Data query method and device, electronic equipment, storage medium and computer program product

Abstract

The invention provides a data query method and device, electronic equipment, a storage medium and a computer program product, and relates to the technical field of data processing, the method comprises the following steps: obtaining query data, and determining first data based on query data conversion; after the first data is audited based on the audit data, querying target data in the data space based on the first data; wherein the auditing data comprises auditing features matched with the data structure of the first data. Thus, the query data is audited through the audit data, the problems of low audit efficiency and high security risk in related technologies are eliminated, the data query efficiency can be improved, and the security risk of data query is reduced.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data query method, apparatus, electronic device, storage medium, and computer program product. Background Technology

[0002] In related technologies, when using structured data for data querying, existing strategies for using structured data employ methods such as Structured Query Language (SQL) and User-Defined Functions (UDFs). These strategies require manual review of the structured data, but the skill level of these personnel is high. Manual review of structured data usage strategies places high demands on reviewers, results in long processing times, and leads to low query efficiency and high security risks. Summary of the Invention

[0003] The data query method, apparatus, electronic device, storage medium, and computer program product provided in this application embodiment can improve the efficiency of data query and reduce security risks.

[0004] The technical solution of this application is implemented as follows:

[0005] This application provides a data query method, including:

[0006] Obtain the query data, and determine the first data based on the transformation of the query data;

[0007] After the first data is approved based on the audit data, the target data is queried in the data space based on the first data; wherein, the audit data includes audit features that match the data structure of the first data.

[0008] In the above scheme, obtaining query data and converting the query data into first data includes:

[0009] The query data is parsed to obtain multiple lexical units;

[0010] An abstract syntax tree is constructed based on the lexical unit, and the abstract syntax tree is converted into first data; wherein the first data includes at least one of the following: operation object, query symbol, operator, and keyword.

[0011] In the above scheme, the audit features of the audit data include: operation object information set, query information set, operator information set, and keyword information set.

[0012] In the above scheme, after the first data is approved based on the audit data, querying the target data in the data space based on the first data includes:

[0013] Each item among the operation object, query symbol, operator, and keyword in the first data is checked and matched against the audit features of the audit data to determine the audit result;

[0014] If the audit result indicates that the audit has passed, the first data is standardized and rewritten to determine the second data;

[0015] Based on the second data, the target data is queried in the data space.

[0016] The method in the above scheme further includes:

[0017] Create a shared database in the private domain, and a shared data table in the shared database;

[0018] Configure corresponding security views for the shared database and the shared data tables; wherein, the security views are used to characterize access permissions for the shared database and the shared data tables;

[0019] Publish the shared database in the data space.

[0020] In the above scheme, the creation of a shared database in the private domain and the shared data tables in the shared database include:

[0021] Import data into an empty table in the private domain to determine the shared data table;

[0022] Create the shared database in the private domain and add the shared data table to the shared database.

[0023] The method in the above scheme further includes:

[0024] Configure corresponding sharing attributes for the shared data tables in the shared database, and configure corresponding access permissions for the data users corresponding to the shared database and the shared data tables, respectively.

[0025] This application also provides a data query method, applied to data users, including:

[0026] The system acquires query data and sends it to a data provider, which then transforms the query data to determine first data. After the first data is approved based on audit data, the system queries target data in the data space based on the first data. The audit data includes audit features that match the data structure of the first data.

[0027] This application also provides a data query device, applied to a data provider, including:

[0028] A data acquisition unit is used to acquire query data and determine first data based on the transformation of the query data;

[0029] The audit query unit is used to query target data in the data space based on the audit data after the first data has been approved based on the audit data; wherein the audit data includes audit features that match the data structure of the first data.

[0030] This application also provides a data query device, applied to a data user, including:

[0031] A data sending unit is used to acquire query data and send the query data to a data provider, so that the data provider can convert the query data to determine first data, and after the first data is approved based on the audit data, query target data in the data space based on the first data; wherein, the audit data includes audit features that match the data structure of the first data.

[0032] This application also provides an electronic device, including a first memory and a first processor. The first memory stores a computer program that can run on the first processor. When the first processor executes the computer program, it implements the steps in the method on the data provider side.

[0033] This application also provides an electronic device, including a second memory and a second processor. The second memory stores a computer program that can run on the second processor. When the second processor executes the computer program, it implements the steps in the method on the data user side.

[0034] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a first processor, implements the steps in the method on the data provider side.

[0035] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a second processor, implements the steps in the method on the data provider side.

[0036] This application also provides a computer program product, including a computer program that, when executed by a first processor, implements the steps in the method on the data provider side.

[0037] This application also provides a computer program product, including a computer program that, when executed by a second processor, implements the steps in the method on the data provider side.

[0038] In this embodiment, query data is acquired, and first data is determined based on the transformation of the query data. After the first data is approved based on the audit data, target data is queried in the data space based on the first data. The audit data includes audit features that match the data structure of the first data. In this way, by auditing the query data using the audit data, the problems of low audit efficiency and high security risks in related technologies are eliminated, thereby improving data query efficiency and reducing data query security risks. Attached Figure Description

[0039] Figure 1 Illustration of the effects of the related technologies provided in the embodiments of this application Figure 1 ;

[0040] Figure 2 Illustration of the effects of the related technologies provided in the embodiments of this application Figure 2 ;

[0041] Figure 3 Flowchart of the data query method provided in the embodiments of this application Figure 1 ;

[0042] Figure 4 Flowchart of the data query method provided in the embodiments of this application Figure 2 ;

[0043] Figure 5 A schematic diagram of the architecture of the data query method provided in the embodiments of this application;

[0044] Figure 6 Flowchart of the data query method provided in the embodiments of this application Figure 3 ;

[0045] Figure 7 Flowchart of the data query method provided in the embodiments of this application Figure 4 ;

[0046] Figure 8 Flowchart of the data query method provided in the embodiments of this application Figure 5 ;

[0047] Figure 9 Interactive illustration of the data query method provided in the embodiments of this application Figure 1 ;

[0048] Figure 10 Interactive illustration of the data query method provided in the embodiments of this application Figure 2 ;

[0049] Figure 11 Schematic diagram of the data query device provided in the embodiments of this application Figure 1 ;

[0050] Figure 12 A hardware entity illustration of an electronic device provided in the embodiments of this application. Figure 1 ;

[0051] Figure 13 Schematic diagram of the data query device provided in the embodiments of this application Figure 2 ;

[0052] Figure 14 A hardware entity illustration of an electronic device provided in the embodiments of this application. Figure 2 . Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0055] If the application documents contain similar descriptions such as "first / second", the following explanation shall be added: In the following description, the terms "first / second / third" are used only to distinguish similar objects and do not represent a specific order of objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0057] In traditional trading markets, the exclusive possession of goods is often used to control their flow and usage. However, the cost of copying plaintext data is close to zero. Once a transaction occurs, the seller not only loses control of the data but also bears security risks, leading data holders to be "unwilling to circulate" and "afraid to circulate." Promoting data circulation requires accelerating the construction of data infrastructure, establishing a trustworthy circulation system, and utilizing technologies such as multi-party secure computation and blockchain to enable suppliers to effectively manage the purpose, method, and flow of data usage. This achieves "usable but invisible," "controllable and measurable" data circulation, ensuring data security, preventing leakage risks, and making data manageable and controllable. The Data Switching Service Network (DSSN) is based on a "connectivity + computing power + capability" information service system, targeting the data element circulation market. It constructs a next-generation, intensive, and efficient data circulation infrastructure that spans industries, regions, fields, and entities, providing a low-cost, high-efficiency, and reliable circulation environment for centralized on-exchange and decentralized off-exchange transactions. It meets common needs in connectivity, computing power, security, and compliance, supporting the efficient and healthy development of the national data element circulation market.

[0058] Based on the principles of on-demand access, computing network infrastructure, secure sharing, open cooperation, and manageability and controllability, the DataNetwork aims to create a reliable integrated data and computing service network, achieving five major goals: proximity-based data access, a wide-coverage circulation network, reliable data delivery, secure, manageable, and controllable data, and full compliance and certifiability. The DataNetwork can connect multiple data providers, data demanders, and data transaction providers, providing "data logistics" services for the circulation of data commodities through a single network access point, while ensuring the secure and compliant use of data.

[0059] Data space is the core solution for achieving secure and reliable data circulation. It is a data element circulation space that connects multiple data providers and data demanders. Under the premise of ensuring the safe and compliant use of data, access to the space provides services such as information release, transaction negotiation, data trading, data clearing, audit supervision, data pricing, and billing settlement for data and data products.

[0060] The Data Strategy Center is the core of the data space, implementing data sovereignty control technology to ensure the availability, manageability, controllability, and verifiability of data during its outbound flow. The space proposes an innovative 5W3H control strategy engine, proposing standardized strategy rule protocols to achieve full lifecycle cross-domain policy implementation, and using end-to-end situational awareness technology to ensure that data remains under the control of the data provider at all times.

[0061] Combination Figure 1By extracting the 5W (Who, When, Where, What, Why) and 3H (How, How much, How feel) requirement frameworks in the data flow process, it pioneered and developed the industry's first general-purpose strategy engine core capability that simultaneously supports structured, unstructured, and semi-structured data, combined with... Figure 2 This achieves a standardized "1 set of strategy templates + 3 types of control strategies + N types of control functions," solving the problem of controlling and protecting data sovereignty according to predetermined strategies.

[0062] Beyond policy control technology, Data Space provides a mechanism for policies to flow with data throughout their entire lifecycle. It innovatively designs standardized policy rule protocols to enable policies to natively accompany data products, allowing for on-demand configuration, flexible loading, secure transmission, and mandatory execution during data flow, ensuring reasonable data operation under policy control. For different types of data product flow scenarios, Data Space provides reliable medium-security data flow services. Structured data is stored according to specific formats and organization methods, has a clearly defined data model, and is typically presented in tables, databases, etc. The use of structured data mainly involves restrictions on specific user access, data types, specific field usage, querying, and calculations. Unstructured data refers to data without a clearly defined format, typically existing in the form of text, images, audio, video, etc. Current mainstream Data Space solutions primarily support unstructured data.

[0063] In related technologies, one type of data space involves the data requester (DCE) providing structured data usage strategies such as SQL / user-defined functions (UDFs). After online review and agreement by both parties in the data transaction, the strategies are deployed within trusted containers of both parties to complete the use of structured data.

[0064] Advantages of implementing SQL queries in related technologies:

[0065] It features SQL and UDF functions, allowing the provider to audit the SQL and UDF functions used by the requester, thus providing security for data usage.

[0066] It features dynamic tracking logs, including pre-event, during-event, and post-event monitoring and loss mitigation operations for violations.

[0067] It supports a wide range of structured data sources (15 types in total, including scheduled and real-time data sources, most of which are relational databases), and has the function of synchronizing data sources in both scheduled and real-time modes.

[0068] The disadvantages of implementing SQL queries in related technologies:

[0069] Despite employing low-code development methods such as SQL and UDF functions, the structured data usage strategy still has a high barrier to entry for operators and is difficult to learn and use.

[0070] The manual review of structured data usage strategies requires data providers to manually verify how the data is used and whether the results contain any sensitive information leaks.

[0071] However, manual review has the following two problems: (1) It places high demands on the reviewers, who need to have data analysis capabilities and be able to analyze potential information leakage problems; (2) The pre-execution approval waiting time is long, and authorization from all data providers involved in the data analysis is required before the data analysis is executed, which may also lead to certain security risks.

[0072] The high barrier to entry in developing and formulating strategies for using structured data, coupled with the difficulty and high risk of manual review, leads to complex overall business processes and makes structured data difficult to use and circulate.

[0073] To address the aforementioned technical problems, this application provides a data query method. Please refer to [link to relevant documentation]. Figure 3 The following is a flowchart illustrating the data query method provided in the embodiments of this application. Figure 1 , will combine Figure 3 The steps shown are explained below:

[0074] S101. Obtain the query data and determine the first data based on the transformation of the query data.

[0075] In this embodiment, the data provider obtains the query data sent by the data requester and performs structural transformation on the query data to determine the first data. The first data has the same function as the query data; both are used to query the target data.

[0076] In this embodiment of the application, after obtaining the query data, the data provider can also verify the identity of the data requester, and only after the verification is successful will the query data be converted into the first data.

[0077] Among them, data providers can be servers, cloud servers, terminals, etc. that provide data space.

[0078] S102. After the first data is approved based on the audit data, the target data is queried in the data space based on the first data; wherein, the audit data includes audit features that match the data structure of the first data.

[0079] In this embodiment, the data provider includes audit data. The audit data includes audit features that match the data structure of the first data. The data provider can match each feature in the first data with the audit data for auditing. If each feature matches successfully, it means that the first data has passed the audit. The first data is then used to query target data in the data space.

[0080] Among them, the data space can be a shared database provided by the data provider for sharing data.

[0081] The audited data may include audited data from the Structured Data Constraints By Policy Mechanism (SCPM). SCPM allows data providers to define the usage of structured data (specifically down to all databases, tables, rows, columns, views, etc., and their usage methods) and disclosure restrictions based on fine-grained database access control. SCPM supports and ensures the secure use of structured data by defining sets of information such as operation objects, query operators, and keywords.

[0082] 1. Operation object information set: Fields in the database, including rows, columns, etc.

[0083] 2. Keyword information set: Constraints By, SECURE View, Share, etc.

[0084] 3. Query symbols are the query symbols that data users are allowed to use. They support common SQL query operations. The query symbol information set includes the following 12 query symbols:

[0085] ALL: Allows all query operators.

[0086] SELECT: Used to select data.

[0087] FROM: Specifies the table from which the data comes from.

[0088] WHERE: Add filter conditions.

[0089] GROUP BY: Groups the results.

[0090] HAVING: Filter groups, HAVING COUNT(order_id)>5.

[0091] ORDER_BY: Sort according to the specified method.

[0092] LIMIT: Limits the number of results.

[0093] JOIN: Combines data from multiple tables.

[0094] UNION: Combines the results of multiple queries.

[0095] DISTINCT: Returns a unique result.

[0096] NONE: Disallows all query operators. This is the default value to prevent accidental operations.

[0097] 4. Operators are combinations of query operators. The operator information set includes:

[0098] OR: At least one constraint must be satisfied.

[0099] xone: Only one constraint must be satisfied, and no more.

[0100] and: All constraints must be satisfied.

[0101] andSeq: All constraints must be satisfied in sequence.

[0102] In this embodiment, query data is acquired, and first data is determined based on the transformation of the query data. After the first data is approved based on the audit data, target data is queried in the data space based on the first data. The audit data includes audit features that match the data structure of the first data. In this way, by auditing the query data using the audit data, the problems of low audit efficiency and high security risks in related technologies are eliminated, thereby improving data query efficiency and reducing data query security risks.

[0103] Please see Figure 4 The following is a flowchart illustrating the data query method provided in the embodiments of this application. Figure 2 , Figure 3 The steps S101 to S102 shown can be implemented through S201 to S205, which will be explained in conjunction with the steps:

[0104] S201. Parse the query data to obtain multiple lexical units.

[0105] In this embodiment, querying data may include SQL statements. The data provider's database engine creates a new session upon receiving the incoming SQL query and then verifies the identity of the query issuer (data requester). If authentication fails, it rejects the request. The data provider decomposes the SQL statement into lexical units.

[0106] S202. Construct an abstract syntax tree based on the lexical unit, and convert the abstract syntax tree into first data; wherein the first data includes at least one of the following: operation object, query symbol, operator, and keyword.

[0107] In this embodiment, the data provider uses the parsed lexical units as nodes of an abstract syntax tree to form the abstract syntax tree, and then converts the abstract syntax tree into first data. The first data includes at least one of the following: an operation object, a query symbol, an operator, and a keyword.

[0108] Example: The query data includes: SELECT name, age FROM users WHERE age>30 AND city='Beijing';

[0109] The first set of data generated from the query might look like this:

[0110] Project(name, age)

[0111] Select(age>30AND city='Beijing')

[0112] Scan(users)

[0113] The first data indicates that data is first scanned from the users table, then the selection criteria age>30ANDcity='Beijing' are applied, and finally the name and age columns are selected.

[0114] S203. Each of the operation objects, query symbols, operators, and keywords in the first data is checked and matched against the audit features of the audit data to determine the audit result.

[0115] In this embodiment, the audit features of the audit data include: an operation object information set, a query symbol information set, an operator information set, and a keyword information set. The data provider can match the operation objects in the first data against the operation object information set of the audit data, match the query symbols in the first data against the query symbol information set of the audit data, match the operators in the first data against the operator information set of the audit data, and match the keywords against the keyword information set of the audit data. If each piece of data matched for audit can be matched with a corresponding field in the corresponding information set, the audit result is determined to be passed. If any piece of data matched for audit cannot be matched with a corresponding field in the corresponding information set, the audit result is determined to be failed.

[0116] For example, the data provider can match key operations such as Project, Select, and AND in the first data with the corresponding information set in the audit data to determine the audit result, and only proceed to the next step after the audit is passed.

[0117] S204. If the audit result indicates that the audit has passed, the first data is rewritten in a standardized manner to determine the second data.

[0118] In this embodiment of the application, after the first data is approved, the first data is rewritten in a standardized manner according to the syntax of the SQL statement to determine the second data.

[0119] In this embodiment, the data provider normalizes and rewrites the legitimate first data plan, optimizes the query expression, generates the optimal execution plan, and selects the best index and scanning method to improve query efficiency.

[0120] S205. Based on the second data, query the target data in the data space.

[0121] In this embodiment, the data provider's database engine accesses the data space according to the generated second data execution plan, processes intermediate results such as sorting and aggregation, and finally formats the processed results of the queried target data and returns them to the client. The entire process ensures that the query can be executed efficiently and accurately.

[0122] In this embodiment, an abstract syntax tree is constructed based on the lexical unit, and the abstract syntax tree is converted into first data; wherein, the first data includes at least one of the following: operation object, query symbol, operator, and keyword. This ensures a one-to-one correspondence between the data features in the first data and the information set in the review features, facilitating the matching and review of query features in the first data, eliminating the need for manual matching and review, saving time, and improving data query efficiency.

[0123] Furthermore, because the first set of data was rewritten in a standardized manner after the review was approved, the query expression was optimized, and the optimal execution plan was generated. This allowed for the selection of the best index and scanning method, thus improving query efficiency.

[0124] Please see Figure 5 This is a schematic diagram of the architecture of the data query method provided in the embodiments of this application, which will be combined with Figure 5 The following describes the solution of the embodiments of this application:

[0125] In this embodiment, the SCPM mechanism reuses the database engine as a whole. First, the database engine's session manager creates a new session for the incoming query SQL and then verifies the identity of the query issuer. If authentication fails, it rejects the request. The parser phase decomposes the SQL statement into lexical units and constructs an Abstract Syntax Tree (AST) to ensure grammatical correctness; then, the planner phase converts the AST into first data.

[0126] During the translator phase, the initial data needs to be compared with the SCPM (Structured Data Model) retrieved by the SCPM Manager using policy constraints. This involves parsing table and column names in the logical plan, checking data types, user permissions, data usage permissions, and other relevant information, and then sending this data to the SCPM Manager for verification against relevant policies to ensure the initial data is legitimate under the constraints of the data owner.

[0127] In the optimizer phase, valid initial data is normalized and rewritten to optimize query expressions, generate an optimal execution plan, and select the best indexes and scanning methods to improve query efficiency. In the execution phase, the database engine accesses data according to the generated execution plan, processes intermediate results such as sorting and aggregation, and finally, in the result return phase, the processed results are formatted and returned to the client. This entire process ensures that queries are executed efficiently and accurately.

[0128] Please see Figure 6 The following is a flowchart illustrating the data query method provided in the embodiments of this application. Figure 3 The following steps will be explained:

[0129] S301. Create a shared data table in the private domain.

[0130] In this embodiment, the data provider creates a shared database in a private domain and adds the data tables that need to be shared to the shared database.

[0131] In this embodiment of the application, the data provider imports data into an empty table in the private domain to determine the shared data table; creates the shared database in the private domain, and adds the shared data table to the shared database.

[0132] In this embodiment of the application, creating a shared data table includes: (1) Creating a data table and table structure: The data provider creates a table to be shared, or prepares an existing table, inserts data into the private table using the INSERT INTO statement or a batch import tool, and ensures the integrity and accuracy of the data. (2) Verifying the data: The completeness and accuracy of the data are verified using query and data analysis tools.

[0133] Creating shared databases and shared tables in the data provider's private domain private.schema can include the following logic:

[0134] Create the following two tables in the dpe_db.private schema and insert sample data.

[0135] (1) Contains the data to be shared and the access_id column for account control data access.

[0136] Use the "access_id" column to map shared data and the data user account that can access the data.

[0137] Use the role sysadmin.

[0138] create or replace tabledpe_db.private.data(

[0139] name string,

[0140] date date,

[0141] time time(9),

[0142] size float,

[0143] access_id string / *granularity for access* / );

[0144] insert into dpe_db.private.data

[0145] values('Apple',dateadd(day,-1,current_date()),'10:00:00',116.5,'SELL_GROUP'),

[0146] ('Apple',dateadd(month,-2,current_date()),'10:00:00',110.5,'SELL_GROUP'),

[0147] ('Banana',dateadd(day,-2,current_date()),'10:00:00',58.0,'SELL_GROUP'),

[0148] ('Orange',dateadd(day,-1,current_date()),'11:00:00',175.2,'SELL_GROUP'),

[0149] ('Orange',dateadd(month,-2,current_date()),'11:00:00',178.2,,'SELL_GROUP'),create or replace tabledpe_db.private.sharing_access(

[0150] access_id string,

[0151] dce_account string );

[0153] insert into dpe_db.private.sharing_access values('SELL_GROUP,'<DCE_account> ');

[0154] S302. Configure a corresponding security view for the shared data table; wherein the security view is used to characterize the access permissions for the shared data table.

[0155] In this embodiment of the application, the data provider can configure a corresponding security view for the shared data table, wherein the security view is used to characterize the access permissions for the data sharing database and the shared data table.

[0156] Create a security view in the public domain of the data provider.

[0157] (1) Define filtering conditions: Create security views to restrict the visibility of data as needed. Security views filter data based on specific conditions to ensure that only authorized users can see specific data.

[0158] (2) Set view permissions: Set appropriate access permissions for security views to ensure that only specific users or roles can access these views.

[0159] 2. Creating a security view in the data provider's public domain public.schema can include the following logic:

[0160] To help ensure that sensitive information is hidden from users who should not have access to it, use the SECURE keyword when creating a view.

[0161] (1) Create the following security view in dpe_db.public.schema:

[0162] create or replace secure view dpe_db.public.data as

[0163] select name,date,time,size,

[0164] from dpe_db.private.data sd

[0165] join dpe_db.private.sharing_access sa on sd.access_id=sa.access_id;

[0166] Constraint by ALL;

[0167] / / Constraint by SELECT and FROM and WHERE;

[0168] grant select on dpe_db.public.data to public;

[0169] (2) Verification table and security view

[0170] Validate tables and security views to ensure data is properly filtered by account.

[0171] / * Verify the security of tables and views using the data provider's account * /

[0172] select count(*)from dpe_db.private.data;

[0173] select*from dpe_db.private.data;

[0174] select count(*)from dpe_db.public.data;

[0175] select*from dpe_db.public.data;

[0176] select*from dpe_db.public.data where name='Apple';

[0177] / * Simulated data users verify availability * /

[0178] alter session set simulated_data_sharing_consumer='<DCE_account> '

[0179] select*from dpe_db.public.data;

[0180] S303. Create a shared database in the private domain, add the shared data table to the shared database, and publish the shared database in the data space.

[0181] In this embodiment, the data provider creates a shared database in a private domain, adds shared data tables to the shared database, and publishes the shared database in a data space. The data provider can log in to the data space, enter the name and description of the shared database and its address, define access control policies for the dataset, including who can access the dataset, access permission levels, and data usage restrictions, and finally publish the dataset.

[0182] In this embodiment of the application, the creation of a shared database by the data provider in a private domain may include:

[0183] (1) Create a shared database and shared tables to publish the dataset to data consumers.

[0184] (2) Add dataset: Add the prepared security view to the shared database and tables.

[0185] (3) Set sharing attributes: Set attributes for the user roles of the shared object, such as the name and description of the shared object.

[0186] (4) Add data consumers: First, determine which data consumer accounts can access the shared dataset, and add the data consumer accounts to the shared database and tables, granting them access to the shared dataset.

[0187] 4. Publish the database to the data space, making it visible to data consumers.

[0188] Creating a shared database can include the following logic:

[0189] (1) Use the ACCOUNTADMIN role or a role that has been granted global CREATE SHARE privileges and has OWNERSHIP privileges on the shared database.

[0190] Roles with USE privileges over the database have the WITH GRANT option. For example:

[0191] Use the role account admin;

[0192] create or replace share db_shared;

[0193] Show shares;

[0194] Add the database, schema (public), and security view to the shared database.

[0195] / / grant usage on database dpe_db to share db_shared;

[0196] grant usage on schema dpe_db.public to share db_shared;

[0197] grant select on db_shared.public.data to share db_shared;

[0198] (3) Verify the shared content. Use the SHOW GRANTS command to verify that the objects in the share have the necessary permissions.

[0199] show grants to share db_shared;

[0200] Please see Figure 7 The following is a flowchart illustrating the data query method provided in the embodiments of this application. Figure 4 The following steps will be explained:

[0201] S401. Configure corresponding sharing attributes for the shared data table in the shared database, and configure corresponding access permissions for the data users corresponding to the shared database and the shared data table, respectively.

[0202] In this embodiment, the data provider configures sharing attributes, such as the name and description of the shared data, for the shared data tables in the shared database. It also determines which data requester accounts can access the shared database or the shared data tables, adds the data requester accounts to the shared database and tables, and grants them access permissions to the shared database or the shared data tables.

[0203] In this embodiment, corresponding sharing attributes are configured for shared data tables in the shared database, and corresponding access permissions are configured for the data users corresponding to the shared database and shared data tables. This effectively restricts access to databases and data tables beyond the permissions of data requesters without the necessary privileges, ensuring data security.

[0204] Please see Figure 8 The following is a flowchart illustrating the data query method provided in the embodiments of this application. Figure 5 The following steps will be explained:

[0205] S501. Obtain query data and send the query data to the data provider, so that the data provider can convert the query data to determine the first data, and after the first data is approved based on the audit data, query the target data in the data space based on the first data; wherein, the audit data includes audit features that match the data structure of the first data.

[0206] In this embodiment, the data consumer browses available datasets within the data space through the data requester, and uses the search function to find specific datasets of interest. The consumer can view detailed information about the dataset, including its description, data provider information, and update frequency. The data consumer can input corresponding query data according to their needs, and the data requester sends the query data to the data provider. The data provider transforms the query data to determine first data, and after approving the first data based on review data, queries the target data in the data space based on the first data; wherein, the review data includes review features that match the data structure of the first data.

[0207] Among them, the data demander can be a terminal, client, etc. that shares data space with the data provider.

[0208] In this embodiment, data consumers can view detailed information about datasets within the data space through the data demander, including dataset descriptions, data provider information, and dataset update frequency. Data consumers can then select a specific dataset of interest and complete a data subscription.

[0209] In this embodiment of the application, the use of a shared database by a data user may include:

[0210] (1) Data users log in to the data space, browse and subscribe to the dataset.

[0211] (2) Connect to the database based on the information shared in the dataset, and use the structured data under the control of the policy.

[0212] In this embodiment, query data is acquired and sent to a data provider. The data provider then transforms the query data to determine first data. After the first data is approved based on audit data, the target data is queried in the data space based on the first data. The audit data includes audit features that match the data structure of the first data. In this way, the data provider audits the query data using audit data, eliminating the problems of low audit efficiency and high security risks in related technologies. This improves data query efficiency and reduces data query security risks.

[0213] Please see Figure 9 This is an interactive illustration of the data query method provided in the embodiments of this application. Figure 1 The following steps will be explained:

[0214] S11. Create data and shared data tables in the private domain.

[0215] In this embodiment of the application, the data provider creates a shared data table in the private domain and imports the data that needs to be shared into the shared data table.

[0216] S12. Create a security view in the public domain.

[0217] In this embodiment of the application, the data provider configures a security view for the data sharing table.

[0218] S13. Create a shared database.

[0219] In this embodiment, the data provider creates a shared database in a private domain, adds shared data tables to the shared database, and publishes the shared database in the data space.

[0220] S14, Discover the dataset.

[0221] In this embodiment of the application, the data consumer browses data within the data space through the data demander and discovers the required shared data table.

[0222] S15, Subscribe to the dataset.

[0223] In this embodiment of the application, data consumers can subscribe to the shared data table they require through the data demander.

[0224] S16. Use a shared database.

[0225] In this embodiment of the application, data consumers can query the data they need within the data space through the data demander and send the queried data to the data provider.

[0226] S17. Publish the dataset.

[0227] In this embodiment of the application, after receiving the query data, the data provider queries the corresponding target data locally and shares the queried target data with the data requester.

[0228] Please see Figure 10 This is an interactive illustration of the data query method provided in the embodiments of this application. Figure 2 The following steps will be explained:

[0229] S701. The data provider obtains the query data and determines the first data based on the transformation of the query data.

[0230] In this embodiment, the real-time steps of S701 can be referred to S101, and will not be described in detail here.

[0231] S702. After the data provider approves the first data based on the audit data, it queries the target data in the data space based on the first data; wherein, the audit data includes audit features that match the data structure of the first data.

[0232] In this embodiment, the real-time steps of S702 can be referred to S102, and will not be described in detail here.

[0233] Please see Figure 11 A schematic diagram of the structure of the data query device provided in the embodiments of this application. Figure 1 .

[0234] This application also provides a data query device 600, applied to a data provider, including: a data acquisition unit 601 and an audit query unit 602.

[0235] The data acquisition unit 601 is used to acquire query data and determine first data based on the query data.

[0236] The audit query unit 602 is used to query target data in the data space based on the first data after the first data has been approved based on the audit data; wherein the audit data includes audit features that match the data structure of the first data.

[0237] In this embodiment of the application, the data acquisition unit 601 in the data query device 600 is used to parse the query data to obtain multiple lexical units;

[0238] An abstract syntax tree is constructed based on the lexical unit, and the abstract syntax tree is converted into first data; wherein the first data includes at least one of the following: operation object, query symbol, operator, and keyword.

[0239] In this embodiment of the application, the audit features of the audit data include: an operation object information set, a query symbol information set, an operator information set, and a keyword information set.

[0240] In this embodiment of the application, the audit query unit 602 in the data query device 600 is used to check and match each of the operation object, query symbol, operator and keyword in the first data with the audit features of the audit data to determine the audit result;

[0241] If the audit result indicates that the audit has passed, the first data is standardized and rewritten to determine the second data;

[0242] Based on the second data, the target data is queried in the data space.

[0243] In this embodiment of the application, the data query device 600 is used to create a shared data table in a private domain;

[0244] Configure a corresponding security view for the shared data table; wherein the security view is used to characterize the access permissions for the shared data table;

[0245] Create a shared database in a private domain, add the shared data tables to the shared database, and publish the shared database in the data space.

[0246] In this embodiment of the application, the data query device 600 is used to configure corresponding shared attributes for the shared data table in the shared database, and to configure corresponding access permissions for the data users corresponding to the shared database and the shared data table, respectively.

[0247] It should be noted that, in the embodiments of this application, if the above-described data query method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a data query device (which may be a personal computer, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0248] Correspondingly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a first processor, implements the steps in the method on the data provider side.

[0249] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0250] It should be noted that, Figure 12 A hardware entity illustration of an electronic device provided in the embodiments of this application. Figure 1 ,like Figure 12As shown, this application embodiment provides an electronic device 700, including a first memory 702 and a first processor 701. The first memory 702 stores a computer program that can run on the first processor 701. When the first processor 701 executes the program, it implements the steps in the above-described method, wherein;

[0251] The first processor 701 typically controls the overall operation of the electronic device 700.

[0252] The first memory 702 is configured to store instructions and applications executable by the first processor 701, and can also cache data to be processed or already processed by the first processor 701 and various modules in the electronic device 700 (e.g., image data, audio data, voice communication data and video communication data), which can be implemented by flash memory or random access memory (RAM).

[0253] Correspondingly, this application also provides a computer program product, including a computer program that can be executed by a first processor 701 of an electronic device 700 to complete the steps in the method of the data query device 600.

[0254] Please see Figure 13 A schematic diagram of the structure of the data query device provided in the embodiments of this application. Figure 2 .

[0255] This application also provides a data query device 800, applied to a data user, including a data sending unit 801.

[0256] The data sending unit 801 is used to acquire query data and send the query data to the data provider, so that the data provider can convert the query data to determine the first data, and after the first data is approved based on the audit data, query the target data in the data space based on the first data; wherein, the audit data includes audit features that match the data structure of the first data.

[0257] Correspondingly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a second processor, implements the steps in the method on the data provider side.

[0258] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0259] It should be noted that, Figure 14 A hardware entity illustration of an electronic device provided in the embodiments of this application. Figure 2 ,like Figure 14 As shown, this application embodiment provides an electronic device 900, including a second memory 902 and a second processor 901. The second memory 902 stores a computer program that can run on the second processor 901. When the second processor 901 executes the program, it implements the steps in the above-described method, wherein;

[0260] The second processor 901 typically controls the overall operation of the electronic device 900.

[0261] The second memory 902 is configured to store instructions and applications executable by the second processor 901, and can also cache data to be processed or already processed by the second processor 901 and various modules in the electronic device 900 (e.g., image data, audio data, voice communication data, and video communication data), which can be implemented by flash memory or random access memory (RAM).

[0262] Correspondingly, this application embodiment also provides a computer program product, including a computer program that can be executed by a second processor 901 of an electronic device 900 to complete the steps in the method on one side of the data query device 800.

[0263] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0264] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0265] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the apparatus or units can be electrical, mechanical, or other forms.

[0266] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0267] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0268] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0269] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0270] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A data query method, characterized in that, Applied to data providers, including: Obtain the query data, and determine the first data based on the transformation of the query data; After the first data is approved based on the audit data, the target data is queried in the data space based on the first data; wherein, the audit data includes audit features that match the data structure of the first data.

2. The data query method according to claim 1, characterized in that, The step of obtaining query data and converting the query data into first data includes: The query data is parsed to obtain multiple lexical units; An abstract syntax tree is constructed based on the lexical unit, and the abstract syntax tree is converted into first data; wherein the first data includes at least one of the following: operation object, query symbol, operator, and keyword.

3. The data query method according to claim 1, characterized in that, The audit features of the audit data include: operation object information set, query information set, operator information set, and keyword information set.

4. The data query method according to claim 3, characterized in that, After the first data is approved based on the audit data, the process of querying the target data in the data space based on the first data includes: Each item among the operation object, query symbol, operator, and keyword in the first data is checked and matched against the audit features of the audit data to determine the audit result; If the audit result indicates that the audit has passed, the first data is standardized and rewritten to determine the second data; Based on the second data, the target data is queried in the data space.

5. The data query method according to any one of claims 1 to 4, characterized in that, The method further includes: Create a shared data table in a private domain; Configure a corresponding security view for the shared data table; wherein the security view is used to characterize the access permissions for the shared data table; Create a shared database in a private domain, add the shared data tables to the shared database, and publish the shared database in the data space.

6. The data query method according to claim 5, characterized in that, The method further includes: Configure corresponding sharing attributes for the shared data tables in the shared database, and configure corresponding access permissions for the data users corresponding to the shared database and the shared data tables, respectively.

7. A data query method, characterized in that, Applied to data users, including: The system acquires query data and sends it to a data provider, which then transforms the query data to determine first data. After the first data is approved based on audit data, the system queries target data in the data space based on the first data. The audit data includes audit features that match the data structure of the first data.

8. A data query device, characterized in that, Applied to data providers, including: A data acquisition unit is used to acquire query data and determine first data based on the transformation of the query data; The audit query unit is used to query target data in the data space based on the audit data after the first data has been approved based on the audit data; wherein the audit data includes audit features that match the data structure of the first data.

9. A data query device, characterized in that, Applied to data users, including: A data sending unit is used to acquire query data and send the query data to a data provider, so that the data provider can convert the query data to determine first data, and after the first data is approved based on the audit data, query target data in the data space based on the first data; wherein, the audit data includes audit features that match the data structure of the first data.

10. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program that can run on the processor, the processor executing the computer program to implement the steps of the method of any one of claims 1 to 6, or to implement the steps of the method of claim 7.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6, or the steps of the method according to claim 7.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6, or the steps of the method according to claim 7.

Images