Access request processing method and device, equipment, storage medium and program product

Abstract

The invention provides an access request processing method and device, equipment, a storage medium and a program product, and can be applied to the technical field of computers. The method comprises the following steps: verifying certificate information carried by an access request according to certificate validity period information on a block chain to obtain an initial verification result; under the condition that the initial verification result represents that the credential is valid, verifying based on the executable performance of the access rule object on the operation statement identifier, the accessibility of a target access data source corresponding to the target access data source attribute information and the permission relationship between the credential identifier and the target access data source to obtain a target verification result; under the condition that the target verification result represents that verification is passed, obtaining target access data source connection information corresponding to the target access data source attribute information from the access rule object, and connecting the target access data source; and aiming at the target access data source, executing an operation statement corresponding to the operation statement identifier to obtain an execution result.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, and more particularly, to an access request processing method and device, equipment, storage medium and program product. BACKGROUND

[0002] With the evolution of system from monolithic architecture to microservice architecture, the data source is no longer limited to a single intranet, but is opened to internal and external users through interface services and other means. Any data access needs to go through access permission verification, otherwise there will be risks such as data leakage.

[0003] In the process of implementing the present disclosure, the inventors found that at least the following problems exist in the related art: In the current process of accessing the data source, there is a lack of complete access permission process verification, which leads to reduced data source access security. SUMMARY

[0004] Therefore, the present disclosure provides an access request processing method and device, equipment, storage medium and program product.

[0005] One aspect of the present disclosure provides an access request processing method, comprising: in response to an access request of a target object, verifying credential information carried by the access request according to credential validity period information on a block chain to obtain an initial verification result, wherein the block chain stores an access rule object, and the credential information includes a credential identifier, an operation statement identifier, and target access data source attribute information; in the case that the initial verification result indicates that the credential is valid, verifying the executable of the operation statement identifier, the accessibility of a target access data source corresponding to the target access data source attribute information, and the permission relationship between the credential identifier and the target access data source based on the access rule object to obtain a target verification result; in the case that the target verification result indicates that the verification is passed, obtaining target access data source connection information corresponding to the target access data source attribute information from the access rule object, connecting the target access data source; and executing an operation statement corresponding to the operation statement identifier for the target access data source to obtain an execution result.

[0006] According to an embodiment of the present disclosure, the access rule object includes a data source file object, an operation statement object, and a permission rule object; wherein the target verification result is obtained by verifying the executable of the operation statement identifier, the accessibility of the target access data source corresponding to the target access data source attribute information, and the permission relationship between the credential identifier and the target access data source based on the access rule object, including: verifying the accessibility of the target access data source corresponding to the target access data source attribute information based on the data source file object to obtain a first verification result; in the case of obtaining the first verification result representing accessibility, verifying the permission relationship between the credential identifier and the target access data source based on the permission rule object to obtain a second verification result; in the case of obtaining the second verification result representing that the verification is passed, verifying the executable of the operation statement identifier based on the operation statement object to obtain a third verification result; in the case of obtaining the third verification result representing executable, obtaining the target verification result representing that the verification is passed.

[0007] According to an embodiment of the present disclosure, the permission rule object stores a preset permission relationship between a preset credential identifier and a preset data source; wherein the second verification result is obtained by verifying the permission relationship between the credential identifier and the target access data source based on the permission rule object, including: in the case that the permission relationship between the credential identifier and the target access data source exists in the preset permission relationship, obtaining the second verification result representing that the verification is passed; in the case that the permission relationship between the credential identifier and the target access data source does not exist in the preset permission relationship, obtaining the second verification result representing that the verification is not passed.

[0008] According to an embodiment of the present disclosure, the blockchain includes a plurality of data source file objects, each data source file object storing data source attribute information corresponding to a preset data source; wherein the first verification result is obtained by verifying the accessibility of the target access data source corresponding to the target access data source attribute information based on the data source file object, including: in the case that the target access data source attribute information is included in the data source attribute information of each of the plurality of data sources, obtaining the first verification result representing accessibility; in the case that the target access data source attribute information is not included in the data source attribute information of each of the plurality of data sources, obtaining the first verification result representing inaccessibility.

[0009] According to an embodiment of the present disclosure, the target access data source connection information corresponding to the target access data source attribute information is obtained from the access rule object, and the target access data source is connected, including: obtaining the encrypted data source connection information in the target data source file object corresponding to the target access data source attribute information from the plurality of data source file objects; decrypting the encrypted data source connection information to obtain decrypted data source connection information; and connecting the target access data source based on the decrypted data source connection information.

[0010] According to an embodiment of the present disclosure, the operation statement corresponding to the operation statement identifier is executed on the target access data source to obtain an initial execution result.

[0011] According to an embodiment of the present disclosure, the permission rule object further includes accessible row permission information and accessible column permission information corresponding to a preset credential identifier, and the initial execution result includes row data and column data; and the filtering of the initial execution result based on the permission rule object to obtain the filtered execution result includes: filtering the row data based on the accessible row permission information corresponding to the preset credential identifier to obtain target row data; filtering the column data based on the accessible column permission information corresponding to the preset credential identifier to obtain target column data; and obtaining the filtered execution result according to the target row data and the target column data.

[0012] According to an embodiment of the present disclosure, the access request processing method further includes: packaging and storing object attribute information of the target object, the target access data source, the execution result, and an execution time on the blockchain.

[0013] Another aspect of the present disclosure provides an access request processing apparatus, including: a response module configured to respond to an access request of a target object, and to verify credential information carried by the access request based on credential validity period information on a blockchain to obtain an initial verification result, wherein the blockchain stores an access rule object, and the credential information includes a credential identifier, an operation statement identifier, and target access data source attribute information; a verification module configured to, in a case where the initial verification result indicates that the credential is valid, verify the executable nature of the operation statement identifier, the accessibility of a target access data source corresponding to the target access data source attribute information, and a permission relationship between the credential identifier and the target access data source based on the access rule object to obtain a target verification result; a connection module configured to, in a case where the target verification result indicates that the verification is passed, acquire target access data source connection information corresponding to the target access data source attribute information from the access rule object, and to connect the target access data source; and an access module configured to execute an operation statement corresponding to the operation statement identifier on the target access data source to obtain an execution result.

[0014] Another aspect of the present disclosure provides an electronic device, including: one or more processors; and a memory storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the access request processing method as described above.

[0015] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions for implementing the access request processing method as above when executed.

[0016] Another aspect of the present disclosure provides a computer program product comprising computer-executable instructions for implementing the access request processing method as above when executed.

[0017] The access request processing method, device, equipment, storage medium and program product provided by the present disclosure first verify the credential information carried by the access request before the access, thereby ensuring the validity of the credential carried by the target object. On this basis, whether the target object can execute the operation statement identified by the operation statement, whether the system is configured with the connection information of the target access data source, and whether the target object has the permission to access the target access data source are verified according to the access rule object associated with the data source stored on the blockchain. After obtaining the target verification result representing that the verification is passed, the zero-trust gateway is called to obtain the operation statement corresponding to the operation statement identifier and the target access data source connection information from the blockchain in real time, and then the access operation is executed on the target access data source. According to the access rule object stored on the blockchain and the complete access permission process verification before the access, the security of the data source access is improved. In addition, when the number of data sources in the system changes, the local configuration file does not need to be modified and all data sources do not need to be restarted. Only the access rule object in the blockchain needs to be adjusted, thereby reducing resource consumption. BRIEF DESCRIPTION OF DRAWINGS

[0018] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure taken in conjunction with the accompanying drawings, in which:

[0019] Figure 1 An application scenario of the access request processing method according to an embodiment of the present disclosure is shown;

[0020] Figure 2 A flowchart of the access request processing method according to an embodiment of the present disclosure is shown;

[0021] Figure 3 A schematic diagram of obtaining a third verification result according to an embodiment of the present disclosure is shown;

[0022] Figure 4 A structural block diagram of the access request processing device according to an embodiment of the present disclosure is shown; and

[0023] Figure 5 A block diagram of an electronic device suitable for implementing the access request processing method according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood, however, that the description is merely exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description of the embodiments of the present disclosure, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, it would be apparent to one skilled in the art that the present disclosure can be practiced without these specific details. In other instances, well-known structures and functions have been described in detail in order to avoid obscuring the concepts of the present disclosure.

[0025] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. As used herein, the term "includes" and tautological expressions thereof, such as "including," "includes," "include," "contains," "containing," and so on, mean the presence of stated features, steps, operations, elements, and / or components but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and / or groups thereof.

[0026] All terms used herein, including technical and scientific terms, have the same meanings as commonly understood by one of ordinary skill in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present specification, and should not be interpreted in an idealized or overly formal way.

[0027] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should generally be interpreted to include any of them, to exclude the other(s) of any of them, or to include some of them. For example, the expression "at least one of A, B, and C" should be interpreted to include only A, only B, only C, only A and B, only A and C, only B and C, only A, B, and C, etc.

[0028] In the process of implementing the present disclosure, it is found that in the current industry, most scenarios of connecting a database in an application program still require only a single data source to be connected, and there are also many scenarios that require multiple databases to be connected in an application program, such as data warehouse data extraction, which requires multiple business databases to be connected. Common multi-data source configurations are based on configuring multiple data source access information in a data source configuration file, loading multiple data sources in the configuration file at one time when the application program starts, writing operation statements to the configuration file in advance, or uniformly configuring to a central database, writing multiple data sources and operation statements to the master database table, but the master database table is a single point, which will have the following problems: (1) the master database is deleted, and the entire system is paralyzed; (2) the modification of the master database table cannot be traced; (3) the master database table needs to be restarted after the new data source configuration, which consumes a lot of resources. In addition, there is a lack of complete access permission process verification in the process of accessing the data source, which reduces the security of data source access.

[0029] Therefore, the embodiment of the present disclosure provides an access request processing method, device, equipment, storage medium and program product. The method comprises: verifying the credential information carried by the access request according to the credential validity period information on the block chain to obtain an initial verification result; in the case that the initial verification result represents that the credential is valid, verifying the executability of the operation statement identifier, the accessibility of the target access data source corresponding to the target access data source attribute information and the permission relationship between the credential identifier and the target access data source based on the access rule object to obtain a target verification result; in the case that the target verification result represents that the verification is passed, obtaining the target access data source connection information corresponding to the target access data source attribute information from the access rule object, connecting the target access data source; and executing the operation statement corresponding to the operation statement identifier for the target access data source to obtain an execution result.

[0030] It should be noted that the access request processing method and the access request processing device determined by the present disclosure can be used in the financial field, and can also be used in any field other than the financial field. The application field of the access request processing method and the access request processing device determined by the present disclosure is not limited.

[0031] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards, do not violate public order and good customs, and provide corresponding operation portal for user to select authorization or refusal.

[0032] It should be noted that in the embodiments of the present application, some existing industry solutions, components, models, etc. may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the technical solution implementation of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0033] Figure 1 The application scenario of the access request processing method according to the embodiment of the present disclosure is shown.

[0034] As shown in Figure 1 The system architecture 100 according to the embodiment can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104 and a server 105. The network 104 is used as a medium to provide a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0035] The user can use at least one of the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0036] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smartphones, tablet computers, laptop computers, desktop computers, etc.

[0037] The server 105 can be a server providing various services, such as a background management server providing support for websites browsed by the user using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (only as an example). The background management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data, etc. obtained or generated according to user requests) to the terminal device.

[0038] It should be noted that the access request processing method provided by the embodiments of the present disclosure can generally be executed by the server 105. Correspondingly, the access request processing apparatus provided by the embodiments of the present disclosure can generally be arranged in the server 105. The access request processing method provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Correspondingly, the access request processing apparatus provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0039] Alternatively, the access request processing method provided by the embodiments of the present disclosure can also be executed by the first terminal device 101, the second terminal device 102, or the third terminal device 103, or by other terminal devices different from the first terminal device 101, the second terminal device 102, or the third terminal device 103. Correspondingly, the access request processing apparatus provided by the embodiments of the present disclosure can also be arranged in the first terminal device 101, the second terminal device 102, or the third terminal device 103, or in other terminal devices different from the first terminal device 101, the second terminal device 102, or the third terminal device 103.

[0040] It should be understood that Figure 1 The number of terminal devices, networks and servers in the above is merely an example. Any number of terminal devices, networks and servers can be provided according to implementation needs.

[0041] Figure 2 A flowchart of an access request processing method according to an embodiment of the present disclosure is shown.

[0042] As Figure 2 The method 200 includes operations S210-S240, as shown in the figure.

[0043] At operation S210, in response to an access request of a target object, the credential information carried by the access request is verified according to the credential validity period information on the blockchain, and an initial verification result is obtained.

[0044] According to an embodiment of the present disclosure, the target object can be a user object or an application object that initiates the access request.

[0045] According to an embodiment of the present disclosure, the server responds to an access request of a target object to access a target access data source, and calls a zero-trust gateway to determine the credential information carried by the access request. The access request can be a request message.

[0046] According to an embodiment of the present disclosure, the credential information is a verifiable digital credential (VC) used to prove that the associated attribute information of the target object is real and valid in an encrypted manner. For example, the associated attribute information can be access object permission information, access data source permission information, access data source row and column permission information, etc.

[0047] According to an embodiment of the present disclosure, the credential information includes a credential identifier, an operation statement identifier, and target access data source attribute information.

[0048] According to an embodiment of the present disclosure, the credential identifier is used to verify the validity of the credential information. The operation statement identifier is used to verify whether the target object can execute an operation statement corresponding to the operation statement identifier. The target access data source attribute information can be address information, port information, name information, etc. of the target access data source.

[0049] According to an embodiment of the present disclosure, the blockchain stores credential validity period information and access rule objects. The credential validity period information includes the validity period corresponding to each preset credential identifier.

[0050] According to an embodiment of the present disclosure, the credential carried by the access request is checked according to the credential validity period information on the blockchain. If the credential is within the validity period, an initial check result indicating that the credential is valid is obtained. If the credential is not within the validity period, an initial check result indicating that the credential is invalid is obtained.

[0051] According to an embodiment of the present disclosure, the invalid credential means that the credential has been revoked by the system, and the server returns an access failure result.

[0052] According to an embodiment of the present disclosure, the access rule object is a file object storing access rules. The access rules include dynamically added accessible data source information, executable operation statement information, access permission mapping rules, and the like in the system.

[0053] In operation S220, if the initial check result indicates that the credential is valid, the executability of the operation statement identifier, the accessibility of the target access data source corresponding to the target access data source attribute information, and the permission relationship between the credential identifier and the target access data source are checked based on the access rule object, and a target check result is obtained.

[0054] According to an embodiment of the present disclosure, the target access data source is determined according to the target access data source attribute information. The target access data source can be a database, a log, a service interface, or the like to be accessed.

[0055] According to an embodiment of the present disclosure, a plurality of preset operation statement identifiers are stored in the access rule object. If the operation statement identifier carried by the credential information is included in the plurality of preset operation statement identifiers in the access rule object, the target object has the permission to execute the operation statement corresponding to the operation statement identifier; otherwise, the target object does not have the permission to execute the operation statement corresponding to the operation statement identifier.

[0056] According to an embodiment of the present disclosure, a plurality of preset data source attribute information are stored in the access rule object. If the target access data source attribute information is included in the plurality of preset data source information in the access rule object, it is determined that the system is configured with connection information of the target access data source corresponding to the target access data source attribute information, and the target access data source is accessible; otherwise, the system is not configured with the connection information of the target access data source corresponding to the target access data source attribute information, and the target access data source is not accessible.

[0057] According to an embodiment of the present disclosure, the access rule object stores a preset credential identifier and a preset data source, and a permission relationship between the preset credential identifier and the preset data source. Whether the credential identifier of the target object corresponds to the target access data source is determined according to the permission relationship between the preset credential identifier and the preset data source. If the credential identifier of the target object corresponds to the target access data source, it is determined that the target object has permission to access the target access data source corresponding to the target access data source attribute information. Otherwise, the target object does not have permission to access the target access data source corresponding to the target access data source attribute information.

[0058] According to an embodiment of the present disclosure, the target verification result includes verification pass and verification fail.

[0059] In operation S230, if the target verification result represents verification pass, target access data source connection information corresponding to the target access data source attribute information is obtained from the access rule object, and the target access data source is connected.

[0060] According to an embodiment of the present disclosure, if the target verification result represents verification pass, the zero-trust gateway is invoked to download the target access data source connection information corresponding to the target access data source attribute information from the access rule object on the blockchain in real time.

[0061] For example, the target access data source connection information can include address, port, username, password, service name, and the like.

[0062] According to an embodiment of the present disclosure, based on the target access data source connection information, the zero-trust gateway connects the target access data source in the memory.

[0063] In operation S240, for the target access data source, an operation statement corresponding to the operation statement identifier is executed to obtain an execution result.

[0064] According to an embodiment of the present disclosure, the access rule object stores a preset operation statement identifier and an operation statement corresponding to the preset operation statement identifier, and the operation statement corresponding to the operation statement identifier is obtained from the access rule object.

[0065] According to an embodiment of the present disclosure, the operation statement can be a structured query language (Structured Query Language).

[0066] According to an embodiment of the present disclosure, the target access data source is assigned to the operation statement in a parameter assignment manner, and then the operation statement is executed to obtain an execution result, and the execution result is returned to the client where the target object is located.

[0067] For example, the execution result can be a data query result.

[0068] According to the embodiments of the present disclosure, since the credential information carried by the access request is verified before the access, the validity of the credential carried by the target object is ensured, and then according to the access rule object associated with the data source stored on the block chain, it is verified whether the target object can execute the operation statement identified by the operation statement, whether the system is configured with the connection information of the target access data source, and whether the target object has the permission to access the target access data source. After obtaining the target verification result representing that the verification is passed, the zero-trust gateway is called to obtain the operation statement corresponding to the operation statement identifier and the connection information of the target access data source from the block chain in real time, and then the access operation is performed on the target access data source. According to the access rule object stored on the block chain and the complete access permission process before the access, the security of the data source access is improved. In addition, when the number of data sources in the system changes, the local configuration file does not need to be modified and all data sources do not need to be restarted. Only the access rule object in the block chain needs to be adjusted, which reduces the resource consumption.

[0069] According to the embodiments of the present disclosure, the access rule object includes a data source file object, an operation statement object, and a permission rule object. The accessability of the target access data source corresponding to the target access data source attribute information and the permission relationship between the credential identifier and the target access data source are verified based on the executable of the operation statement identifier, the operation statement object, and the permission rule object, and a target verification result is obtained. The accessability of the target access data source corresponding to the target access data source attribute information is verified based on the data source file object, and a first verification result is obtained. In the case where the first verification result representing the accessability is obtained, the permission relationship between the credential identifier and the target access data source is verified based on the permission rule object, and a second verification result is obtained. In the case where the second verification result representing the verification pass is obtained, the executable of the operation statement identifier is verified based on the operation statement object, and a third verification result is obtained. In the case where the third verification result representing the executable is obtained, the target verification result representing the verification pass is obtained.

[0070] According to the embodiments of the present disclosure, the data source file object is used to store the preset data source information.

[0071] For example, after the system administrator clicks "add data source" on the webpage, adds the address, port, username, password, and other information of the data source in sequence, the system automatically generates a data source file object, and stores the data source file object on the block chain by using a hash algorithm.

[0072] According to an embodiment of the present disclosure, the checking the accessibility of the target access data source corresponding to the target access data source attribute information can include: in a case where the target access data source attribute information is included in the plurality of preset data source information in the data source file object, obtaining a first check result representing accessible, which means that the system is configured with the connection information of the target access data source corresponding to the target access data source attribute information, and the target access data source is accessible; otherwise, obtaining a first check result representing inaccessible, which means that the system is not configured with the connection information of the target access data source corresponding to the target access data source attribute information, and the target access data source is inaccessible.

[0073] According to an embodiment of the present disclosure, the permission rule object is used to store the permission relationship between the preset credential identifier and the preset data source. In the system configuration stage, it is necessary to establish the corresponding permission relationship between the preset credential identifier of each object allowed to be accessed by the system and the preset data source accessible to the object, so as to prevent the object from accessing the preset data source without permission and leaking information.

[0074] According to an embodiment of the present disclosure, after obtaining the first check result representing accessible, further checking the permission relationship between the credential identifier and the target access data source based on the permission rule object includes: determining whether the credential identifier of the target object corresponds to the target access data source from the permission relationship between the preset credential identifier and the preset data source, and in a case where the credential identifier of the target object corresponds to the target access data source, obtaining a second check result representing that the checking passes, which means that the target object has the permission to access the target access data source corresponding to the target access data source attribute information.

[0075] According to an embodiment of the present disclosure, in a case where the credential identifier of the target object does not correspond to the target access data source, obtaining a second check result representing that the checking does not pass, which means that the target object does not have the permission to access the target access data source corresponding to the target access data source attribute information.

[0076] According to an embodiment of the present disclosure, the operation statement object is used to store the operation statement executable by each object allowed to be accessed by the system, and the preset operation statement identifier corresponding to each operation statement.

[0077] According to an embodiment of the present disclosure, after obtaining the second check result representing that the checking passes, checking the executability of the operation statement identifier based on the operation statement object includes: in a case where the operation statement identifier carried by the credential information is included in the plurality of preset operation statement identifiers, obtaining a third check result representing executable, which means that the target object has the permission to execute the operation statement corresponding to the operation statement identifier; otherwise, obtaining a third check result representing inexecutable, which means that the target object does not have the permission to execute the operation statement corresponding to the operation statement identifier.

[0078] According to an embodiment of the present disclosure, in a case where the third check result characterizes the executable, a target check result characterizing the check pass is obtained, and then the target access data source can be accessed.

[0079] Figure 3 A schematic diagram of obtaining the third check result according to an embodiment of the present disclosure is shown.

[0080] As shown in Figure 3 , the first check result 303 is obtained by checking the accessibility of the target access data source 302 corresponding to the target access data source attribute information based on the data source file object 301; in a case where the first check result characterizing the accessibility is obtained, the second check result 306 is obtained by checking the permission relationship 305 between the credential identifier and the target access data source based on the permission rule object 304; in a case where the second check result characterizing the check pass is obtained, the third check result 309 is obtained by checking the executable of the operation statement identifier 308 based on the operation statement object 307.

[0081] According to an embodiment of the present disclosure, the permission rule object stores a preset permission relationship between a preset credential identifier and a preset data source; wherein, the second check result is obtained by checking the permission relationship between the credential identifier and the target access data source based on the permission rule object, including: in a case where the permission relationship between the credential identifier and the target access data source exists in the preset permission relationship, obtaining the second check result characterizing the check pass; in a case where the permission relationship between the credential identifier and the target access data source does not exist in the preset permission relationship, obtaining the second check result characterizing the check fail.

[0082] According to an embodiment of the present disclosure, the permission rule object stores a preset permission relationship between a plurality of preset credential identifiers and a plurality of preset data sources.

[0083] For example, the permission rule object stores a preset permission relationship corresponding to the preset credential identifier 100 and the preset data source A; a preset permission relationship corresponding to the preset credential identifier 200 and the preset data source B; and a preset permission relationship corresponding to the preset credential identifier 300 and the preset data source C.

[0084] For example, the credential identifier of the target object is 100, the target access data source is A, and in a case where the permission relationship between the credential identifier 100 and the target access data source A exists in the preset permission relationship, the second check result characterizing the check pass is obtained.

[0085] For example, the credential identifier of the target object is 100, the target access data source is B, and in a case where the permission relationship between the credential identifier 100 and the target access data source B does not exist in the preset permission relationship, the second check result characterizing the check fail is obtained.

[0086] According to an embodiment of the present disclosure, the blockchain comprises a plurality of data source file objects, each of which stores data source attribute information corresponding to a preset data source; wherein the first check result is obtained by checking the accessibility of the target access data source corresponding to the target access data source attribute information based on the data source file object, including: in the case that the target access data source attribute information is included in the data source attribute information of each of the plurality of preset data sources, obtaining the first check result representing accessibility; in the case that the target access data source attribute information is not included in the data source attribute information of each of the plurality of data sources, obtaining the first check result representing inaccessibility.

[0087] According to an embodiment of the present disclosure, when a preset data source is added or deleted, the system administrator adds or deletes the data source file object corresponding to the preset data source on the webpage, and then updates the blockchain, each data source file object stores data source attribute information corresponding to the preset data source.

[0088] According to an embodiment of the present disclosure, the data source attribute information includes the address, port, username, password and other information of the data source.

[0089] According to an embodiment of the present disclosure, the plurality of preset data sources do not distinguish between primary data sources and backup data sources.

[0090] For example, the blockchain comprises data source file objects corresponding to preset data source A, preset data source B, and preset data source C respectively.

[0091] For example, the target access data source is A, and the data source attribute information can be the data source name. In the data source names corresponding to preset data source A, preset data source B, and preset data source C respectively, the name of the target access data source A is included, and therefore the first check result representing accessibility is obtained.

[0092] For example, the target access data source is D, and the data source attribute information can be the data source name. In the data source names corresponding to preset data source A, preset data source B, and preset data source C respectively, the name of the target access data source D is not included, and therefore the first check result representing inaccessibility is obtained.

[0093] According to an embodiment of the present disclosure, when the number of data sources in the system changes, there is no need to modify the local configuration file and restart all data sources, but only to adjust the data source file object in the blockchain, reducing resource consumption; the plurality of preset data sources do not distinguish between primary data sources and backup data sources, avoiding the risk of paralysis of the entire system when the primary data source is deleted in the related art in which a plurality of backup data sources are configured in the primary data source.

[0094] According to an embodiment of the present disclosure, the target access data source connection information corresponding to the target access data source attribute information is obtained from the access rule object, and the connection of the target access data source includes: obtaining the encrypted data source connection information in the target data source file object corresponding to the target access data source attribute information from the plurality of data source file objects; decrypting the encrypted data source connection information to obtain the decrypted data source connection information; and connecting the target access data source based on the decrypted data source connection information.

[0095] According to an embodiment of the present disclosure, the encrypted data source connection information used to connect the preset data source is stored in the data source file object.

[0096] According to an embodiment of the present disclosure, the zero-trust gateway is called to determine the target data source file object corresponding to the target access data source attribute information from the plurality of data source file objects on the block chain, and the encrypted data source connection information is downloaded from the target data source file object.

[0097] According to an embodiment of the present disclosure, the encrypted data source connection information includes encrypted address information, port information, service name information, user name information, password information, etc.

[0098] According to an embodiment of the present disclosure, the zero-trust gateway decrypts the encrypted data source connection information in the memory to obtain the decrypted data source connection information.

[0099] According to an embodiment of the present disclosure, the target access data source is connected according to the decrypted data source connection information.

[0100] According to an embodiment of the present disclosure, the encrypted data source connection information of the preset data source is stored in the data source file object on the block chain, and in the case where it is determined that there is a right to access the preset data source, the zero-trust gateway is called to download and decrypt the encrypted data source connection information, thereby improving the security of the preset data source access.

[0101] According to an embodiment of the present disclosure, for the target access data source, the operation statement corresponding to the operation statement identifier is executed to obtain an execution result, which includes: obtaining the operation statement corresponding to the operation statement identifier from the operation statement object; executing the operation statement on the target access data source to obtain an initial execution result; and filtering the initial execution result based on the permission rule object to obtain a filtered execution result.

[0102] According to an embodiment of the present disclosure, the operation statement object stores the operation statements executable by each of the objects allowed to be accessed by the system, and the preset operation statement identifier corresponding to each operation statement.

[0103] According to an embodiment of the present disclosure, after obtaining the target verification result representing the verification passing, the zero-trust gateway is called to download the operation statement corresponding to the operation statement identifier from the operation statement object.

[0104] According to an embodiment of the present disclosure, the credential information can include access row information and access column information. The target access data source, the access row information and the access column information are assigned to the operation statement in a parameter assignment manner, and then the operation statement is executed to obtain an initial execution result.

[0105] For example, when the operation statement is a query operation statement, the initial execution result is a query data result; when the operation statement is an insert operation statement, the initial execution result is an insert data result.

[0106] According to an embodiment of the present disclosure, the permission rule object can further store an access content permission rule, for example, table row data or table column data that can be accessed by the preset credential identifier. The initial execution result is filtered based on the permission rule object to obtain a filtered execution result.

[0107] According to an embodiment of the present disclosure, the permission rule object further includes accessible row permission information and accessible column permission information corresponding to the preset credential identifier, and the initial execution result includes row data and column data; wherein the filtered execution result is obtained by filtering the initial execution result based on the permission rule object, including: filtering the row data based on the accessible row permission information corresponding to the preset credential identifier to obtain target row data; filtering the column data based on the accessible column permission information corresponding to the preset credential identifier to obtain target column data; and obtaining the filtered execution result according to the target row data and the target column data.

[0108] For example, the permission rule object specifies that the accessible row permission information corresponding to the preset credential identifier 100 is the first 100 rows in the preset data source A, and the accessible column permission information corresponding to the preset credential identifier A is the first 50 columns in the preset data source 100.

[0109] For example, the initial execution result includes row data of the first 200 rows in the target access data source A, and the accessible row permission information of the credential identifier 100 of the target object is the first 100 rows in the preset data source A, so the row data of rows 101-200 in the first 200 rows is filtered to obtain the target column data of the first 100 rows.

[0110] For example, the initial execution result includes column data of the first 100 columns in the target access data source A, and the accessible column permission information of the credential identifier 100 of the target object is the first 50 columns in the preset data source A, so the column data of columns 51-100 in the first 100 columns is filtered to obtain the target column data of the first 50 columns.

[0111] According to an embodiment of the present disclosure, the target row data and the target column data are sorted to obtain a filtered execution result, and the filtered execution result is sent to the target object.

[0112] According to an embodiment of the present disclosure, the access request processing method further includes: packaging and storing the object attribute information of the target object, the target access data source, the execution result, and the execution time on the blockchain.

[0113] According to an embodiment of the present disclosure, the object attribute information of the target object can include an object name of the target object.

[0114] For example, the execution result is the first 100 rows of data of the target access data source A that is queried.

[0115] According to an embodiment of the present disclosure, the execution time is the time when the operation statement is executed.

[0116] According to an embodiment of the present disclosure, after the filtered execution result is sent to the target object, the zero-trust gateway is called to package the object attribute information of the target object, the target access data source, the execution result, and the execution time into one-time access information and store it on the blockchain.

[0117] According to an embodiment of the present disclosure, since the object attribute information, the target access data source, the execution result, and the execution time generated by each access request are packaged and stored on the blockchain, an unchangeable on-chain log record is formed, and the audit is always available, ensuring the authenticity, traceability, and anti-repudiation of accessing the target access data source.

[0118] Based on the above access request processing method, the present disclosure further provides an access request processing device. The following will be described in detail Figure 4 The device is described in detail.

[0119] Figure 4 A structural block diagram of an access request processing device according to an embodiment of the present disclosure is shown.

[0120] As Figure 4 shown, the access request processing device 400 of this embodiment includes a response module 410, a verification module 420, a connection module 430, and an access module 440.

[0121] The response module 410 is configured to respond to an access request of a target object, verify credential information carried by the access request according to credential validity period information on a blockchain to obtain an initial verification result, wherein the access rule object is stored on the blockchain, and the credential information includes a credential identifier, an operation statement identifier, and target access data source attribute information. In an embodiment, the response module 410 can be configured to perform the operation S210 described above, and thus will not be described here.

[0122] The checking module 420 is configured to, in a case where the initial checking result indicates that the credential is valid, perform checking on the basis of the executable nature of the operation statement identified by the operation statement identifier, the accessibility of the target access data source corresponding to the target access data source attribute information, and the permission relationship between the credential identifier and the target access data source, to obtain a target checking result. In an embodiment, the checking module 420 can be configured to perform operation S220 described above, and details are not described herein again.

[0123] The connecting module 430 is configured to, in a case where the target checking result indicates that the checking is passed, acquire target access data source connection information corresponding to the target access data source attribute information from the access rule object, and connect the target access data source. In an embodiment, the connecting module 430 can be configured to perform operation S230 described above, and details are not described herein again.

[0124] The accessing module 440 is configured to, for the target access data source, execute the operation statement corresponding to the operation statement identifier, to obtain an execution result. In an embodiment, the accessing module 440 can be configured to perform operation S240 described above, and details are not described herein again.

[0125] According to an embodiment of the present disclosure, the checking module 420 includes a first checking submodule, a second checking submodule, a third checking submodule, and a fourth checking submodule.

[0126] The first checking submodule is configured to perform checking on the basis of the data source file object on the accessibility of the target access data source corresponding to the target access data source attribute information, to obtain a first checking result.

[0127] The second checking submodule is configured to, in a case where the first checking result indicates that the target access data source is accessible, perform checking on the basis of the permission rule object on the permission relationship between the credential identifier and the target access data source, to obtain a second checking result.

[0128] The third checking submodule is configured to, in a case where the second checking result indicates that the checking is passed, perform checking on the basis of the operation statement object on the executable nature of the operation statement identified by the operation statement identifier, to obtain a third checking result.

[0129] The fourth checking submodule is configured to, in a case where the third checking result indicates that the operation statement is executable, obtain a target checking result indicating that the checking is passed.

[0130] According to an embodiment of the present disclosure, the second checking submodule includes a first checking unit and a second checking unit.

[0131] The first checking unit is configured to, in a case where the preset permission relationship includes the permission relationship between the credential identifier and the target access data source, obtain the second checking result indicating that the checking is passed.

[0132] The second checking unit is configured to obtain a second checking result indicating that the checking fails, in a case where the credential identifier and the target access data source do not exist in the preset permission relationship.

[0133] According to an embodiment of the present disclosure, the first checking sub-module includes a third checking unit and a fourth checking unit.

[0134] The third checking unit is configured to obtain a first checking result indicating that the target access data source is accessible, in a case where the target access data source attribute information is included in the data source attribute information of each of the plurality of data sources.

[0135] The fourth checking unit is configured to obtain a first checking result indicating that the target access data source is not accessible, in a case where the target access data source attribute information is not included in the data source attribute information of each of the plurality of data sources.

[0136] According to an embodiment of the present disclosure, the connection module 430 includes an acquisition sub-module, a decryption sub-module, and a connection sub-module.

[0137] The acquisition sub-module is configured to acquire encrypted data source connection information in a target data source file object corresponding to the target access data source attribute information from a plurality of data source file objects.

[0138] The decryption sub-module is configured to decrypt the encrypted data source connection information to obtain decrypted data source connection information.

[0139] The connection sub-module is configured to connect the target access data source based on the decrypted data source connection information.

[0140] According to an embodiment of the present disclosure, the access module 440 includes a first access sub-module, a second access sub-module, and a third access sub-module.

[0141] The first access sub-module is configured to acquire an operation statement corresponding to an operation statement identifier from an operation statement object.

[0142] The second access sub-module is configured to execute the operation statement on the target access data source to obtain an initial execution result.

[0143] The third access sub-module is configured to filter the initial execution result based on the permission rule object to obtain a filtered execution result.

[0144] According to an embodiment of the present disclosure, the third access sub-module includes a first access unit, a second access unit, and a third access unit.

[0145] The first access unit is configured to filter row data based on accessible row permission information corresponding to a preset credential identifier to obtain target row data.

[0146] The second access unit is configured to filter the column data based on the accessible column permission information corresponding to the preset credential identifier, to obtain target column data.

[0147] The third access unit is configured to obtain a filtered execution result according to the target row data and the target column data.

[0148] According to an embodiment of the present disclosure, the access request processing apparatus 400 further includes a storage module.

[0149] The storage module is configured to package and store the object attribute information of the target object, the target access data source, the execution result, and the execution time on a blockchain.

[0150] Any one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure, or at least part of the functions of any one or more of the modules, sub-modules, units, and sub-units, can be implemented in one module. Any one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure can be split into multiple modules for implementation. Any one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or any other reasonable manner of hardware or firmware through integration or packaging of circuits, or in any one of software, hardware, and firmware, or in an appropriate combination of any one or more of the three. Alternatively, one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure can be at least partially implemented as computer program modules that can perform corresponding functions when the computer program modules are run.

[0151] For example, any of the response module 410, the verification module 420, the connection module 430 and the access module 440 can be combined in one module / unit / sub-unit, or any of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of the modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units, and implemented in one module / unit / sub-unit. According to embodiments of the present disclosure, at least one of the response module 410, the verification module 420, the connection module 430 and the access module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable manner that can integrate or package a circuit, etc. or implemented in software, hardware and firmware in any one of the three implementation manners or in a proper combination of any of the three implementation manners. Alternatively, at least one of the response module 410, the verification module 420, the connection module 430 and the access module 440 can be at least partially implemented as a computer program module that can perform corresponding functions when the computer program module is run.

[0152] Figure 5 A block diagram of an electronic device suitable for implementing the access request processing method according to embodiments of the present disclosure is shown.

[0153] Figure 5 The electronic device shown is merely an example and should not bring any limitation to the functions and use range of embodiments of the present disclosure.

[0154] As shown in Figure 5 The computer electronic device 500 according to embodiments of the present disclosure includes a processor 501 that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 502 or loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 can include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application specific integrated circuit (ASIC)), etc. The processor 501 can also include an on-board memory for cache use. The processor 501 can include a single processing unit or multiple processing units for performing different actions of the method processes according to embodiments of the present disclosure.

[0155] In the RAM 503, various programs and data required for the operation of the electronic device 500 are stored. The processor 501, the ROM 502, and the RAM 503 are connected to each other via the bus 504. The processor 501 performs various operations of the method flow according to the embodiments of the present application by executing the programs in the ROM 502 and / or the RAM 503. It should be noted that the programs can also be stored in one or more memories other than the ROM 502 and the RAM 503. The processor 501 can also perform various operations of the method flow according to the embodiments of the present application by executing the programs stored in the one or more memories.

[0156] Optionally, the electronic device 500 can further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 can further include one or more of the following components connected to the input / output (I / O) interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as necessary. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 510 as necessary, so that a computer program read therefrom is installed in the storage portion 508 as necessary.

[0157] Optionally, the method flow according to the embodiments of the present application can be implemented as a computer software program. For example, the embodiments of the present application include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program codes for executing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network via the communication portion 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above-described functions defined in the system according to the embodiments of the present application are performed. Optionally, the system, device, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0158] The present application also provides a computer-readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, which when executed, implement the access request processing method according to the embodiments of the present application.

[0159] Optionally, the computer readable storage medium can be a non-transitory computer readable storage medium. For example, it can include, but is not limited to, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In this application, the computer readable storage medium can be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device.

[0160] For example, optionally, the computer readable storage medium can include one or more memories such as the ROM 502 and / or the RAM 503 and / or one or more memory chips / units other than the ROM 502 and the RAM 503 described above.

[0161] Embodiments of the present application also include a computer program product, which comprises a computer program for performing the methods provided by the embodiments of the present application, when the computer program is executed by an electronic device. The program code of the computer program can cause the electronic device to implement the access request processing method provided by the embodiments of the present application.

[0162] When the computer program is executed by the processor 501, the above-described functions defined in the system / apparatus of the embodiments of the present application are performed. Optionally, the systems, apparatuses, modules, units and the like described above can be implemented by the computer program modules.

[0163] In one embodiment, the computer program can rely on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program can also be transmitted in the form of a signal on a network medium and be downloaded and installed by the communication part 509 and / or be installed from the detachable medium 511. The program code contained in the computer program can be transmitted by any appropriate network medium, including, but not limited to, wireless, wired, etc., or any suitable combination of the foregoing.

[0164] Alternatively, program code to carry out operations provided in embodiments of the present application can be written in any combination of one or more programming languages, including high-level, procedural and / or object oriented programming languages, and / or assembly / machine language. Program code can execute entirely on a user's computing device, partly on the user's device, as a stand-alone software package, partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider.

[0165] The computer program instructions can also be loaded onto a computer or other programmable information processing apparatus to cause a series of operations to be performed on the computer or other programmable information processing apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable information processing apparatus implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0166] Embodiments of the present disclosure have been described. However, these embodiments are merely meant to be illustrative of the present disclosure and are not meant to limit the scope of the present disclosure. Although each of the embodiments has been described above, it is not meant that measures in each of the embodiments cannot be used in combination. A person skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should fall within the scope of the present disclosure.

Claims

1. An access request processing method characterized by comprising: The method comprises: In response to an access request of a target object, verifying credential information carried by the access request according to credential validity period information on a blockchain to obtain an initial verification result, wherein the blockchain stores an access rule object, and the credential information comprises a credential identifier, an operation statement identifier, and target access data source attribute information; In a case where the initial verification result indicates that the credential is valid, verifying the executable nature of the operation statement identifier, the accessibility of a target access data source corresponding to the target access data source attribute information, and a permission relationship between the credential identifier and the target access data source based on the access rule object to obtain a target verification result; In a case where the target verification result indicates that the verification is passed, obtaining target access data source connection information corresponding to the target access data source attribute information from the access rule object, and connecting the target access data source; For the target access data source, executing an operation statement corresponding to the operation statement identifier to obtain an execution result.

2. The method of claim 1, wherein, The access rule object comprises a data source file object, an operation statement object, and a permission rule object; The verifying the executable nature of the operation statement identifier, the accessibility of the target access data source corresponding to the target access data source attribute information, and the permission relationship between the credential identifier and the target access data source based on the access rule object to obtain a target verification result comprises: Verifying the accessibility of the target access data source corresponding to the target access data source attribute information based on the data source file object to obtain a first verification result; In a case where the first verification result indicates that the target access data source is accessible, verifying the permission relationship between the credential identifier and the target access data source based on the permission rule object to obtain a second verification result; In a case where the second verification result indicates that the verification is passed, verifying the executable nature of the operation statement identifier based on the operation statement object to obtain a third verification result; In a case where the third verification result indicates that the operation statement identifier is executable, obtaining the target verification result indicating that the verification is passed.

3. The method of claim 2, wherein, The permission rule object stores a preset permission relationship between a preset credential identifier and a preset data source; The verifying the permission relationship between the credential identifier and the target access data source based on the permission rule object to obtain a second verification result comprises: In a case where the preset permission relationship includes a permission relationship between the credential identifier and the target access data source, obtaining the second verification result indicating that the verification is passed; In a case where the preset permission relationship does not include a permission relationship between the credential identifier and the target access data source, obtaining the second verification result indicating that the verification is not passed.

4. The method of claim 2, wherein, The blockchain comprises a plurality of data source file objects, and each data source file object stores data source attribute information corresponding to a preset data source; The verifying the accessibility of the target access data source corresponding to the target access data source attribute information based on the data source file object to obtain a first verification result comprises: In the case that the target access data source attribute information is included in the data source attribute information of each of the plurality of data sources, a first check result indicating that the target access data source is accessible is obtained. In the case that the target access data source attribute information is not included in the data source attribute information of each of the plurality of data sources, a first check result indicating that the target access data source is not accessible is obtained.

5. The method of claim 1, wherein, The target access data source is connected by obtaining, from the access rule object, target access data source connection information corresponding to the target access data source attribute information. The target access data source is connected by obtaining, from the access rule object, target access data source connection information corresponding to the target access data source attribute information. The target access data source is connected by obtaining, from the access rule object, target access data source connection information corresponding to the target access data source attribute information. The target access data source is connected by obtaining, from the access rule object, target access data source connection information corresponding to the target access data source attribute information.

6. The method of claim 1, wherein, The operation statement corresponding to the operation statement identifier is executed on the target access data source to obtain an execution result, including: The operation statement corresponding to the operation statement identifier is obtained from the operation statement object. The operation statement is executed on the target access data source to obtain an initial execution result. The initial execution result is filtered based on the permission rule object to obtain a filtered execution result.

7. The method of claim 6, wherein, The permission rule object further includes accessible row permission information and accessible column permission information corresponding to a preset credential identifier, and the initial execution result includes row data and column data. The row data is filtered based on the accessible row permission information corresponding to the preset credential identifier to obtain target row data. The column data is filtered based on the accessible column permission information corresponding to the preset credential identifier to obtain target column data. The filtered execution result is obtained based on the target row data and the target column data. The method further includes:

8. The method of claim 1, wherein, The object attribute information of the target object, the target access data source, the execution result, and the execution time are packaged and stored on the blockchain. The device includes:

9. An access request processing apparatus characterized by comprising: A response module is configured to respond to an access request of a target object, and to check credential information carried by the access request based on credential validity period information on a blockchain to obtain an initial check result, wherein the blockchain stores an access rule object, and the credential information includes a credential identifier, an operation statement identifier, and target access data source attribute information. A check module is configured to, in the case that the initial check result indicates that the credential is valid, check the executability of the operation statement identifier, the accessibility of a target access data source corresponding to the target access data source attribute information, and a permission relationship between the credential identifier and the target access data source based on the access rule object to obtain a target check result. A connection module is configured to, in the case that the target check result indicates that the check is passed, obtain target access data source connection information corresponding to the target access data source attribute information from the access rule object, and connect the target access data source. ​ An accessing module is configured to access the target data source, execute an operation statement corresponding to the operation statement identifier, and obtain an execution result. 10.An electronic device, comprising: one or more processors; memory storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method of any of claims 1-8. 11.A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method of any of claims 1-8. 12.A computer program product comprising a computer program that, when executed by a processor, performs the method of any of claims 1-8.

Images