Data processing method and device based on rule engine, equipment and medium
By using a rule-based data processing method, the limitations of traditional access control models in complex enterprise business scenarios are overcome, enabling flexible access configuration and dynamic data filtering, thereby improving the security and efficiency of data processing.
Patent Information
- Application Number
- CN202511353527.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-22
- Publication Date
- 2025-12-16
AI Technical Summary
Traditional access control models such as RBAC struggle to handle fine-grained dynamic permissions in complex enterprise business scenarios, leading to high development and maintenance costs and increasing the risk of data breaches and leaks. They also cannot dynamically attach filtering conditions at the database query layer.
A data processing method based on a rule engine is adopted. By pre-configuring permission rule expressions, a rule engine such as Drools or Easy Rules is used for matching to achieve dynamic permission control, intercept operation requests, and perform data processing operations based on the matching results.
It enables flexible permission rule configuration, reduces the maintenance cost of rule changes, improves the security and efficiency of data processing, reduces data risks, and adapts to complex and ever-changing business scenarios.
Smart Images
Figure CN121145238A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data security technology, and in particular to a data processing method, apparatus, device, and medium based on a rule engine. Background Technology
[0002] In today's enterprise IT environment, the requirements for data processing security and flexibility are increasing. Access control, as a core mechanism for data processing security, directly impacts data processing quality. Traditional access control models, such as RBAC (Role-Based Access Control), achieve control by mapping users to roles and assigning fixed permissions to roles, which can meet the needs of scenarios with simple and fixed permission logic. However, as enterprise business complexity increases, the limitations of this model become increasingly apparent. Due to the deep coupling between permission logic and business code, changes in business rules require code modification and system redeployment, resulting in high development and maintenance costs and slow response to business needs. Furthermore, this model struggles to handle fine-grained dynamic permissions based on data attributes, typically requiring a large number of hard-coded conditional statements at the business layer. In data list query scenarios, it can only determine "access permission is allowed," unable to dynamically attach filtering conditions at the database query layer, such as "only reports created by the user can be viewed," easily leading to unauthorized data leaks.
[0003] In summary, how to meet data processing requirements through appropriate permission rule configuration is a pressing technical problem that needs to be solved. Summary of the Invention
[0004] In view of this, the purpose of this invention is to provide a data processing method, apparatus, device, and medium based on a rule engine, capable of fulfilling data processing requirements through adapted permission rule configuration. The specific solution is as follows:
[0005] Firstly, this application provides a data processing method based on a rules engine, including:
[0006] Determine the pre-configured permission rule expression for the target enterprise application system, and obtain the target user's target operation request for the target enterprise application system;
[0007] Intercept the target operation request and determine the target context information corresponding to the target operation request;
[0008] Based on the operation scenario corresponding to the target operation request, several candidate permission rule expressions are selected from the permission rule expressions, and the target context information is matched with the candidate permission rule expressions using a rule engine to obtain the corresponding matching results.
[0009] Based on the matching results, perform corresponding data processing operations on the data in the target enterprise application system.
[0010] Optionally, before determining the pre-configured permission rule expression for the target enterprise application system, the method further includes:
[0011] The target rule configuration interface is determined based on a preset graphical interface or a preset scripted interface.
[0012] Through the target rule configuration interface, configure the permission rule expression according to the preset syntax format, preset user attribute variables, preset operation type variables, and preset data object attribute variables.
[0013] Optionally, intercepting the target operation request includes:
[0014] Based on aspect-oriented programming technology, or by configuring a target interceptor corresponding to the target enterprise application system using a preset filter, the target interceptor is used to intercept the target operation request;
[0015] Accordingly, determining the target context information corresponding to the target operation request includes:
[0016] The target interceptor is used to determine the target context information corresponding to the target operation request.
[0017] Optionally, determining the target context information corresponding to the target operation request using the target interceptor includes:
[0018] The target interceptor is used to obtain the target identity information corresponding to the target user from the target operation request; the target identity information includes the target ID, target role, and target department corresponding to the target user.
[0019] The target interceptor is used to parse the HTTP request corresponding to the target operation request, and the target operation type is determined based on the parsing result; the target operation type includes read, add, update, and delete.
[0020] The target interceptor determines the target data object corresponding to the target operation request based on the target operation type, and encapsulates the target identity information, the target operation type, and the target data object into the target context information.
[0021] Optionally, the step of selecting several candidate permission rule expressions from the permission rule expressions based on the operation scenario corresponding to the target operation request includes:
[0022] Using the target interceptor, the operation scenario corresponding to the target operation request is determined based on the target URL path corresponding to the target context information and the target operation type, and several candidate permission rule expressions are selected from the permission rule expressions based on the operation scenario corresponding to the target operation request.
[0023] Optionally, the step of using a rule engine to match the target context information with the candidate permission rule expression to obtain the corresponding matching result includes:
[0024] The candidate permission rule expression is loaded into the working memory of the rule engine, and the target context information is input into the session of the rule engine; the rule engine is either the Drools rule engine or the Easy Rules rule engine.
[0025] Using the rule engine, the candidate permission rule expression in the working memory is matched with the target context information in the session to obtain the matching result; the matching result is a boolean value or a target data filtering condition.
[0026] Accordingly, performing corresponding data processing operations on the data in the target enterprise application system based on the matching result includes:
[0027] Based on the matching results, a target permission rule expression is determined from the candidate permission rule expressions, and corresponding data processing operations are performed on the data in the target enterprise application system based on the target permission rule expression.
[0028] Optionally, the step of determining the target permission rule expression from the candidate permission rule expressions based on the matching result, and performing corresponding data processing operations on the data in the target enterprise application system based on the target permission rule expression, includes:
[0029] If the matching result is a Boolean value and the Boolean value is yes, then the candidate permission rule expression corresponding to the matching result is determined as the target permission rule expression, and corresponding data processing operations are performed on the data in the target enterprise application system based on the priority corresponding to the target permission rule expression;
[0030] If the matching result is the target data filtering condition, then the candidate permission rule expression corresponding to the matching result is determined as the target permission rule expression, and the query statement fragment corresponding to the target permission rule expression is determined. Based on the query statement fragment and the target operation request, the target query statement is determined, and the data in the target database of the target enterprise application system is processed accordingly based on the priority corresponding to the target permission rule expression and the target query statement.
[0031] Secondly, this application provides a data processing apparatus based on a rules engine, comprising:
[0032] The operation request acquisition module is used to determine the permission rule expression pre-configured for the target enterprise application system and acquire the target user's target operation request for the target enterprise application system.
[0033] The context information determination module is used to intercept the target operation request and determine the target context information corresponding to the target operation request;
[0034] The matching result determination module is used to filter out several candidate permission rule expressions from the permission rule expressions based on the operation scenario corresponding to the target operation request, and use the rule engine to match the target context information with the candidate permission rule expressions to obtain the corresponding matching result;
[0035] The data processing module is used to perform corresponding data processing operations on the data in the target enterprise application system based on the matching results.
[0036] Thirdly, this application provides an electronic device, comprising:
[0037] Memory, used to store computer programs;
[0038] A processor is used to execute the computer program to implement the aforementioned data processing method based on a rules engine.
[0039] Fourthly, this application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned data processing method based on a rule engine.
[0040] In this application, firstly, a pre-configured permission rule expression for the target enterprise application system is determined, and the target user's target operation request for the target enterprise application system is obtained. Then, the target operation request is intercepted, and the target context information corresponding to the target operation request is determined. Subsequently, based on the operation scenario corresponding to the target operation request, several candidate permission rule expressions are selected from the permission rule expressions, and a rule engine is used to match the target context information with the candidate permission rule expressions to obtain the corresponding matching results. Finally, based on the matching results, corresponding data processing operations are performed on the data in the target enterprise application system. As can be seen, this application configures volatile permission rules in the form of rule expressions, decoupling them from core business code. When business rules change, the administrator only needs to modify the rule expression for it to take effect, without needing to modify, test, or redeploy the application. In this way, this application can achieve flexible configuration of permission rules, thereby accurately matching the permission requirements of different operation scenarios, effectively improving the security and efficiency of data processing, and reducing data risks caused by improper permission management. At the same time, this application can reduce maintenance costs when rules change, making the data processing of enterprise application systems more adaptable to complex and ever-changing business scenarios. Attached Figure Description
[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0042] Figure 1 A flowchart of a data processing method based on a rule engine is provided for this application;
[0043] Figure 2 A flowchart of a specific data processing method based on a rule engine is provided for this application;
[0044] Figure 3 A schematic diagram of a data processing device based on a rule engine is provided for this application;
[0045] Figure 4 This application provides a structural diagram of an electronic device. Detailed Implementation
[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0047] In today's enterprise IT environment, the requirements for data processing security and flexibility are increasing. Access control, as a core mechanism for data processing security, directly impacts data processing quality. Traditional access control models, such as RBAC, achieve control by mapping users to roles and assigning fixed permissions to roles, which can meet the needs of scenarios with simple and fixed permission logic. However, as enterprise business complexity increases, the limitations of this model become increasingly apparent. Due to the deep coupling between permission logic and business code, changes in business rules require code modification and system redeployment, resulting in high development and maintenance costs and slow response to business needs. Furthermore, this model struggles to handle fine-grained dynamic permissions based on data attributes, typically requiring a large number of hard-coded conditional statements at the business layer. Moreover, in data list query scenarios, it can only determine "access permission," unable to dynamically attach filtering conditions at the database query layer, easily leading to data leakage due to unauthorized access. Therefore, this application provides a data processing solution based on a rule engine, capable of meeting data processing requirements through adapted permission rule configurations.
[0048] See Figure 1 As shown in the figure, this embodiment of the invention discloses a data processing method based on a rule engine, which may include:
[0049] Step S11: Determine the pre-configured permission rule expression for the target enterprise application system, and obtain the target user's target operation request for the target enterprise application system.
[0050] In this embodiment, first, it is necessary to determine the target rule configuration interface based on a preset graphical interface or a preset scripting interface; then, through the target rule configuration interface, a permission rule expression can be configured according to a preset syntax format, preset user attribute variables, preset operation type variables, and preset data object attribute variables. That is, an administrator can write and store a permission rule expression through the target rule configuration interface according to business security requirements. Specifically, the permission rule expression is not a simple permission identifier, but a logical conditional statement written in a preset syntax format, such as the DRL (Deep Reinforcement Learning) language of Drools, MVEL (MVFLEX Expression Language), or an expression syntax similar to Java. The variables in the permission rule expression are dynamic placeholders that can be mapped to specific values in the running context of the target enterprise application system. The variables include at least three categories:
[0051] (1) User attribute variables: such as user.department, user.role, user.id, etc.
[0052] (2) Operation type variables: such as action.type, which can be enumerated values such as 'READ', 'WRITE', 'DELETE', etc.
[0053] (3) Data object attribute variables: such as data.owner, data.amount, data.status, etc.
[0054] For example, a permission rule expression can be written as: action.type == 'READ' && (user.department == data.department && data.amount <1000000> || user.role == 'CEO'). The specific meaning of this expression is: when the operation type performed by the user is reading, the operation is allowed only when one of the following two conditions is met: (1) the department to which the user belongs is the same as the department to which the data belongs, and the data amount is less than 1 million; (2) the user role is CEO.
[0055] Meanwhile, in this embodiment, a target operation request related to protected resources in the target enterprise application system can be received in real time from a target user.
[0056] Step S12: Intercept the target operation request and determine the target context information corresponding to the target operation request.
[0057] In this embodiment, when a user initiates a target operation request to the target enterprise application system, the target operation request needs to be intercepted. The specific process may include: firstly, configuring a target interceptor corresponding to the target enterprise application system based on aspect-oriented programming (AOP) or a preset filter, and then using the target interceptor to intercept the target operation request. That is, in this embodiment, the target interceptor can be implemented in the form of AOP or a filter, and deployed to the key business interface entry point of the target enterprise application system. The target interceptor can listen for all user operation requests in real time, such as HTTP API (Hypertext Transfer Protocol Application Programming Interface) requests. Once an operation request related to protected resources in the target enterprise application system is detected, it is immediately intercepted, and subsequent business logic is not executed.
[0058] It should be noted that in this embodiment, a target interceptor can be used to determine the target context information corresponding to the target operation request. The specific process may include: first, using the target interceptor to obtain the target identity information corresponding to the target user from the target operation request; the target identity information includes the target ID, target role, and target department of the target user; then, using the target interceptor to parse the HTTP (Hypertext Transfer Protocol) request corresponding to the target operation request, and determining the target operation type based on the parsing result; the target operation type includes read, add, update, and delete; finally, using the target interceptor to determine the target data object corresponding to the target operation request based on the target operation type, and encapsulating the target identity information, target operation type, and target data object into target context information. Specifically, the target interceptor can obtain the target identity information of the authenticated target user from the target operation request of the current session and the context of the security framework, including the user's ID, role, and department. Then, the target interceptor can parse the HTTP request method corresponding to the target operation request to determine the target operation type, such as GET for read, POST for add, PUT for update, and DELETE for delete; simultaneously, the target operation type can be determined by combining the explicitly specified operation type from the parameters of the target operation request. Subsequently, if the target operation request is for an add or update operation, the target interceptor can extract the data entity or its unique identifier from the target operation request to identify the target data object. If the target operation request is for a read or delete operation, the target interceptor can extract the query conditions or data ID from the query parameters or path parameters of the target operation request to identify the target data object. Finally, the target interceptor can be used to construct target context information based on the target identity information, the target operation type, and the target data object.
[0059] Step S13: Based on the operation scenario corresponding to the target operation request, select several candidate permission rule expressions from the permission rule expressions, and use the rule engine to match the target context information with the candidate permission rule expressions to obtain the corresponding matching results.
[0060] In this embodiment, the target interceptor can retrieve and obtain candidate permission rule expressions applicable to the current operation scenario from pre-configured permission rule expressions. The specific process may include: using the target interceptor, determining the operation scenario corresponding to the target operation request based on the target URL (Uniform Resource Locator) path and target operation type corresponding to the target context information, and filtering out several candidate permission rule expressions from the permission rule expressions based on the operation scenario corresponding to the target operation request. In one specific implementation, the target URL path to be accessed, the target operation type, and the data entity type corresponding to the target context information can be used as filtering conditions to accurately retrieve one or more candidate permission rule expressions applicable to the current operation scenario from the pre-configured permission rule expressions. For example, only the permission rule expression defined for the READ operation of the Project entity can be retrieved.
[0061] In this embodiment, target context information and candidate permission rule expressions can be used as input, and a rule engine can be used for rule matching. The specific process can include: first, loading the candidate permission rule expressions into the working memory of the rule engine, and inputting the target context information into the rule engine's session; the rule engine is either the Drools rule engine or the Easy Rules rule engine; then, using the rule engine, matching the candidate permission rule expressions in the working memory with the target context information in the session to obtain a matching result; the matching result is a boolean value or a target data filtering condition. Specifically, after receiving the target context information and candidate permission rule expressions, the rule engine processes them as follows:
[0062] (1) Loading and parsing: Load the candidate permission rule expressions into the working memory of the rule engine.
[0063] (2) Fact insertion: Insert the target context information as a fact into the rule engine session.
[0064] (3) Pattern matching: The rule engine matches the pattern in the candidate permission rule expression with the facts in the current session to obtain the matching result.
[0065] The matching results output by the rule engine are divided into the following two types:
[0066] (1) Boolean value, True / False, directly indicates whether the operation is allowed; for example, the matching result of the rule user.id==data.ownerId is a boolean value.
[0067] (2) Data filtering conditions are used to filter the query result set; for example, the rule engine can output filtering conditions such as {"department": "Sales", "region": "North"}.
[0068] In this way, this embodiment can both determine the access level of an operation and control the visibility of data content, demonstrating a dual capability in terms of control granularity.
[0069] Step S14: Perform corresponding data processing operations on the data in the target enterprise application system based on the matching results.
[0070] Understandably, after the rule engine outputs the matching results, it needs to determine the target permission rule expression from the candidate permission rule expressions based on the matching results, and then perform corresponding data processing operations on the data in the target enterprise application system based on the target permission rule expression. Specifically, the rule engine activates all successfully matched target permission rule expressions and puts them into the execution agenda. Afterwards, it can perform corresponding data processing operations on the data in the target enterprise application system according to the priority of the target permission rule expressions.
[0071] In this embodiment, the target interceptor can perform corresponding data processing operations based on the matching results output by the rule engine. In one specific implementation, the process of determining the target permission rule expression from candidate permission rule expressions based on the matching results, and performing corresponding data processing operations on the data in the target enterprise application system based on the target permission rule expression, can include: if the matching result is a boolean value and the boolean value is yes, then the candidate permission rule expression corresponding to the matching result is determined as the target permission rule expression, and corresponding data processing operations are performed on the data in the target enterprise application system based on the priority corresponding to the target permission rule expression. Specifically, if the matching result is a boolean value False, the request processing flow is immediately terminated, an "access denied" message is returned to the client, and the process ends. If the matching result is a boolean value True, it indicates that the permission verification is successful, the target interceptor allows the target operation request, and performs corresponding data processing operations on the data in the target enterprise application system based on the priority corresponding to the target permission rule expression.
[0072] In another specific implementation, the process of determining the target permission rule expression from candidate permission rule expressions based on the matching result, and performing corresponding data processing operations on the data in the target enterprise application system based on the target permission rule expression, may include: if the matching result is a target data filtering condition, then determining the candidate permission rule expression corresponding to the matching result as the target permission rule expression, determining the query statement fragment corresponding to the target permission rule expression, determining the target query statement based on the query statement fragment and the target operation request, and performing corresponding data processing operations on the data in the target database of the target enterprise application system based on the priority corresponding to the target permission rule expression and the target query statement. Specifically, if the matching result is a target data filtering condition, the target interceptor first allows the target operation request and simultaneously passes the target permission rule expression corresponding to the target data filtering condition to the data access adaptation module. The data access adaptation module is responsible for translating the abstract target data filtering condition, such as {"ownerId": currentUser.id}, into a query statement fragment specific to the underlying database, such as a WHERE clause fragment of an SQL statement, for example, WHERE owner_id=123, and dynamically concatenating the query statement fragment to the original query statement corresponding to the target operation request to obtain the target query statement. Finally, based on the priority of the target permission rule expression and the target query statement, corresponding data processing operations are performed on the data in the target database of the target enterprise application system. This ensures that only data matching the target permission rule expression is retrieved from the database and returned to the user. This step implements native data filtering at the database level, fundamentally ensuring data security and avoiding the performance and security risks associated with extensive data filtering at the application layer.
[0073] In this embodiment, see Figure 2As shown, the specific process of the rule engine-based data processing solution is as follows: First, the administrator configures permission rules in the "Rule Configuration Module," such as rules specifying "which users and what operations can access which data." When a user initiates an operation request to access the enterprise application system, the "Access Control Interceptor" intercepts the request and constructs a context corresponding to the request, which is then passed to the "Rule Configuration Module." Next, the "Rule Configuration Module" retrieves the permission rules matching the current scenario based on the context and passes them to the "Rule Engine Module." The Rule Engine Module uses the context and the permission rules matching the current scenario to perform calculations: if the permission verification fails, user access is denied; if the verification passes, access to the enterprise application system is granted directly; if permission filtering conditions are generated, they are handed over to the "Data Access Adaptation Module." The Data Access Adaptation Module generates an SQL query statement based on the permission filtering conditions and the operation request, and queries the corresponding data from the enterprise application system's database. Finally, the enterprise application system returns the business data to the user. It should be noted that the above rule engine-based data processing solution includes a rule engine-based access control system, specifically including:
[0074] Rule configuration module: Provides a graphical or scripted interface for administrators to configure and store permission rule expressions; permission rule expressions are logical judgment statements written in a specific syntax, and their variables can include user attributes, operation types, and attributes of the data objects to be accessed;
[0075] Access control interceptor: Deployed in the business interface layer of enterprise application system, it is used to intercept user operation requests, and obtain the current user information, operation type and target data object associated with the operation request according to the operation request, construct a context information object, and call the rule engine module;
[0076] Rule Engine Module: As the core computing unit, it has a built-in rule interpreter and executor. It receives the input context information and permission rule expression, performs parsing and calculation, and returns the calculation result of Boolean value or data filtering condition.
[0077] Data access adaptation module: interacts with the data persistence layer of enterprise application systems, receives data filtering conditions returned by the rules engine module, converts them into specific database query languages, such as the WHERE clause of SQL, and dynamically appends them to the original data query operation.
[0078] As can be seen from the above, this embodiment first determines the pre-configured permission rule expression for the target enterprise application system and obtains the target user's target operation request for the target enterprise application system; then, it intercepts the target operation request and determines the target context information corresponding to the target operation request; subsequently, based on the operation scenario corresponding to the target operation request, it filters out several candidate permission rule expressions from the permission rule expressions, and uses a rule engine to match the target context information with the candidate permission rule expressions to obtain the corresponding matching results; finally, it performs corresponding data processing operations on the data in the target enterprise application system according to the matching results. As can be seen from the above, this embodiment configures the volatile permission rules in the form of rule expressions, decoupling them from the core business code. When business rules change, the administrator only needs to modify the rule expression for it to take effect, without needing to modify, test, or redeploy the application. In this way, this embodiment can achieve flexible configuration of permission rules, thereby accurately matching the permission requirements of different operation scenarios, effectively improving the security and efficiency of data processing, and reducing data risks caused by improper permission management. At the same time, this embodiment can reduce the maintenance cost when rules change, making the data processing of the enterprise application system more adaptable to complex and ever-changing business scenarios.
[0079] Accordingly, see Figure 3 As shown in the embodiments of this application, a data processing device based on a rule engine is also provided, which may include:
[0080] The operation request acquisition module 11 is used to determine the permission rule expression pre-configured for the target enterprise application system and acquire the target user's target operation request for the target enterprise application system.
[0081] The context information determination module 12 is used to intercept the target operation request and determine the target context information corresponding to the target operation request;
[0082] The matching result determination module 13 is used to filter out several candidate permission rule expressions from the permission rule expressions based on the operation scenario corresponding to the target operation request, and use the rule engine to match the target context information with the candidate permission rule expressions to obtain the corresponding matching result;
[0083] The data processing module 14 is used to perform corresponding data processing operations on the data in the target enterprise application system according to the matching result.
[0084] In some specific embodiments, the rule engine-based data processing device may further include:
[0085] The rule configuration interface determination module is used to determine the target rule configuration interface based on a preset graphical interface or a preset scripted interface.
[0086] The permission rule expression configuration module is used to configure the permission rule expression through the target rule configuration interface according to the preset syntax format, preset user attribute variables, preset operation type variables and preset data object attribute variables.
[0087] In some specific embodiments, the context information determination module 12 may include:
[0088] The request interception unit is used to configure the target interceptor corresponding to the target enterprise application system based on aspect-oriented programming technology or a preset filter, and to use the target interceptor to intercept the target operation request;
[0089] Accordingly, the context information determination module 12 may include:
[0090] The context information determination submodule is used to determine the target context information corresponding to the target operation request using the target interceptor.
[0091] In some specific implementations, the context information determination submodule may include:
[0092] An identity information acquisition unit is used to acquire target identity information corresponding to the target user from the target operation request using the target interceptor; the target identity information includes the target ID, target role, and target department corresponding to the target user.
[0093] An operation type determination unit is used to parse the HTTP request corresponding to the target operation request using the target interceptor, and determine the target operation type based on the parsing result; the target operation type includes read, add, update, and delete;
[0094] The context information determination unit is used to determine the target data object corresponding to the target operation request based on the target operation type using the target interceptor, and to encapsulate the target identity information, the target operation type and the target data object into the target context information.
[0095] In some specific embodiments, the matching result determination module 13 may include:
[0096] The permission rule expression filtering unit is used to use the target interceptor to determine the operation scenario corresponding to the target operation request based on the target URL path corresponding to the target context information and the target operation type, and to filter out a number of candidate permission rule expressions from the permission rule expressions based on the operation scenario corresponding to the target operation request.
[0097] In some specific embodiments, the matching result determination module 13 may include:
[0098] The permission rule expression loading unit is used to load the candidate permission rule expression into the working memory of the rule engine and input the target context information into the session of the rule engine; the rule engine is either the Drools rule engine or the Easy Rules rule engine.
[0099] The matching result determination unit is used to use the rule engine to match the candidate permission rule expression in the working memory with the target context information in the session to obtain the matching result; the matching result is a boolean value or a target data filtering condition.
[0100] Accordingly, the data processing module 14 may include:
[0101] The data processing submodule is used to determine the target permission rule expression from the candidate permission rule expressions based on the matching results, and to perform corresponding data processing operations on the data in the target enterprise application system based on the target permission rule expression.
[0102] In some specific embodiments, the data processing submodule may include:
[0103] The first data processing unit is configured to determine the candidate permission rule expression corresponding to the matching result as the target permission rule expression if the matching result is a Boolean value and the Boolean value is yes, and to perform corresponding data processing operations on the data in the target enterprise application system based on the priority corresponding to the target permission rule expression;
[0104] The second data processing unit is configured to, if the matching result is a target data filtering condition, determine the candidate permission rule expression corresponding to the matching result as the target permission rule expression, determine the query statement fragment corresponding to the target permission rule expression, determine the target query statement based on the query statement fragment and the target operation request, and perform corresponding data processing operations on the data in the target database of the target enterprise application system based on the priority corresponding to the target permission rule expression and the target query statement.
[0105] Furthermore, embodiments of this application also disclose an electronic device, Figure 4This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the rule engine-based data processing method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.
[0106] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol that can be used in the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.
[0107] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.
[0108] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the rule engine-based data processing method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.
[0109] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned data processing method based on a rule engine. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.
[0110] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.
[0111] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0112] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.
[0113] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0114] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A data processing method based on a rule engine, characterized in that, include: Determine the pre-configured permission rule expression for the target enterprise application system, and obtain the target user's target operation request for the target enterprise application system; Intercept the target operation request and determine the target context information corresponding to the target operation request; Based on the operation scenario corresponding to the target operation request, several candidate permission rule expressions are selected from the permission rule expressions, and the target context information is matched with the candidate permission rule expressions using a rule engine to obtain the corresponding matching results. Based on the matching results, perform corresponding data processing operations on the data in the target enterprise application system.
2. The data processing method based on a rule engine according to claim 1, characterized in that, Before determining the pre-configured permission rule expression for the target enterprise application system, the method further includes: The target rule configuration interface is determined based on a preset graphical interface or a preset scripted interface. Through the target rule configuration interface, configure the permission rule expression according to the preset syntax format, preset user attribute variables, preset operation type variables, and preset data object attribute variables.
3. The data processing method based on a rule engine according to claim 1, characterized in that, The interception of the target operation request includes: Based on aspect-oriented programming technology, or by configuring a target interceptor corresponding to the target enterprise application system using a preset filter, the target interceptor is used to intercept the target operation request; Accordingly, determining the target context information corresponding to the target operation request includes: The target interceptor is used to determine the target context information corresponding to the target operation request.
4. The data processing method based on a rule engine according to claim 3, characterized in that, The step of determining the target context information corresponding to the target operation request using the target interceptor includes: The target interceptor is used to obtain the target identity information corresponding to the target user from the target operation request; the target identity information includes the target ID, target role, and target department corresponding to the target user. The target interceptor is used to parse the HTTP request corresponding to the target operation request, and the target operation type is determined based on the parsing result; the target operation type includes read, add, update, and delete. The target interceptor determines the target data object corresponding to the target operation request based on the target operation type, and encapsulates the target identity information, the target operation type, and the target data object into the target context information.
5. The data processing method based on a rule engine according to claim 4, characterized in that, The step of selecting several candidate permission rule expressions from the permission rule expressions based on the operation scenario corresponding to the target operation request includes: Using the target interceptor, the operation scenario corresponding to the target operation request is determined based on the target URL path corresponding to the target context information and the target operation type, and several candidate permission rule expressions are selected from the permission rule expressions based on the operation scenario corresponding to the target operation request.
6. The data processing method based on a rule engine according to any one of claims 1 to 5, characterized in that, The step of using a rule engine to match the target context information with the candidate permission rule expression to obtain the corresponding matching results includes: The candidate permission rule expression is loaded into the working memory of the rule engine, and the target context information is input into the session of the rule engine; the rule engine is either the Drools rule engine or the Easy Rules rule engine. Using the rule engine, the candidate permission rule expressions in the working memory are matched with the target context information in the session to obtain the matching result; the matching result is a boolean value or a target data filtering condition. Accordingly, performing corresponding data processing operations on the data in the target enterprise application system based on the matching result includes: Based on the matching results, a target permission rule expression is determined from the candidate permission rule expressions, and corresponding data processing operations are performed on the data in the target enterprise application system based on the target permission rule expression.
7. The data processing method based on a rule engine according to claim 6, characterized in that, The step of determining the target permission rule expression from the candidate permission rule expressions based on the matching result, and performing corresponding data processing operations on the data in the target enterprise application system based on the target permission rule expression, includes: If the matching result is a Boolean value and the Boolean value is yes, then the candidate permission rule expression corresponding to the matching result is determined as the target permission rule expression, and corresponding data processing operations are performed on the data in the target enterprise application system based on the priority corresponding to the target permission rule expression; If the matching result is the target data filtering condition, then the candidate permission rule expression corresponding to the matching result is determined as the target permission rule expression, and the query statement fragment corresponding to the target permission rule expression is determined. Based on the query statement fragment and the target operation request, the target query statement is determined, and the data in the target database of the target enterprise application system is processed accordingly based on the priority corresponding to the target permission rule expression and the target query statement.
8. A data processing device based on a rule engine, characterized in that, include: The operation request acquisition module is used to determine the permission rule expression pre-configured for the target enterprise application system and acquire the target user's target operation request for the target enterprise application system. The context information determination module is used to intercept the target operation request and determine the target context information corresponding to the target operation request; The matching result determination module is used to filter out several candidate permission rule expressions from the permission rule expressions based on the operation scenario corresponding to the target operation request, and use the rule engine to match the target context information with the candidate permission rule expressions to obtain the corresponding matching result; The data processing module is used to perform corresponding data processing operations on the data in the target enterprise application system based on the matching results.
9. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the data processing method based on a rule engine as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the data processing method based on a rule engine as described in any one of claims 1 to 7.