Database row level authority control method and device and electronic equipment

Abstract

The invention provides a database row level authority control method and device and electronic equipment, and the method comprises the steps: obtaining data source parameters which comprise user query statements; when it is determined that the user has the basic authority for accessing the data source and the user is a non-administrator user, determining an authority rule corresponding to the user based on preset authority configuration information; performing semantic matching on the user query statement and the permission rule to obtain a matching result; and under the condition of determining that the user query statement is successfully matched with the permission rule, performing row-level query on the target database based on the user query statement to obtain a query result. According to the database row-level permission control method and device and the electronic equipment provided by the invention, semantic matching is performed on the user query statement and the corresponding permission rule, so that implicit service logic can be accurately identified, the accuracy, safety and flexibility of row-level permission control are improved, and the operation and maintenance cost is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular, to a database row-level permission control method, device and electronic equipment. BACKGROUND

[0002] With the development of big data and cloud computing technology, data access scenarios are increasingly complex, and users' demand for intelligent and dynamic permission control is significantly improved. In the field of database management, row-level permission control is one of the core technologies to protect data security. The purpose is to limit the range of accessible data rows according to user identity and permission rules to prevent unauthorized access and data leakage. Traditional database row-level permission control methods filter permissions based on field values or simple logical conditions, which have poor precision and flexibility, exist data leakage risks, are difficult to adapt to complex application scenarios, and have high operation and maintenance costs. SUMMARY

[0003] The present application provides a database row-level permission control method, device and electronic equipment to solve the defects of poor precision, security and flexibility of the prior art database row-level permission control method and high operation and maintenance costs.

[0004] The present application provides a database row-level permission control method, comprising: obtaining data source parameters, the data source parameters comprising a user query statement; in a case where it is determined that a user has a basic permission to access a data source and the user is a non-administrator user, determining a permission rule corresponding to the user based on preset permission configuration information; performing semantic matching on the user query statement and the permission rule to obtain a matching result; in a case where it is determined that the user query statement and the permission rule match successfully, performing row-level query on a target database based on the user query statement to obtain a query result.

[0005] In some embodiments, the semantic matching of the user query statement and the permission rule to obtain a matching result comprises: performing semantic encoding on the user query statement to obtain semantic features of the user query statement; processing the permission rule to extract keywords of the permission rule, the keywords comprising a table name, a control field and a condition value; matching the semantic features of the user query statement with the keywords of the permission rule to obtain a matching result.

[0006] In some embodiments, the semantic encoding of the user query statement to obtain semantic features of the user query statement comprises: input the user query statement into a pre-constructed deep learning model to obtain semantic features of the user query statement output by the deep learning model; The deep learning model is obtained based on sample user query statements and semantic feature labels of the sample user query statements.

[0007] In some embodiments, the matching of the semantic features of the user query statement with the keywords of the permission rule comprises: calculating a cosine similarity of the semantic features of the user query statement and the keywords of the permission rule; In a case where the cosine similarity is greater than a preset threshold, it is determined that the user query statement matches the permission rule successfully.

[0008] In some embodiments, the processing of the permission rule to extract the keywords of the permission rule comprises: parsing and cleaning the permission rule to obtain a structured permission rule; dynamically splicing a query statement based on the structured permission rule, and querying a unique value of a control field based on the query statement.

[0009] In some embodiments, after the data source parameter is obtained, the method further comprises: verifying, based on the data source parameter, whether the user has a basic permission to access the data source; based on the user table, verifying whether the user is a non-administrator user, in a case where it is determined that the user has the basic permission to access the data source.

[0010] In some embodiments, the data source parameter further comprises a data source identifier, a permission control identifier, and a user identifier.

[0011] In some embodiments, the training process of the deep learning model comprises: obtaining sample user query statements; determining semantic feature labels of the sample user query statements; inputting the sample user query statements into an initial deep learning model to obtain predicted semantic features of the sample user query statements output by the initial deep learning model; calculating a loss function value based on the predicted semantic features of the sample user query statements and the semantic feature labels of the sample user query statements; based on the loss function value, iteratively optimizing parameters of the initial deep learning model to obtain the deep learning model.

[0012] The application further provides a database row-level permission control device, comprising: An acquisition unit is configured to acquire data source parameters, wherein the data source parameters comprise a user query statement; A determination unit is configured to, in a case where it is determined that a user has a basic right to access a data source and the user is a non-administrator user, determine a right rule corresponding to the user based on preset right configuration information. A matching unit is configured to perform semantic matching on the user query statement and the right rule to obtain a matching result. A query unit is configured to, in a case where it is determined that the user query statement and the right rule match successfully, perform a row-level query on a target database based on the user query statement to obtain a query result.

[0013] The application further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor implements the database row-level right control method according to any one of the above embodiments when executing the program.

[0014] The database row-level right control method, device and electronic device provided by the application can accurately identify implicit business logic by acquiring data source parameters, wherein the data source parameters comprise a user query statement; in a case where it is determined that a user has a basic right to access a data source and the user is a non-administrator user, a right rule corresponding to the user is determined based on preset right configuration information; semantic matching is performed on the user query statement and the right rule to obtain a matching result; in a case where it is determined that the user query statement and the right rule match successfully, a row-level query is performed on a target database based on the user query statement to obtain a query result, thereby improving the accuracy, security and flexibility of row-level right control and reducing operation and maintenance costs. BRIEF DESCRIPTION OF DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0016] Figure 1 is a flowchart of the database row-level right control method provided by the embodiments of the application.

[0017] Figure 2 is a flowchart of the semantic matching of the user query statement and the right rule provided by the embodiments of the application.

[0018] Figure 3 is a flowchart of the training process of the deep learning model provided by the embodiments of the application.

[0019] Figure 4 is a structural schematic diagram of a database row-level permission control device provided by an embodiment of the present application.

[0020] Figure 5 is a structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0022] The terms "first", "second" and the like in the present application are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that the terms thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than that illustrated or described herein, and the objects distinguished by "first", "second" are generally of a kind, without limiting the number of objects, for example, the first object can be one or more.

[0023] At present, the traditional database row-level permission control method usually relies on hard-coded permission rules or statically spliced Structured Query Language (SQL), which has the following significant defects: (1) The traditional scheme realizes the addition, modification or deletion of permission rules by manually writing code or modifying database configuration, and when the business scenario is complex (such as multiple roles, multiple data sources, dynamic permission changes), the maintenance cost is high and errors are easy to occur. For example, when the user permission needs to be dynamically adjusted according to the department and the project, the hard-coded way is difficult to quickly respond to the demand change.

[0024] (2) The existing method can only filter permissions based on field values or simple logical conditions, and cannot understand the deep semantics of user query statements. For example, for a fuzzy query statement (such as "query high-value orders in the last three months"), the traditional scheme cannot parse the business logic (such as time range, numerical threshold) implied therein, affecting the accuracy of permission checking and the security of data access.

[0025] (3) The syntax and permission system of different databases are different, and the traditional method is usually designed for a single database, which is difficult to realize unified permission control across databases, increasing the system complexity and maintenance cost in a multi-database environment.

[0026] (4) Traditional database row-level permission control methods can only achieve coarse-grained control based on tables and fields, and cannot combine natural language processing technology to analyze query intent in a fine-grained manner. For example, a user may construct a query statement containing complex conditions (such as multi-table association queries, logical combination conditions) through natural language, and the traditional scheme is difficult to accurately match its permission range, which poses a risk of data leakage.

[0027] Traditional methods lack natural language processing capabilities and flexible permission configuration mechanisms, making it difficult to meet the needs of modern database systems for secure, efficient, and scalable row-level permission control. Therefore, there is an urgent need for a database row-level permission control method based on natural language processing technology to improve the semantic understanding ability and dynamic adaptability of permission verification and achieve fine-grained data access control.

[0028] To this end, the embodiments of the present application provide a database row-level permission control method, device and electronic equipment, by acquiring data source parameters, the data source parameters including user query statements; in the case that it is determined that the user has the basic permission to access the data source and the user is a non-administrator user, determining the permission rule corresponding to the user based on the preset permission configuration information; performing semantic matching on the user query statement and the permission rule to obtain a matching result; in the case that it is determined that the user query statement and the permission rule match successfully, performing row-level query on the target database based on the user query statement to obtain a query result. The present application can improve the accuracy, security and flexibility of row-level permission control, and reduce operation and maintenance costs.

[0029] Figure 1 The flowchart of the database row-level permission control method provided by the embodiments of the present application is shown in FIG. 1. Figure 1 As shown in FIG. 1, a database row-level permission control method is provided, which includes the following steps: step 110, step 120, step 130 and step 140. The method flow steps are only used as one possible implementation of the present application.

[0030] Step 110, acquiring data source parameters, the data source parameters including user query statements.

[0031] Among them, the data source parameters contain all the context information required by the data query request.

[0032] Among them, the user query statement refers to the original SQL query request initiated by the user (or the front-end application), and the user query statement indicates the data content and filtering conditions that the user wants to obtain.

[0033] Optionally, receiving a data query request sent by a client, and extracting data source parameters from the data query request.

[0034] In some embodiments, the data source parameters further include a data source identifier, a permission control identifier and a user identifier.

[0035] Wherein, the data source identifier is used for locating the target database and data table; the permission control identifier is a Boolean value (True / False) or an enumeration type flag, which is used as a switch of the permission control process to avoid meaningless verification; the permission control identifier is used to indicate whether the row-level permission control needs to be enabled for this query; the user identifier is associated with the user permission configuration, and is used to uniquely identify the information of the user who initiates the current data query request, and the user identifier can be a user ID, a user name or a token.

[0036] In some embodiments, after obtaining the data source parameter, the method further comprises: verifying whether the user has the basic permission to access the data source based on the data source parameter; under the condition that it is determined that the user has the basic permission to access the data source, verifying whether the user is a non-administrator user based on the user table.

[0037] Optionally, the permission verification process branch is triggered by a conditional judgment statement, and the data source without enabled permission control is directly released to improve the system processing efficiency.

[0038] Optionally, the user is verified whether to have the basic permission to access the data source based on the permission control identifier, the data source identifier and the user identifier.

[0039] Specifically, the permission control identifier is parsed, if the parsed permission control identifier is false or not set, the query stage is directly entered and the permission verification is skipped; if the parsed permission control identifier is true, the subsequent permission verification process is triggered.

[0040] Further, the permission configuration is queried based on the data source identifier and the user identifier to verify whether the user has the basic permission to access the current data source: if not authorized, the operation is terminated and a permission denial prompt is returned; if the authorization is passed, the next role recognition is entered.

[0041] Optionally, the user role is recognized by the field isAdmin (Boolean value) in the user table; if the user role is administrator (isAdmin=true), the subsequent control step is skipped and full data access is allowed; if the user role is non-administrator, the permission configuration parsing stage is entered.

[0042] Wherein, the administrator role has the highest permission by default, and bypasses the row-level permission control to support system management operations.

[0043] It can be understood that the role distinguishing mechanism enables the administrator to efficiently manage full data, and also enables the fine-grained permission filtering of ordinary users, which can simultaneously guarantee the security and convenience of data access.

[0044] In step 120, in the case that it is determined that the user has the basic permission to access the data source and the user is a non-administrator user, the permission rule corresponding to the user is determined based on the preset permission configuration information.

[0045] The preset permission configuration information supports natural language description (for example, "allow access to the employee table data of the R&D department").

[0046] The permission rule at least includes a target data table, an operation type and a condition expression, and the function of the permission rule is to automatically and transparently filter out the data rows that the current user has no access to during data query.

[0047] Optionally, the preset permission configuration information is updated to obtain updated permission configuration information.

[0048] Specifically, the preset permission configuration information is modified, added or deleted, or other update operations.

[0049] Optionally, the permission rule corresponding to the non-administrator user is determined based on the preset permission configuration information, that is, the permission rule corresponding to the user.

[0050] It should be noted that the permission rule in the embodiment of the application is not hard-coded, but is driven by data and configuration, and can be modified at any time without the need to restart the service or modify the code, and has strong flexibility and scalability.

[0051] In step 130, the user query statement is semantically matched with the permission rule to obtain a matching result.

[0052] Optionally, the user query statement is subjected to natural language processing to obtain semantic features of the user query statement, the permission rule is subjected to natural language processing to obtain semantic features of the permission rule, and the semantic features of the user query statement are matched with the semantic features of the permission rule to obtain the matching result.

[0053] Optionally, the user query statement is parsed to extract keywords of the user query statement, such as a table name, a field, a condition and the like, the permission rule is parsed to extract keywords of the permission rule, such as a table name, a control field, a condition and the like, and the keywords of the user query statement are matched with the keywords of the permission rule to obtain the matching result.

[0054] It can be understood that by analyzing the deep semantics (such as fuzzy conditions and associated logic) of the user query statement by using natural language processing technology, the implicit business logic and data association can be identified, the fine-grained permission check based on the query intent can be realized, and the risk of unauthorized access caused by inaccurate traditional syntax matching can be avoided.

[0055] Step 140, in the case that the user query statement is determined to match the permission rule successfully, performing a row-level query on the target database based on the user query statement to obtain a query result.

[0056] Optionally, a SQL query statement is dynamically constructed based on the user query statement, and a row-level query is performed on the target database based on the SQL query statement, so as to improve the query efficiency.

[0057] Optionally, a row-level query is performed on the target database based on the user query statement and the permission rule to obtain a query result.

[0058] For example, if the permission rule is "department = R&D department", "SELECT DISTINCT department FROM employee table WHERE department = R&D department" is generated.

[0059] In the embodiment of the application, by obtaining a data source parameter, the data source parameter includes a user query statement; in the case that the user has a basic permission to access the data source and the user is a non-administrator user, a permission rule corresponding to the user is determined based on preset permission configuration information; the user query statement is semantically matched with the permission rule to obtain a matching result, which can accurately identify the implicit business logic; in the case that the user query statement is determined to match the permission rule successfully, a row-level query is performed on the target database based on the user query statement to obtain a query result, which improves the accuracy, security and flexibility of the row-level permission control and reduces the operation and maintenance cost.

[0060] Figure 2 A flowchart for semantically matching the user query statement with the permission rule is provided in the embodiment of the application. As shown in Figure 2 In some embodiments, step 130 semantically matches the user query statement with the permission rule to obtain a matching result, which includes: Step 131, semantically encoding the user query statement to obtain semantic features of the user query statement; Step 132, processing the permission rule to extract keywords of the permission rule, the keywords including a table name, a control field and a condition value; Step 133, matching the semantic features of the user query statement with the keywords of the permission rule to obtain a matching result.

[0061] The semantic features of the user query statement include at least user intention, context meaning, entity relationship, and complex logic.

[0062] Optionally, the user query statement is semantically encoded using a deep learning model to understand the real intention and context structure of the user query.

[0063] In the embodiment of the application, the semantic features of the user query statement are obtained by semantically encoding the user query statement, the keywords of the permission rule are extracted by processing the permission rule, and the matching result is obtained by matching the semantic features of the user query statement with the keywords of the permission rule, so that accurate permission control can be achieved, flexibility and security under complex queries are enhanced, and a foundation is laid for realizing intelligent permission management.

[0064] In some embodiments, the semantic features of the user query statement are obtained by semantically encoding the user query statement in step 131, including: The user query statement is input into a pre-constructed deep learning model to obtain the semantic features of the user query statement output by the deep learning model. The deep learning model is trained based on sample user query statements and semantic feature labels of the sample user query statements.

[0065] The deep learning model is a specially trained neural network model that can understand the semantics of SQL query statements.

[0066] In the embodiment of the application, the deep learning model is introduced to semantically encode the user query statement, and the deep meaning of the user query statement can be obtained, thereby laying a foundation for realizing high-precision, intelligent, and self-adaptive row-level permission control.

[0067] In some embodiments, the keywords of the permission rule are extracted by processing the permission rule in step 132, including: The permission rule is parsed and cleaned to obtain a structured permission rule. The structured permission rule is dynamically spliced based on the query statement to query the unique value of the control field based on the query statement.

[0068] The structured permission rule refers to a pre-defined, machine-readable, and standardized format of the permission rule. The structured permission rule includes a series of explicit fields and values that can be automatically parsed and processed by a program, and is the cornerstone of flexible and automated data permission management.

[0069] Optionally, parsing the permission rule includes using a regular expression or a word segmentation tool to extract table names, fields, condition values, and other information in the permission rule.

[0070] Optionally, the purifying of the permission rules comprises: filtering invalid configurations such as null values, illegal characters, etc.; merging duplicate rules (such as multiple allowed values for the same table and the same field); and checking logical conflicts (such as handling priority levels when “allowed” and “prohibited” rules coexist).

[0071] It can be understood that, by parsing and purifying the permission rules, the structured permission rules are obtained, which can reduce the technical threshold and avoid human errors.

[0072] In some embodiments, the matching of the semantic features of the user query statement with the keywords of the permission rules in step 133 comprises: calculating the cosine similarity of the semantic features of the user query statement with the keywords of the permission rules; in a case where the cosine similarity is greater than a preset threshold, determining that the user query statement and the permission rules are matched successfully.

[0073] Optionally, the matching dimensions of the user query statement and the permission rules comprise at least: table name matching: whether the table involved in the query is within the permission rule allowed range; field matching: whether the query field is a control field or a non-sensitive field; condition matching: whether the value in the query condition is contained in the permission field value set (such as whether “R&D department” is in the allowed value list).

[0074] Figure 3 A flowchart of the training process of the deep learning model provided by the embodiments of the present application is shown. In some embodiments, the training process of the deep learning model comprises: step 310, obtaining a sample user query statement; step 320, determining the semantic feature label of the sample user query statement; step 330, inputting the sample user query statement into the initial deep learning model to obtain the predicted semantic features of the sample user query statement output by the initial deep learning model; step 340, calculating the loss function value based on the predicted semantic features of the sample user query statement and the semantic feature label of the sample user query statement; step 350, based on the loss function value, iteratively optimizing the parameters of the initial deep learning model to obtain the deep learning model.

[0075] Optionally, a large number of representative sample user query statements are collected; these sample user query statements cover various business scenarios, syntax complexity, and query intentions (such as simple queries, multi-table joins, subqueries, aggregation queries, etc.).

[0076] Optionally, the semantic feature label of the sample user query sentence is generated by a pre-trained teacher model, or is determined by manual labeling and verification.

[0077] Optionally, the parameters of the initial deep learning model are continuously adjusted by a back propagation algorithm, so that the difference (loss) between the output (predicted semantic feature) of the initial deep learning model and the real label is minimized.

[0078] Optionally, the trained deep learning model is deployed in a production environment as a microservice or built into a permission control service. When permission control is needed, the system calls the deployed deep learning model, passes the user query sentence as input to the model, and the model internally performs calculations to finally output a high-dimensional vector, i.e., the semantic feature of the user query sentence.

[0079] In the embodiment of the application, by inputting the sample user query sentence into the initial deep learning model, the predicted semantic feature of the sample user query sentence output by the initial deep learning model is obtained, the loss function value is calculated based on the predicted semantic feature of the sample user query sentence and the semantic feature label of the sample user query sentence, and the parameters of the initial deep learning model are iteratively optimized based on the loss function value to obtain the deep learning model, thereby improving the generalization performance of the deep learning model.

[0080] The database row-level permission control device provided in the embodiment of the application is described below. The database row-level permission control device described below can be correspondingly referred to the database row-level permission control method described above.

[0081] Figure 4 The structural schematic diagram of the database row-level permission control device provided in the embodiment of the application is shown in FIG. 4, which includes: Figure 4 The acquisition unit 410 is configured to acquire data source parameters, and the data source parameters include a user query sentence. The determination unit 420 is configured to, in a case where it is determined that the user has a basic permission to access the data source and the user is a non-administrator user, determine a permission rule corresponding to the user based on preset permission configuration information. The matching unit 430 is configured to perform semantic matching on the user query sentence and the permission rule to obtain a matching result. The query unit 440 is configured to, in a case where it is determined that the user query sentence and the permission rule match successfully, perform row-level query on a target database based on the user query sentence to obtain a query result.

[0082] Optionally, the semantic matching of the user query sentence and the permission rule to obtain the matching result includes:​ The semantic encoding of the user query statement is performed to obtain semantic features of the user query statement. The permission rule is processed to extract keywords of the permission rule, and the keywords include a table name, a control field, and a condition value. The semantic features of the user query statement are matched with the keywords of the permission rule to obtain a matching result.

[0083] Optionally, the semantic encoding of the user query statement is performed to obtain semantic features of the user query statement, including: The user query statement is input into a pre-constructed deep learning model to obtain semantic features of the user query statement output by the deep learning model. The deep learning model is obtained based on sample user query statements and semantic feature labels of the sample user query statements.

[0084] Optionally, the matching of the semantic features of the user query statement with the keywords of the permission rule includes: The cosine similarity of the semantic features of the user query statement and the keywords of the permission rule is calculated. In a case where the cosine similarity is greater than a preset threshold, it is determined that the user query statement and the permission rule are matched successfully.

[0085] Optionally, the processing of the permission rule to extract the keywords of the permission rule includes: The permission rule is parsed and cleaned to obtain a structured permission rule. The structured permission rule is dynamically spliced with a query statement to query a unique value of the control field based on the query statement.

[0086] Optionally, the database row-level permission control apparatus further includes: A first verification unit configured to verify, based on a data source parameter, whether a user has basic permission to access a data source. A second verification unit configured to, based on a user table, verify whether the user is a non-administrator user, on a condition that it is determined that the user has the basic permission to access the data source.

[0087] Optionally, the data source parameter further includes a data source identifier, a permission control identifier, and a user identifier.

[0088] Optionally, the training process of the deep learning model includes: Sample user query statements are obtained. Semantic feature labels of the sample user query statements are determined. The sample user query statements are input into an initial deep learning model to obtain predicted semantic features of the sample user query statements output by the initial deep learning model. Based on the predicted semantic features of the sample user query statements and the semantic feature labels of the sample user query statements, a loss function value is calculated. Based on the loss function value, the parameters of the initial deep learning model are iteratively optimized to obtain the deep learning model.

[0089] It should be noted that the database row-level permission control device provided by the embodiments of the present application can realize all the method steps realized by the database row-level permission control method embodiments and achieve the same technical effects. Therefore, the same parts and beneficial effects of the method embodiments will not be described in detail.

[0090] Figure 5 The structure schematic diagram of the electronic device provided by the embodiments of the present application is shown in FIG. 1. Figure 5 As shown in FIG. 1, the electronic device can include a processor 510, a communications interface 520, a memory 530, and a communications bus 540. The processor 510, the communications interface 520, and the memory 530 can communicate with each other through the communications bus 540. The processor 510 can invoke the logical instructions in the memory 530 to execute the database row-level permission control method. The method includes obtaining data source parameters, wherein the data source parameters include a user query statement; in the case that it is determined that the user has the basic permission to access the data source and the user is a non-administrator user, determining the permission rule corresponding to the user based on the preset permission configuration information; performing semantic matching on the user query statement and the permission rule to obtain a matching result; and in the case that it is determined that the user query statement and the permission rule are matched successfully, performing row-level query on the target database based on the user query statement to obtain a query result.

[0091] In addition, the logical instructions in the memory 530 described above can be implemented in the form of a software function unit and sold or used as an independent product. When stored in a computer readable storage medium, the technical solutions of the present application can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0092] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected to achieve the purposes of the embodiments according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0093] Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0094] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A database row-level permission control method, characterized in that, include: Obtain the data source parameters, which include the user query statement; If it is determined that the user has basic permissions to access the data source and that the user is not an administrator, the permission rules corresponding to the user are determined based on the preset permission configuration information. The user query statement is semantically matched with the permission rules to obtain the matching result; If it is determined that the user query statement matches the permission rule successfully, a row-level query is performed on the target database based on the user query statement to obtain the query results.

2. The database row-level permission control method according to claim 1, characterized in that, The step of semantically matching the user query statement with the permission rules to obtain the matching result includes: The user query statement is semantically encoded to obtain its semantic features; The permission rules are processed to extract keywords from the permission rules. The keywords include table name, control field, and condition value. The semantic features of the user query statement are matched with the keywords of the permission rules to obtain the matching results.

3. The database row-level permission control method according to claim 2, characterized in that, The step of semantically encoding the user query statement to obtain its semantic features includes: The user query statement is input into a pre-built deep learning model to obtain the semantic features of the user query statement output by the deep learning model. The deep learning model is trained based on the sample user query statements and the semantic feature labels of the sample user query statements.

4. The database row-level permission control method according to claim 2, characterized in that, The step of matching the semantic features of the user query statement with the keywords of the permission rules includes: Calculate the cosine similarity between the semantic features of the user query and the keywords of the permission rules; If the cosine similarity is greater than a preset threshold, it is determined that the user query statement successfully matches the permission rule.

5. The database row-level permission control method according to claim 2, characterized in that, The permission rules are processed to extract keywords from the permission rules, including: The permission rules are parsed and cleaned to obtain structured permission rules; The query statement is dynamically constructed based on the structured permission rules, and the unique value of the control field is retrieved based on the query statement.

6. The database row-level permission control method according to claim 1, characterized in that, After obtaining the data source parameters, the process also includes: Based on the data source parameters, verify whether the user has the basic permissions to access the data source; Assuming the user has basic permissions to access the data source, verify whether the user is a non-administrator user based on the user table.

7. The database row-level permission control method according to any one of claims 2-6, characterized in that, The data source parameters also include data source identifier, access control identifier, and user identifier.

8. The database row-level permission control method according to claim 3, characterized in that, The training process of the deep learning model includes: Obtain sample user query statements; Determine the semantic feature tags of the query statements of the sample users; The sample user query statement is input into the initial deep learning model to obtain the predicted semantic features of the sample user query statement output by the initial deep learning model. Based on the predicted semantic features of the sample user query statements and the semantic feature labels of the sample user query statements, the loss function value is calculated; Based on the loss function value, the parameters of the initial deep learning model are iteratively optimized to obtain the deep learning model.

9. A database row-level permission control device, characterized in that, include: The acquisition unit is used to acquire data source parameters, including user query statements. The determining unit is used to determine the permission rules corresponding to the user based on preset permission configuration information when it is determined that the user has basic permissions to access the data source and the user is a non-administrator user. The matching unit is used to semantically match the user query statement with the permission rules to obtain the matching result; The query unit is used to perform a row-level query on the target database based on the user query statement when it is determined that the user query statement matches the permission rule successfully, and obtain the query result.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the database row-level permission control method as described in any one of claims 1 to 8.

Images