[0003] Traditional methods typically use a single field to constrain permissions. For example, defining data access boundaries based solely on a single attribute like "department" or "position" fails to meet the requirements for multi-dimensional, cross-functional permission management, resulting in a lack of flexibility in permission control. A new technical approach is needed to address these issues. Summary of the Invention

[0004] In view of this, an embodiment of the present invention provides a method, terminal device and storage medium for permission control of business data, which can solve the problem that related technologies cannot meet the requirements of multi-dimensional cross-permission management and control and the lack of flexibility in permission control.

[0005] A first aspect of the present invention provides a method for controlling permissions of business data, comprising:

[0006] Determine the filter field library that requires permission control;

[0007] Configuring a filtering condition for each business field in the filtering field library to obtain a condition set;

[0008] Combining each filtering condition in the condition set to obtain a composite condition set;

[0009] When a business data processing request is detected, an authority control operation is performed on the business data processing request according to the composite condition set.

[0010] Optionally, in a first implementation of the first aspect of the present invention, the step of configuring a filtering condition for each business field in the filtering field library to obtain a condition set includes:

[0011] Determining, according to the field type of each business field in the filter field library, a conditional configuration corresponding to each business field, wherein the conditional configuration includes a fixed value configuration, a dictionary group configuration, or an SQL fragment configuration;

[0012] According to the condition limitation configuration corresponding to each business field, a filtering condition is configured for each business field to obtain the condition set.

[0013] Optionally, in a second implementation of the first aspect of the present invention, when a business data processing request is detected, the step of performing an authority control operation on the business data processing request according to the composite condition set includes:

[0014] When a business data processing request is detected, extracting a target field set carried by the business data processing request;

[0015] According to the target field set, matching the target filtering condition in the compound condition set;

[0016] Performing an authority control operation on the business data processing request according to the target filtering condition.

[0017] Optionally, in a third implementation of the first aspect of the present invention, the step of matching a target filtering condition in the composite condition set according to the target field set includes:

[0018] Determine a logic type of the service data processing request, where the logic type includes a logical AND and a logical OR;

[0019] Match the target filter condition in the compound condition set according to the logic type and the target field set

[0020] Each filtering condition in the condition set is combined to obtain a composite condition set.

[0021] Optionally, in a fourth implementation of the first aspect of the present invention, when a service data processing request is detected, the step of extracting a target filter field library carried in the service data processing request includes:

[0022] Parsing the SQL statement in the business data processing request to obtain an SQL syntax tree;

[0023] Identify the business fields corresponding to the SQL syntax tree and obtain the target field set.

[0024] Optionally, in a fifth implementation of the first aspect of the present invention, the step of combining each filtering condition in the condition set to obtain a composite condition set includes:

[0025] Combining each filtering condition in the condition set to obtain a condition set to be confirmed;

[0026] If an adjustment instruction is detected, the condition to be confirmed is adjusted in response to the adjustment instruction to obtain the composite condition set.

[0027] Optionally, in a sixth implementation of the first aspect of the present invention, the step of configuring a filtering condition for each business field in the filtering field library to obtain a condition set includes:

[0028] When a change in a business field in the filtering field library is detected, the process returns to the step of configuring a filtering condition for each business field in the filtering field library to obtain a condition set.

[0029] Optionally, in a seventh implementation manner of the first aspect of the present invention, after the step of combining each filtering condition in the condition set to obtain a composite condition set, the method further includes:

[0030] When a change in a business field in the filtering field library is detected, detecting the type of change;

[0031] If the change type is field addition, an incremental update operation is performed on the compound condition set.

[0032] In a second aspect, an embodiment of the present invention provides a terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned method for controlling the authority of business data when executing the computer program.

[0033] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the above-mentioned business data permission control method.

[0034] In a fourth aspect, an embodiment of the present invention provides a computer program product, which, when executed on a terminal device, enables the terminal device to execute the above-mentioned method for controlling the authority of business data.

[0035] Compared with the existing technology, the beneficial effects of the embodiments of the present invention are: multi-dimensional dynamic permission control can be achieved through a configurable filter field library and a composite condition set. Compared with the single field constraint mode of the traditional RBAC model, the filter condition configuration method of cross-combining multiple business fields solves the technical defect of insufficient permission control dimensions in complex business scenarios. Through the dynamic combination of condition sets, permission control can flexibly adapt to dynamic needs such as organizational structure adjustments and business role changes, thereby improving the flexibility of permission control. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1A schematic diagram of an embodiment of a method for controlling permissions of business data according to an embodiment of the present invention;

[0038] Figure 2 This is a schematic diagram of a specific embodiment of step S102 of the method for controlling authority of business data in an embodiment of the present invention;

[0039] Figure 3 This is a schematic diagram of a specific embodiment of step S104 of the method for controlling authority of business data in an embodiment of the present invention;

[0040] Figure 4 This is a schematic diagram of a specific embodiment of step S1042 of the method for controlling authority of business data in an embodiment of the present invention;

[0041] Figure 5 Schematic diagram of a terminal device in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are protected by the present invention.

[0043] It should be noted that the terms "include", "comprising" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, terminal, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices. In the claims, specification and drawings of the present invention, relational terms such as "first" and "second" are merely used to distinguish one entity / operation / object from another entity / operation / object, and do not necessarily require or imply any such real-time relationship or order between these entities / operations / objects.

[0044] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute a separate or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0045] Permission control is a core component of ensuring data confidentiality and integrity. Traditional data permission management relies primarily on the role-based access control (RBAC) model. While this achieves a certain degree of permission isolation, it exhibits significant limitations when faced with complex and ever-changing business scenarios.

[0046] Traditional methods typically use a single field to constrain permissions. For example, defining data access boundaries based solely on a single attribute like "department" or "position" fails to meet the requirements for multi-dimensional, cross-functional permission management, resulting in a lack of flexibility in permission control. A new technical approach is needed to address these issues.

[0047] In view of this, an embodiment of the present invention provides a permission control method, terminal device and storage medium for business data, which can realize multi-dimensional dynamic permission control through a configurable filter field library and a composite condition set. Compared with the single field constraint mode of the traditional RBAC model, the filtering condition configuration method of the cross-combination of multiple business fields solves the technical defect of insufficient permission control dimensions in complex business scenarios. Through the dynamic combination of condition sets, permission control can flexibly adapt to dynamic needs such as organizational structure adjustments and business role changes, thereby improving the flexibility of permission control.

[0048] In order to illustrate the technical solution of the present invention, specific embodiments are provided below.

[0049] Figure 1 The following is a flow chart showing a method for controlling the authority of business data according to an embodiment of the present invention. The method can be applied to a terminal device, such as a mobile phone, tablet computer, laptop computer, ultra-mobile personal computer (UMPC), or netbook.

[0050] Specifically, the above-mentioned business data authority control method may include the following steps S101 to S104.

[0051] Step S101: Determine a filter field library that requires permission control.

[0052] In an embodiment of the present invention, the terminal device (the permission control device for business data) identifies key data fields that require permission control based on business rules, such as user attributes, organizational structure, or business tags. Through data dictionary parsing or manual configuration, fields involving sensitive data range control are included in a dynamically maintained filter field library. This library supports the addition, deletion, modification, and query of fields, so that the permission control model can adapt to changes in the business data structure.

[0053] Step S102: Configure a filtering condition for each business field in the filtering field library to obtain a condition set.

[0054] In this embodiment of the present invention, for each business field in the filter field library, the system automatically generates a strategy for matching appropriate filtering conditions based on its data type and business characteristics. For example, numeric fields can be configured using interval thresholds, enumeration fields support selection from preset dictionary groups, and complex business logic can be dynamically injected using SQL snippets. All independently configured condition items form an extensible condition set, providing atomic rule units for subsequent complex logic combinations.

[0055] Step S103: Combine each filter condition in the condition set to obtain a composite condition set.

[0056] In this embodiment of the present invention, a logical combination operation is performed on each independent filtering condition in a condition set, generating a multi-dimensional, cross-composite condition set based on preset AND and OR logical operators. This process supports automated full permutation and combination or generates valid condition combinations based on priority rules, while retaining a manual adjustment mechanism to optimize the logical coupling relationship between conditions, ultimately forming a permission control rule network covering multiple scenarios.

[0057] Step S104: When a business data processing request is detected, a permission control operation is performed on the business data processing request according to a composite condition set.

[0058] In an embodiment of the present invention, when a data operation request is detected, the set of fields involved in the request is immediately parsed and the corresponding filtering rules are matched against the composite condition set. By logically comparing the request parameters with the target filtering conditions, a dynamic determination is made as to whether the request satisfies the preset permission constraints. An interception mechanism is triggered for unauthorized operations, while rewrite instructions with additional filtering conditions are generated for legitimate requests, ensuring that data access strictly adheres to the permission policy.

[0059] Compared with the existing technology, the beneficial effects of the embodiments of the present invention are: multi-dimensional dynamic permission control can be achieved through a configurable filter field library and a composite condition set. Compared with the single field constraint mode of the traditional RBAC model, the filter condition configuration method of cross-combining multiple business fields solves the technical defect of insufficient permission control dimensions in complex business scenarios. Through the dynamic combination of condition sets, permission control can flexibly adapt to dynamic needs such as organizational structure adjustments and business role changes, thereby improving the flexibility of permission control.

[0060] Traditional permission control methods rely on static constraints on a single field. To allow access to multiple departments simultaneously, these methods require hard-coding multiple "OR" conditions. To dynamically calculate data visibility based on user rank, these methods lack the ability to inject custom SQL. Furthermore, as business field types expand, these methods require redeveloping the condition generation module. Based on this, the present invention proposes an alternative embodiment.

[0061] Reference Figure 2 , Figure 2 This is a schematic diagram of a specific embodiment of step S102 of the method for controlling the authority of business data in an embodiment of the present invention. Step S102 also includes the following specific implementation methods.

[0062] Step S1021 : determining the conditional configuration corresponding to each business field according to the field type of each business field in the filter field library. The conditional configuration includes a fixed value configuration, a dictionary group configuration, or an SQL fragment configuration.

[0063] In the embodiments of the present invention, the business fields in the filter field library are analyzed for type characteristics to identify the data structure characteristics of each field (such as numeric type, enumeration type, or association type). Through metadata parsing or a predefined rule library, the applicable configuration mode of the field is determined. For example, numeric fields are marked as range-limited, enumeration fields are marked as dictionary group, and association fields are marked as dynamic SQL logic.

[0064] Step S1022: According to the conditional configuration corresponding to each business field, a filtering condition is configured for each business field to obtain a condition set.

[0065] In an embodiment of the present invention, a strategy is generated based on the corresponding conditions matching the field type, where:

[0066] Fixed value configuration: For static business rules (such as status fields), generate "field = value" equation filter conditions through a preset value list;

[0067] Dictionary group configuration: For multi-select enumeration scenarios (such as department permissions), a pre-loaded dictionary group is used to generate a set filter condition such as "field IN (value 1, value 2)";

[0068] SQL fragment configuration: For cross-table associations or complex calculation scenarios (such as data grading), dynamic SQL conditional expressions are directly injected, supporting subqueries or function operations.

[0069] Based on the above strategy, a separate condition unit is generated for each field and stored in a structured manner according to the field identifier. For example, fields configured with a dictionary group will generate an IN condition template with placeholders, while fields configured with an SQL fragment will retain the original logical expression. All atomic conditions form a unified condition set, providing standardized input for subsequent composite condition construction.

[0070] In this embodiment of the present invention, by distinguishing field types and matching corresponding configuration modes, the limitations of single condition generation in traditional permission models are overcome. Fixed value configuration ensures the execution efficiency of static rules, dictionary group configuration enables fast matching of multi-value enumerations, and SQL fragment configuration enables flexible expression of complex business logic. The hierarchical configuration mechanism enables the permission model to accurately adapt to the business characteristics of different fields, significantly improving the maintainability and scenario coverage of permission rules.

[0071] Traditional permission control methods typically use static pre-authorization or post-result set filtering strategies. Role-based, coarse-grained authorization cannot accurately match the field-level operational intent in dynamic business requests, resulting in a misalignment between the scope of authorization and actual needs. In data query scenarios, executing a full query first and then truncating the result set based on permissions can lead to security risks due to the temporary exposure of sensitive data during transmission. Based on this, the present invention proposes an alternative embodiment.

[0072] Reference Figure 3 , Figure 3 This is a schematic diagram of a specific embodiment of step S104 of the method for controlling the authority of business data in an embodiment of the present invention. Step S104 also includes the following specific implementation methods.

[0073] Step S1041 : When a business data processing request is detected, a target field set carried in the business data processing request is extracted.

[0074] In an embodiment of the present invention, when a business data processing request is detected, the request content is structured and parsed. By analyzing the request parameters or data operation instructions (such as SQL statements or API call parameters), the specific data operation targets involved in the request are extracted, including but not limited to query fields, update fields, or deletion conditions, to form a complete target field set. This set identifies the business data dimensions that the current request attempts to access or modify.

[0075] Step S1042: Match the target filtering condition in the composite condition set according to the target field set.

[0076] In this embodiment of the present invention, based on the extracted target field set, multi-dimensional rule matching is performed within a pre-generated composite condition set. By comparing the target field with the field combinations involved in the composite condition, all filter conditions relevant to the current request are screened. For example, if the request involves the "Department" and "Rank" fields, composite conditions containing both fields are matched, ensuring that the permission rules accurately correspond to the intended operation.

[0077] Step S1043: Perform permission control operations on the business data processing request according to the target filtering conditions.

[0078] In this embodiment, permission control is implemented in stages based on the matching target filter conditions. For example, the filter conditions are injected into the data query logic to generate query statements with permission constraints, pre-determining the data range accessible to users. For data modification requests, the modification permissions of the target fields are verified, and if the modification permissions involve unauthorized fields, the operation is directly blocked. Actual data processing is only performed on requests that pass verification.

[0079] In this embodiment, a priori data scope determination mechanism is used to dynamically generate permission-constrained data operation logic before executing business data processing operations. Compared to the crude control methods of "execute first, filter later" or "return all data and truncate part of it" in traditional methods, this solution precisely defines the scope of operable data through a set of composite conditions before data processing, effectively avoiding the transmission of invalid data and wasting computing resources.

[0080] Traditional permission control methods typically use fixed logic types. When a business requires users to access data through multiple paths (such as "department" or "project team"), traditional methods force the use of logical ANDs, resulting in no valid paths. To cover different logical scenarios, a large number of independent rules must be pre-configured, resulting in a bloated permission library and a surge in maintenance costs. Based on this, the present invention proposes an alternative embodiment.

[0081] Reference Figure 4 , Figure 4 This is a schematic diagram of a specific embodiment of step S1042 of the method for controlling the authority of business data in an embodiment of the present invention. Step S1042 also includes the following specific implementation methods.

[0082] Step S10421: Determine the logic type of the business data processing request. The logic type includes logical AND and logical OR.

[0083] In an embodiment of the present invention, the context semantics of the business data processing request is parsed, the operation type (such as data query, batch update) and the associated business rules are identified, and the logical combination type required by the request is determined:

[0084] Logical AND: Applicable to high-security scenarios where multiple conditions must be met simultaneously (e.g., financial data must meet the conditions "Department = Finance Department" and "Position Level ≥ Manager");

[0085] Logical OR: Applicable to flexible scenarios where multiple authorization paths coexist (such as allowing access to data for "Department = Sales Department" or "Project Group = Core Project").

[0086] Step S10422: Match the target filtering condition in the composite condition set according to the logic type and the target field set.

[0087] In this embodiment of the present invention, filter conditions that simultaneously include all fields in the target field set are extracted from the composite condition set to form strict matching constraint rules. Filter conditions associated with any field in the target field set within the composite condition set are retrieved to generate multi-path access rules. Through intelligent adaptation of logical operators, the selected condition set is highly consistent with the operational intent of the business request.

[0088] Step S10423: Combine each filter condition in the condition set to obtain a composite condition set.

[0089] In this embodiment of the present invention, the matched target filtering conditions are combined according to logical types. For example, the "AND" connector is used to generate cross-constraint conditions (e.g., Department = Sales Department AND Position = Supervisor); the "OR" connector is used to generate parallel authorization conditions (e.g., Project Group = Group A OR Project Status = Emergency). The resulting composite condition set serves as the core of permission control and is applied in real time to the current business request.

[0090] In an embodiment of the present invention, the limitation of a single logical type in the traditional permission model is broken through by dynamically determining the logical type of the business request and adapting the combination rules. For example, in a strictly controlled scenario where multiple conditions need to be met at the same time, accurate data delineation can be achieved through logic and combination; and in a scenario where flexible authorization is required, the scope of legal operations can be expanded through logic or combination. The logic-driven dynamic combination mechanism enables permission rules to intelligently adjust the constraint strength according to the business scenario, which not only avoids business interruption caused by excessive interception, but also effectively prevents the risk of data leakage caused by permission generalization, significantly improving the flexibility and security of permission control in complex business scenarios.

[0091] Traditional permission control methods directly use database physical field names for rule matching when parsing data operation requests. This requires manual maintenance of the mapping relationship between field names and business meanings, and is prone to misjudgment due to field renaming or missing annotations. Based on this, the present invention proposes an alternative embodiment.

[0092] Step S1041 also includes the following specific implementation methods.

[0093] Step S10411: parse the SQL statement in the business data processing request to obtain an SQL syntax tree.

[0094] In an embodiment of the present invention, after capturing a business data processing request, the SQL statements embedded in the request are subjected to lexical analysis and grammatical parsing. The original statement is converted into a structured syntax tree (AST) by the SQL parsing engine, fully preserving semantic information such as operation types (e.g., SELECT, UPDATE), table relationships, and conditional expressions. During this process, explicit field references (e.g., WHERE department_id=1) and implicitly associated fields (e.g., foreign key fields in JOIN clauses) in the statement are identified and recorded.

[0095] Step S10412: Identify the business fields corresponding to the SQL syntax tree and obtain a target field set.

[0096] In the embodiment of the present invention, based on the generated syntax tree, each child node is traversed to extract all the data table fields involved. Through the preset business metadata mapping table, the database physical fields are converted into corresponding business field identifiers, so that the subsequent permission rule matching is consistent with the semantics of the business scenario.

[0097] De-duplicate and prioritize the parsed business fields. For example, identify key fields that directly affect the data range and mark them as high priority; identify fields derived through table joins or calculations and mark them as secondary validation fields; and extract the fields to be returned in the SELECT clause as the final output constraints for permission verification. Ultimately, a complete target field set is formed.

[0098] In the embodiment of the present invention, the alignment of permission control rules and data operation intentions is achieved through semantic SQL parsing and business field mapping. Compared with the traditional method based on keyword fuzzy matching or simple field name interception, syntax tree parsing can improve the integrity and accuracy of field extraction, and can effectively avoid permission control loopholes caused by field omissions. At the same time, the business semantic mapping capability decouples the underlying data table structure from the business rules, allowing the permission model to seamlessly adapt to changes in the database table structure, thereby improving the cross-environment portability of the permission system.

[0099] Traditional permission control methods rely on manually writing compound conditions in the condition combination stage, which is difficult to deal with the combinatorial explosion problem caused by the surge in the number of fields and is prone to rule omissions or contradictions. Based on this, the present invention proposes an optional embodiment.

[0100] Step S103 also includes the following specific implementation methods.

[0101] Step S1031: Combine each filtering condition in the condition set to obtain a condition set to be confirmed.

[0102] In an embodiment of the present invention, a full combination operation is performed on all independent filter conditions in a condition set based on predefined logical operator priorities and combination rules. By traversing all possible field combinations, a set of conditions to be confirmed containing all potential permission rules is generated. This can be achieved by pruning redundant conditions or merging similar logic to ensure that the generated combination conditions are deduplicated.

[0103] Step S1032: If an adjustment instruction is detected, the conditions to be confirmed are adjusted in response to the adjustment instruction to obtain a composite condition set.

[0104] In an embodiment of the present invention, after the set of conditions to be confirmed is generated, the rule review process is triggered, and the conditions to be confirmed are displayed in an interactive tree structure, supporting administrators to filter key rules according to business scenarios; the administrator's enabling operations, disabling operations, logical operator modifications or condition weight adjustment actions on specific conditions are monitored to generate structured adjustment instructions.

[0105] Based on the received adjustment instructions, real-time rule optimization is performed. If it is a conditional deletion instruction, the filter conditions marked as invalid or conflicting are removed; if it is a logic correction instruction, the combination relationship between conditions is modified according to the instruction.

[0106] In the embodiment of the present invention, through the condition combination mechanism of human-machine collaboration, the business adaptability of the permission model can be significantly improved while ensuring the efficiency of rule generation.

[0107] Optionally, when a change in a business field in the filter field library is detected, the process returns to the step of configuring filter conditions for each business field in the filter field library to obtain a condition set. Specifically, the metadata changes of the filter field library are continuously monitored, and field addition, deletion, and modification operations are detected in real time through database triggers or file monitoring mechanisms. When a business field changes, the type of change event, the field identifiers involved, and the associated business attributes are captured. Based on the type of field change detected, the rule reconstruction process is triggered, and the filter condition configuration process is re-executed. This solves the problem of lagging rule updates in the traditional permission model.

[0108] Optionally, when a change is detected in a business field in the filter field library, the type of change is detected; if the change type is a field addition, an incremental update operation is performed on the composite condition set. Specifically, when a new field is added to the filter field library, only the conditions for the newly added part are generated and combined, rather than the entire composite condition set being reconstructed. The targeted update strategy can significantly reduce the computing resource consumption required for rule refreshes and is suitable for high-frequency field expansion scenarios. At the same time, incremental updates avoid unnecessary changes to existing rules and significantly improve response efficiency in highly dynamic environments.

[0109] like Figure 5FIG2 is a schematic diagram of a terminal device provided in an embodiment of the present invention. The terminal device 500 may include: a processor 501, a memory 502, and a computer program 503 stored in the memory 502 and executable on the processor 501, such as a business data permission control program. When the processor 501 executes the computer program 503, the steps in the aforementioned business data permission control embodiments are implemented.

[0110] The computer program can be divided into one or more modules / units, which are stored in the memory 502 and executed by the processor 501 to implement the present invention. One or more modules / units can be a series of computer program instruction segments that can perform specific functions. These instruction segments are used to describe the execution process of the computer program in the terminal device.

[0111] The terminal device may include, but is not limited to, a processor 501 and a memory 502. Those skilled in the art will appreciate that Figure 5 It is only an example of a terminal device and does not constitute a limitation of the terminal device. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the terminal device may also include input and output devices, network access devices, buses, etc.

[0112] The processor 501 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0113] The memory 502 can be an internal storage unit of the terminal device, such as a hard drive or memory of the terminal device. The memory 502 can also be an external storage device of the terminal device, such as a plug-in hard drive, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, etc. equipped with the terminal device. Furthermore, the memory 502 can include both an internal storage unit of the terminal device and an external storage device. The memory 502 is used to store computer programs and other programs and data required by the terminal device. The memory 502 can also be used to temporarily store data that has been output or is about to be output.

[0114] It should be noted that, for the convenience and brevity of description, the structure of the above-mentioned terminal device can also refer to the specific description of the structure in the method embodiment, which will not be repeated here.

[0115] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method for controlling the authority of business data can be implemented.

[0116] An embodiment of the present invention provides a computer program product. When the computer program product is run on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned service data authority control method when executing the computer program product.

[0117] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0118] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0119] In the embodiments provided herein, it should be understood that the disclosed terminal devices and methods can be implemented in other ways. For example, the terminal device embodiments described above are merely illustrative. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection via some interface, device, or unit, which may be electrical, mechanical, or other means.

[0120] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0121] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0122] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the process in the above-mentioned embodiment method, and can also be completed by a computer program to instruct the relevant hardware. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0123] The above embodiments are intended only to illustrate the technical solutions of the present invention and are not intended to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may be modified or some of the technical features thereof may be replaced with equivalents. Such modifications or replacements do not deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention and are therefore intended to be included within the scope of protection of the present invention.

Claims

1. A method for controlling the authority of business data, characterized in that: include: Determine the filter field library that requires permission control; Configuring a filtering condition for each business field in the filtering field library to obtain a condition set; Combining each filtering condition in the condition set to obtain a composite condition set; When a business data processing request is detected, an authority control operation is performed on the business data processing request according to the composite condition set.

2. The method for controlling the authority of business data according to claim 1, wherein: The step of configuring a filtering condition for each business field in the filtering field library to obtain a condition set includes: Determining, according to the field type of each business field in the filter field library, a conditional configuration corresponding to each business field, wherein the conditional configuration includes a fixed value configuration, a dictionary group configuration, or an SQL fragment configuration; According to the condition limitation configuration corresponding to each business field, a filtering condition is configured for each business field to obtain the condition set.

3. The method for controlling the authority of business data according to claim 1, wherein: When a business data processing request is detected, the step of performing an authority control operation on the business data processing request according to the composite condition set includes: When a business data processing request is detected, extracting a target field set carried by the business data processing request; According to the target field set, matching the target filtering condition in the compound condition set; Performing an authority control operation on the business data processing request according to the target filtering condition.

4. The method for controlling the authority of business data according to claim 3, wherein: The step of matching a target filtering condition in the composite condition set according to the target field set includes: Determine a logic type of the service data processing request, where the logic type includes a logical AND and a logical OR; Matching a target filtering condition in the compound condition set according to the logic type and the target field set; Each filtering condition in the condition set is combined to obtain a composite condition set.

5. The method for controlling the authority of business data according to claim 3, wherein: When a business data processing request is detected, the step of extracting a target filtering field library carried in the business data processing request includes: Parsing the SQL statement in the business data processing request to obtain an SQL syntax tree; Identify the business fields corresponding to the SQL syntax tree and obtain the target field set.

6. The method for controlling the authority of business data according to claim 1, wherein: The step of combining each filtering condition in the condition set to obtain a composite condition set includes: Combining each filtering condition in the condition set to obtain a condition set to be confirmed; If an adjustment instruction is detected, the condition to be confirmed is adjusted in response to the adjustment instruction to obtain the composite condition set.

7. The method for controlling the authority of business data according to claim 1, wherein: The step of configuring a filtering condition for each business field in the filtering field library to obtain a condition set includes: When a change in a business field in the filtering field library is detected, the process returns to the step of configuring a filtering condition for each business field in the filtering field library to obtain a condition set.

8. The method for controlling the authority of business data according to claim 7, characterized in that: After the step of combining each filtering condition in the condition set to obtain a composite condition set, the method further includes: When a change in a business field in the filtering field library is detected, detecting the type of change; If the change type is field addition, an incremental update operation is performed on the compound condition set.

9. A terminal device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the method for controlling the authority of business data according to any one of claims 1 to 8 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the business data authority control method according to any one of claims 1 to 8 are implemented.

Images