Query processing method and device for preventing level unauthorized, electronic equipment and storage medium

Abstract

The invention discloses a query processing method and device for preventing level unauthorized, electronic equipment and a storage medium. The method comprises the following steps: receiving a query request sent by a user side through a front query interface, and determining a query result based on a screening condition in the query request; adding the unique identifier of the query result to a Bloom filter corresponding to the front query interface, and returning the query result and the unique identifier of the query result to the user side; when a processing request for the query result sent by a user side through a rear operation interface is received, judging whether a unique identifier carried in the processing request exists in the Bloom filter or not; and if yes, processing based on the processing operation in the processing request. Under the condition that the database does not need to be inquired, the level exceeding can be prevented, the number of times of database inquiry is reduced, and therefore the database pressure is reduced.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a query processing method, device, electronic device and storage medium for preventing horizontal unauthorized access. Background Art

[0002] The operating logic of existing backend management systems is usually to first query according to the filter conditions. The query results may be single or multiple, and then the results can be viewed, edited, deleted, and other processing operations. When viewing, editing, deleting, and other processing operations, there are generally horizontal override controls.

[0003] The current mainstream horizontal unauthorized access control method is to determine whether the user has the permission to operate the record by querying the database in real time during access. However, this method will result in an additional database query operation when performing operations such as viewing details, editing, and deleting, which increases the pressure on the database. Summary of the Invention

[0004] The present invention provides a query processing method, device, electronic device and storage medium for preventing horizontal unauthorized access, which realizes horizontal unauthorized access control and solves the problem that the existing horizontal unauthorized access control method will increase the database pressure due to the increase in the number of database queries.

[0005] According to one aspect of the present invention, a query processing method for preventing horizontal unauthorized access is provided, which is applied to a backend server and includes:

[0006] Receive a query request sent by a user through a front-end query interface, and determine a query result based on a screening condition in the query request;

[0007] Adding the unique identifier of the query result to the Bloom filter corresponding to the pre-query interface, and returning the query result and the unique identifier of the query result to the user terminal;

[0008] When receiving a processing request for the query result sent by the user end through the post-operation interface, it is determined whether the Bloom filter has a unique identifier carried in the processing request; if so, processing is performed based on the processing operation in the processing request.

[0009] According to another aspect of the present invention, a query processing device for preventing horizontal unauthorized access is provided, which is applied to a backend server and includes:

[0010] A pre-query module is used to receive a query request sent by a user terminal through a pre-query interface and determine a query result based on the screening conditions in the query request;

[0011] an identification adding module, configured to add the unique identification of the query result to the Bloom filter corresponding to the pre-query interface, and return the query result and the unique identification of the query result to the user terminal;

[0012] The post-processing module is used to determine whether the unique identifier carried in the processing request exists in the Bloom filter when receiving a processing request for the query result sent by the user end through the post-operation interface; if so, perform processing based on the processing operation in the processing request.

[0013] According to another aspect of the present invention, an electronic device is provided, comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the query processing method for preventing horizontal authority overstepping according to any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions for enabling a processor to implement the query processing method for preventing horizontal unauthorized access according to any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention is to receive a query request sent by a user terminal through a front-end query interface, determine the query result based on the screening conditions in the query request; add the unique identifier of the query result to the Bloom filter corresponding to the front-end query interface, and return the query result and the unique identifier of the query result to the user terminal; when receiving a processing request for the query result sent by the user terminal through a back-end operation interface, determine whether the unique identifier carried in the processing request exists in the Bloom filter; if so, process it based on the processing operation in the processing request. The present invention uses a Bloom filter to identify the unique identifier to achieve horizontal unauthorized control, and at the same time solves the problem that the existing horizontal unauthorized control method will increase the database pressure due to the increase in the number of database queries. When there is no need to query the database, horizontal unauthorized control can be prevented, the number of database queries can be reduced, and the database pressure can be reduced.

[0019] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 This is a flowchart of a query processing method for preventing horizontal unauthorized access provided by the first embodiment of the present invention;

[0022] Figure 2 This is a flowchart of a query processing method for preventing horizontal unauthorized access provided by the second embodiment of the present invention;

[0023] Figure 3 This is a flowchart of a query processing method for preventing horizontal unauthorized access provided by the third embodiment of the present invention;

[0024] Figure 4 1 is a schematic diagram of the structure of a query processing device for preventing horizontal unauthorized access provided by a fourth embodiment of the present invention;

[0025] Figure 5 This is a structural diagram of an electronic device provided in Example 5 of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Before specifically introducing the embodiments of the present invention, it is first necessary to note that most of the current backend management systems have horizontal override control. If there is no horizontal override control, the following problems will occur. Taking business personnel and customers as an example, it is assumed that business personnel A has three customers AA, AB and AC, and business personnel B has two customers BB and BC; then the system will restrict business personnel A to only view, edit, delete and other operations on customers AA, AB, AC, and business personnel B to only view, edit, delete and other operations on customers BB and BC; suppose one day business personnel B knows the unique identifier of business personnel A's customer AA in the system, such as an ID number, and business personnel B initiates detailed view, editing, deletion and other operations on customer AA through specific technical means (such as modifying the request message and reviewing elements). In this way, business personnel B operates on customer AA, which he should not serve. This is an infringement on both business personnel A and customer AA, that is, an act of horizontal override. Therefore, horizontal privilege escaping is more important in the current backend management system. The current mainstream method is to use real-time database query during access to determine whether the user has the permission to operate the record. For example, when business person B operates customer AA, he will first query the database to see if customer AA is under the name of business person B. If not, the operation will be rejected. This method will result in an additional database query operation for operations such as viewing, editing, and deleting details, which increases the pressure on the database.

[0029] Example 1

[0030] Figure 1 This is a flowchart of a query processing method for preventing horizontal unauthorized access provided by the first embodiment of the present invention. This embodiment is applicable to preventing horizontal unauthorized access during the query processing process of the background management system. The method can be executed by a query processing device for preventing horizontal unauthorized access. The query processing device for preventing horizontal unauthorized access can be implemented in the form of hardware and / or software. The query processing device for preventing horizontal unauthorized access can be configured in the back-end server. Figure 1 As shown, the method includes:

[0031] S110: Receive a query request sent by a user terminal through a front-end query interface, and determine a query result based on a screening condition in the query request.

[0032] S120: Add the unique identifier of the query result to the Bloom filter corresponding to the pre-query interface, and return the query result and the unique identifier of the query result to the user terminal.

[0033] S130. When receiving a processing request for the query result sent by the user end through the post-operation interface, determine whether the Bloom filter has the unique identifier carried in the processing request; if so, perform processing based on the processing operation in the processing request.

[0034] Among them, the unique identifier is used to uniquely identify the query result. Specifically, the unique identifier can be a unique field, such as a primary key, an ID number, etc. The Bloom filter is a random data structure with high space efficiency, which is used to determine whether an element may belong to a set. The Bloom filter has a feature that it determines that something that may exist may not necessarily exist, and it determines that something that does not exist must not exist. In an embodiment of the present invention, in the pre-query stage, the user initiates a query through the pre-query interface, the back-end server obtains the query result according to the screening conditions, and stores the unique identifier of the query result in the Bloom filter, and returns the query result and the unique identifier of the query result to the user end. In the post-operation stage, the user performs an operation on the query result in the operation interface of the user end, and sends a processing request for the query result to the back-end server through the post-operation interface. The back-end server receives the processing request, and the operation request carries the unique identifier returned during the query. The validity of the unique identifier is quickly verified through the Bloom filter, and it is determined whether the unique identifier carried in the processing request exists in the Bloom filter. If it exists, the operation is executed and the processing is performed based on the processing operation in the processing request.

[0035] Based on the above embodiment, optionally, the method further includes: if the unique identifier carried in the processing request does not exist in the Bloom filter, then the processing operation in the processing request has horizontal unauthorized behavior, and the processing request is rejected.

[0036] In an embodiment of the present invention, if the unique identifier carried in the processing request does not exist in the Bloom filter, it indicates that the unique identifier is invalid, the processing operation in the processing request has horizontal unauthorized behavior, and the operation in the processing request is refused to be executed.

[0037] The technical solution of this embodiment is to receive a query request sent by the user end through the front query interface, determine the query result based on the screening conditions in the query request; add the unique identifier of the query result to the Bloom filter corresponding to the front query interface, and return the query result and the unique identifier of the query result to the user end; when receiving a processing request for the query result sent by the user end through the back operation interface, determine whether the unique identifier carried in the processing request exists in the Bloom filter; if so, process it based on the processing operation in the processing request. The present invention uses a Bloom filter to identify the unique identifier to achieve horizontal unauthorized control, and at the same time solves the problem that the existing horizontal unauthorized control method will increase the database pressure due to the increase in the number of database queries. When there is no need to query the database, horizontal unauthorized control can be prevented, the number of database queries can be reduced, and the database pressure can be reduced.

[0038] Example 2

[0039] Figure 2 This is a flowchart of a query processing method for preventing horizontal overreach provided by the second embodiment of the present invention. Based on the above embodiments, this embodiment optionally includes the query request carrying a session identifier; adding the unique identifier of the query result to the Bloom filter corresponding to the pre-query interface, including: reading session information based on the session identifier, determining the Bloom filter corresponding to the pre-query interface based on the session information; adding the unique identifier of the query result to the Bloom filter corresponding to the pre-query interface. Figure 2 As shown, the method includes:

[0040] S210: Receive a query request sent by a user terminal through a front-end query interface, and determine a query result based on a screening condition in the query request; the query request carries a session identifier.

[0041] S220. Read session information based on the session identifier, and determine the Bloom filter corresponding to the front query interface based on the session information; add the unique identifier of the query result to the Bloom filter corresponding to the front query interface, and return the query result and the unique identifier of the query result to the user terminal.

[0042] The session identifier is used to locate and query session information, thereby determining the Bloom filter bound to the session information. In an embodiment of the present invention, the session identifier is parsed from the query request and used as a key to query the distributed cache for session information. Within the session information, the Bloom filter corresponding to the pre-query interface can be located using a key combination of interface name + user. Furthermore, the unique identifier of the query result is added to the Bloom filter corresponding to the pre-query interface, and the query result and its unique identifier are returned to the user.

[0043] In some embodiments, optionally, before determining the Bloom filter corresponding to the front query interface based on the session information, the method further includes: if the session information is not bound to the Bloom filter corresponding to the front query interface, creating a new Bloom filter and binding the Bloom filter to the session information.

[0044] In an embodiment of the present invention, the existence of the Bloom filter is checked. If the session information is not bound to the Bloom filter corresponding to the front-end query interface, then this query request is the first request, a new Bloom filter is created, and the unique identifier of the query result is added to the Bloom filter, and the Bloom filter is set to the session information.

[0045] In some embodiments, if the backend is deployed in a distributed manner, the session information is centrally stored in a distributed cache. The Bloom filter can be serialized and then set to the session information. When retrieving the Bloom filter from the user session information, it is first deserialized into a Bloom filter object.

[0046] S230. When receiving a processing request for the query result sent by the user end through the post-operation interface, determine whether the Bloom filter has the unique identifier carried in the processing request; if so, perform processing based on the processing operation in the processing request.

[0047] In some embodiments, the method may further include: when the user logs out, destroying the session information and the Bloom filter bound to the session information. The session information and Bloom filter are simultaneously cleared to prevent unauthorized access caused by residual information.

[0048] Example 3

[0049] Figure 3 This is a flowchart of a query processing method for preventing horizontal overreach provided by the third embodiment of the present invention. Based on the above embodiments, this embodiment optionally further includes: setting an expiration time threshold for the Bloom filter, and destroying the Bloom filter when the time from the creation time of the Bloom filter to the current time exceeds the expiration time threshold. Figure 3As shown, the method includes:

[0050] S310: Receive a query request sent by a user terminal through a front-end query interface, and determine a query result based on a screening condition in the query request.

[0051] S320: Add the unique identifier of the query result to the Bloom filter corresponding to the pre-query interface, and return the query result and the unique identifier of the query result to the user terminal.

[0052] S330: Set an expiration time threshold for the Bloom filter, and when the time from the creation time of the Bloom filter to the current time exceeds the expiration time threshold, destroy the Bloom filter.

[0053] In an embodiment of the present invention, if a user does not perform post-query operations for a long time after completing a pre-query operation, an automatic expiration timer can be set for the Bloom filter to prevent it from occupying memory for a long time. Specifically, a Bloom filter expiration threshold is set. When the time from the Bloom filter's creation time to the current time exceeds the expiration threshold, the Bloom filter is destroyed. By setting the Bloom filter expiration threshold, the Bloom filter is destroyed promptly, preventing it from occupying memory for a long time. Furthermore, timely destruction of the Bloom filter prevents others from using the user terminal to perform post-query operations on the query results.

[0054] S340. When receiving a processing request for the query result sent by the user end through the post-operation interface, determine whether the Bloom filter exists; if the Bloom filter exists, determine whether the Bloom filter contains the unique identifier carried in the processing request; if so, perform processing based on the processing operation in the processing request.

[0055] In an embodiment of the present invention, a Bloom filter will be destroyed due to exceeding the expiration time threshold, so it is necessary to detect the existence of the Bloom filter. If the Bloom filter exists, it is further determined based on the Bloom filter whether the unique identifier carried in the processing request is in the Bloom filter. If so, it indicates that there is no horizontal unauthorized behavior, and processing is performed based on the processing operation in the processing request.

[0056] S350: If the Bloom filter does not exist, then the processing operation in the processing request involves horizontal unauthorized behavior, and the processing request is rejected.

[0057] Example 4

[0058] Figure 4 This is a schematic diagram of the structure of a query processing device for preventing horizontal overreach provided by the fourth embodiment of the present invention. Figure 4 As shown, the device is applied to a back-end server and includes:

[0059] The pre-query module 410 is configured to receive a query request sent by a user terminal through a pre-query interface and determine a query result based on a screening condition in the query request;

[0060] An identifier adding module 420 is configured to add the unique identifier of the query result to the Bloom filter corresponding to the pre-query interface, and return the query result and the unique identifier of the query result to the user terminal;

[0061] The post-processing module 430 is used to determine whether the unique identifier carried in the processing request exists in the Bloom filter when receiving a processing request for the query result sent by the user end through the post-operation interface; if so, perform processing based on the processing operation in the processing request.

[0062] The technical solution of this embodiment is to receive a query request sent by the user end through the front query interface, determine the query result based on the screening conditions in the query request; add the unique identifier of the query result to the Bloom filter corresponding to the front query interface, and return the query result and the unique identifier of the query result to the user end; when receiving a processing request for the query result sent by the user end through the back operation interface, determine whether the unique identifier carried in the processing request exists in the Bloom filter; if so, process it based on the processing operation in the processing request. The present invention uses a Bloom filter to identify the unique identifier to achieve horizontal unauthorized control, and at the same time solves the problem that the existing horizontal unauthorized control method will increase the database pressure due to the increase in the number of database queries. When there is no need to query the database, horizontal unauthorized control can be prevented, the number of database queries can be reduced, and the database pressure can be reduced.

[0063] Based on the above embodiment, optionally, the identification adding module 420 is used to read the session information based on the session identifier, determine the Bloom filter corresponding to the front query interface based on the session information; and add the unique identification of the query result to the Bloom filter corresponding to the front query interface.

[0064] Based on the above embodiment, optionally, the device further includes a Bloom filter creation module, which is used to create a new Bloom filter if the session information is not bound to the Bloom filter corresponding to the pre-query interface, and bind the Bloom filter to the session information.

[0065] Based on the above embodiment, optionally, the device also includes a Bloom filter expiration detection module, which is used to set an expiration time threshold of the Bloom filter. When the time from the creation time of the Bloom filter to the current time exceeds the expiration time threshold, the Bloom filter is destroyed.

[0066] Based on the above embodiment, optionally, the device also includes a Bloom filter existence detection module for determining whether the Bloom filter exists. If the Bloom filter does not exist, there is horizontal overreach in the processing operation in the processing request, and the processing request is rejected.

[0067] Based on the above embodiment, optionally, the post-processing module 430 is further configured to reject the processing request if the unique identifier carried in the processing request does not exist in the Bloom filter, indicating that the processing operation in the processing request involves horizontal unauthorized behavior.

[0068] Based on the above embodiment, optionally, the device further includes a destruction module, which is used to destroy the session information and the Bloom filter bound to the session information when the user logs out.

[0069] The query processing device for preventing horizontal authority exceeding provided by the embodiment of the present invention can execute the query processing method for preventing horizontal authority exceeding provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0070] Example 5

[0071] Figure 5 1 is a structural diagram of an electronic device provided in Example 5 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0072] like Figure 5As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by the at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12 and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0073] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0074] The processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the query processing method for preventing horizontal unauthorized access.

[0075] In some embodiments, the query processing method for preventing horizontal privilege escalation can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the query processing method for preventing horizontal privilege escalation described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the query processing method for preventing horizontal privilege escalation in any other appropriate manner (for example, by means of firmware).

[0076] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0077] Computer programs for implementing the query processing method for preventing horizontal unauthorized access of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0078] Example 6

[0079] Embodiment 6 of the present invention further provides a computer-readable storage medium storing computer instructions, the computer instructions being used to cause a processor to execute a query processing method for preventing horizontal unauthorized access, the method being applied to a backend server and comprising:

[0080] Receive a query request sent by a user through a front-end query interface, and determine a query result based on a screening condition in the query request;

[0081] Adding the unique identifier of the query result to the Bloom filter corresponding to the pre-query interface, and returning the query result and the unique identifier of the query result to the user terminal;

[0082] When receiving a processing request for the query result sent by the user end through the post-operation interface, it is determined whether the Bloom filter has a unique identifier carried in the processing request; if so, processing is performed based on the processing operation in the processing request.

[0083] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0084] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0085] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0086] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0087] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0088] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A query processing method for preventing horizontal unauthorized access, applied to a backend server, characterized in that: include: Receive a query request sent by a user through a front-end query interface, and determine a query result based on a screening condition in the query request; Adding the unique identifier of the query result to the Bloom filter corresponding to the pre-query interface, and returning the query result and the unique identifier of the query result to the user terminal; When receiving a processing request for the query result sent by the user end through the post-operation interface, it is determined whether the Bloom filter has a unique identifier carried in the processing request; if so, processing is performed based on the processing operation in the processing request.

2. The method according to claim 1, characterized in that The query request carries a session identifier; and adding the unique identifier of the query result to the Bloom filter corresponding to the front query interface includes: Reading session information based on the session identifier, and determining a Bloom filter corresponding to the pre-query interface based on the session information; The unique identifier of the query result is added to the Bloom filter corresponding to the pre-query interface.

3. The method according to claim 2, characterized in that Before determining the Bloom filter corresponding to the pre-query interface based on the session information, the method further includes: If the session information is not bound to the Bloom filter corresponding to the pre-query interface, a new Bloom filter is created and the Bloom filter is bound to the session information.

4. The method according to claim 1, wherein The method further comprises: An expiration time threshold of the Bloom filter is set, and when the time from the creation time of the Bloom filter to the current time exceeds the expiration time threshold, the Bloom filter is destroyed.

5. The method according to claim 4, characterized in that Before determining whether the unique identifier in the processing request exists in the Bloom filter, the method further includes: It is determined whether the Bloom filter exists. If the Bloom filter does not exist, then the processing operation in the processing request has horizontal unauthorized behavior, and the processing request is rejected.

6. The method according to claim 1, characterized in that The method further comprises: If the unique identifier carried in the processing request does not exist in the Bloom filter, then the processing operation in the processing request involves horizontal unauthorized behavior, and the processing request is rejected.

7. The method according to claim 2, characterized in that The method further comprises: When the user logs out, the session information and the Bloom filter bound to the session information are destroyed.

8. A query processing device for preventing horizontal unauthorized access, applied to a back-end server, characterized in that: include: A pre-query module is used to receive a query request sent by a user terminal through a pre-query interface and determine a query result based on the screening conditions in the query request; an identification adding module, configured to add the unique identification of the query result to the Bloom filter corresponding to the pre-query interface, and return the query result and the unique identification of the query result to the user terminal; The post-processing module is used to determine whether the unique identifier carried in the processing request exists in the Bloom filter when receiving a processing request for the query result sent by the user end through the post-operation interface; if so, perform processing based on the processing operation in the processing request.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the query processing method for preventing horizontal authority overstepping according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the query processing method for preventing horizontal unauthorized access according to any one of claims 1 to 7 when the computer instructions are executed.

Images