Access authority control method and equipment for distributed data service
By introducing dynamic permission condition fields and context information evaluation into the distributed data permission policy, the limitations of static policies in traditional methods are overcome, enabling flexible permission control and precise permission determination, while reducing configuration and maintenance costs.
Patent Information
- Application Number
- CN202511561686.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-29
- Publication Date
- 2026-01-23
AI Technical Summary
Traditional distributed data access control methods rely on static policies, which cannot respond to dynamic access environments, resulting in insufficient flexibility and real-time adaptability. Furthermore, the number of policies increases exponentially with the increase of departments and resources, increasing maintenance workload and easily leading to access control vulnerabilities. They also cannot make comprehensive authorization decisions by combining dynamic context information.
The data permission policy structure introduces a dynamic permission condition field, which defines the permission activation rules through scripting language or expression. It combines basic ternary information and context information for evaluation to achieve dynamic permission determination and supports the matching of static policies with dynamic environments.
By introducing dynamic permission conditions, the flexibility and accuracy of permission control are improved, the cost of policy configuration and maintenance is reduced, various dynamic security requirements are supported, and the security and accuracy of permission decisions are ensured.
Smart Images
Figure CN121396609A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of big data security and data governance, and particularly relates to an access permission control method and device of distributed data service. BACKGROUND
[0002] With the rapid development of big data technology, distributed data systems have become the core carriers for enterprises to store, process and analyze massive data, and data security and permission control are key links of data management.
[0003] At present, the traditional distributed data permission control method mainly realizes the control of data access through a pre-set static permission strategy, that is, an administrator defines the corresponding relationship between the subject, that is, the user / user group, the object, that is, the data resource, and the operation in the policy library, and when a user initiates a data access request, a policy evaluation engine only matches the pre-set static strategy and generates a permission judgment result according to the subject, object and operation in the request.
[0004] This method has obvious limitations: Firstly, the authorization decision of this method completely depends on the pre-fixed static strategy, and cannot respond to the dynamically changing access environment and scene in runtime, resulting in a lack of flexibility and real-time adaptability of permission control.
[0005] Secondly, the strategy conditions of this method are mostly static SQL fragments or fixed configuration parameters, and if the demand that different department users only access the data of the department to which they belong needs to be realized, the administrator needs to create static strategies with similar logic but different resources / users for each department, so that the number of strategies increases exponentially with the number of departments and data resources, which greatly increases the configuration and maintenance workload, and also easily causes permission vulnerabilities and increases data security risks due to strategy repetition and conflict.
[0006] Thirdly, the permission judgment of this method only depends on the internally stored user and resource information, and cannot make comprehensive authorization decisions in combination with dynamic context information, making it difficult to meet the intelligent permission control demand. SUMMARY
[0007] The embodiments of the present application provide an access permission control method and device of distributed data service, which are used to solve the limitation problem of the above-mentioned traditional distributed data permission control method.
[0008] The embodiments of the present application adopt the following technical solutions: On the one hand, the embodiments of the present application provide an access permission control method of distributed data service, which comprises: constructing dynamic permission conditions for data resource security requirements in the data structure corresponding to the data permission strategy of the distributed data system; The basic triadic information and context information of the access request are collected when receiving an access request of a user to a data resource. The basic triadic information and context information of the access request are evaluated based on dynamic permission conditions to allow or reject the access request.
[0009] In one example, the dynamic permission conditions are constructed for data resource security requirements in a data structure corresponding to the data permission policy of the distributed data system, specifically including: A dynamic permission condition field is added to each permission item field in the data structure corresponding to the data permission policy. The dynamic rules that the permission takes effect are defined by a script language or expression in the dynamic permission condition field of each permission item.
[0010] In one example, the dynamic permission condition field is added to each permission item field in the data structure, specifically including: A dynamic permission condition field for storing dynamic rules is added to the policy configuration sub-data structure associated with each permission item field.
[0011] In one example, the basic triadic information includes: user, data resource, and operation information. The context information includes at least one of system time information, client network address information, client type identification information, session label information, user session attributes, user identity attributes, and resource classification labels.
[0012] In one example, the basic triadic information and context information of the access request are evaluated based on dynamic permission conditions to allow or reject the access request, specifically including: One or more target permission policies associated with the basic triadic information are retrieved from a preset policy library according to the basic triadic information. It is determined whether the basic triadic information of the access request matches the static configuration field of the target permission policy. If the static matching is successful, the dynamic permission conditions of the target permission policy are parsed, and it is determined whether the context information meets the rules defined by the dynamic permission conditions. If it meets, the target permission policy is marked as the effective policy of the current evaluation. The permission judgment result of the access request is generated based on the authorization items of all effective policies.
[0013] In one example, the permission judgment result of the access request is generated based on the authorization items of all effective policies, specifically including: If any of the effective policies includes a deny-type authorization item, a permission determination result of denying access is generated; If all the effective policies only have allow-type authorization items, a permission determination result of allowing access is generated.
[0014] In one example, the method further includes: If there is no any effective policy, a permission determination result of denying access is generated.
[0015] In one example, the method further includes: If the dynamic permission condition of the target permission policy involves a user external attribute, a specific value of the user external attribute is obtained through a predefined external attribute interface, and the attribute value is added to the context information.
[0016] In one example, the method further includes: When the access request is to allow access, the dynamic permission condition is parsed to generate a screening condition corresponding to row-level filtering and a column-level desensitization rule; The screening condition is integrated into an original data operation statement corresponding to the access request to obtain data rows that meet the permission requirements; Based on the column-level desensitization rule, the data rows that meet the permission requirements are subjected to column-level desensitization processing to obtain a final response result of the access request.
[0017] On the other hand, the embodiments of the present application provide an access permission control device for distributed data services, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform any of the above-described access permission control methods for distributed data services.
[0018] The above at least one technical solution adopted by the embodiments of the present application can achieve the following beneficial effects: The method provided by the present application solves the problem that the existing strategy only relies on fixed users and resource configurations and cannot respond to dynamic information such as access time and IP by assigning dynamic effective conditions to permission items. Moreover, it is necessary to create independent static strategies for each scenario, which is cumbersome to manage. The strategy is upgraded from fixed configuration to flexible adaptation, supporting various dynamic security requirements. One dynamic strategy can replace hundreds or thousands of static strategies, and only the expression logic needs to be modified to quickly respond to changes in business requirements, greatly reducing the cost of strategy configuration and maintenance.
[0019] The basic triple information and context information of the access request are collected, the problem that the traditional permission evaluation only depends on the basic triple information and lacks dynamic environment data support is solved, and comprehensive data support is provided for subsequent dynamic evaluation. The internal context information and external user attributes are fused, and data basis is provided for the requirement that the user only accesses the department data.
[0020] Through the dual judgment of static matching and dynamic verification, the problem that the static policy and dynamic environment do not match, resulting in inaccurate permission judgment, is solved. The accuracy and security of the permission decision are ensured. Through centralized management of permission rules, the dispersion of permission logic is avoided, and the maintenance cost is reduced. BRIEF DESCRIPTION OF DRAWINGS
[0021] In order to more clearly illustrate the technical solutions of the present application, some embodiments of the present application will be described in detail below with reference to the accompanying drawings, in which: Figure 1 A flowchart of a distributed data service access permission control method provided by an embodiment of the present application is shown. Figure 2 A table level new column data permission operation page provided by an embodiment of the present application is shown. Figure 3 A structure diagram of a distributed data service access permission control device provided by an embodiment of the present application is shown. DETAILED DESCRIPTION
[0022] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below with reference to specific embodiments and corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.
[0023] Some embodiments of the present application will be described in detail below with reference to the accompanying drawings.
[0024] Figure 1 A flowchart of a distributed data service access permission control method provided by an embodiment of the present application is shown. The method can be applied to different business fields, such as the Internet financial business field, the e-commerce business field, the instant messaging business field, the public service business field, etc. The flow can be executed by a computing device in the corresponding field, and some input parameters or intermediate results in the flow are allowed to be manually intervened and adjusted to help improve the accuracy.
[0025] The implementation of the analysis method related to the embodiments of the present application can be a terminal device or a server, and the present application does not make special limitations thereon. For the convenience of understanding and description, the following embodiments are described in detail taking the server as an example.
[0026] It should be noted that the server can be a single device or a system composed of multiple devices, i.e., a distributed server, and the present application does not make specific limitations thereon.
[0027] Figure 1 The flow in the method includes the following steps: S101, constructing a dynamic permission condition for a data resource security requirement in a data structure corresponding to a data permission policy of a distributed data system.
[0028] The data structure corresponding to the permission policy refers to a data organization form in which the permission rules are stored in the distributed data system.
[0029] In some embodiments of the present application, the dynamic permission condition is constructed for the data resource security requirement in the data structure corresponding to the data permission policy of the distributed data system, and specifically includes: A dynamic permission condition field is added to each permission item field in the data structure corresponding to the data permission policy. The dynamic permission condition field in each permission item is defined by a script language or an expression to meet the dynamic rules for permission taking effect.
[0030] The permission item field represents a specific operation that can be executed by a user, for example, can include a SELECT query, an UPDATE modification, a DELETE deletion, an ACCESS access, and the like. The dynamic permission condition field is a newly added field for storing dynamic constraint rules, and is a core carrier for connecting static policies and dynamic environments. The script language / expression is used to flexibly define dynamic rules.
[0031] A specific example is that a dynamic permission condition field is added to each permission item field in the data structure, and specifically includes: in the policy configuration sub-data structure associated with each permission item field, a dynamic permission condition field for storing dynamic rules is added.
[0032] The policy configuration sub-data structure is a data organization form in which the permission rules are stored in the distributed data system, and each permission item corresponds to a set of exclusive policy configuration sub-structures, which includes an authorized object and a controlled resource range corresponding to the permission item.
[0033] S102, when receiving an access request of a user to a data resource, collecting basic triadic information and context information of the access request.
[0034] Among them, the basic three-element information is the foundation for identifying the core identity of the access request, while the context information is the dynamic environment and auxiliary attribute information during the runtime of the access request.
[0035] For example, the basic three-element information includes: user, data resource, and operation information. Contextual information includes at least one of the following: system time information, client network address information, client type identifier information, session tag information, user session attributes, user identity attributes, and resource category tag.
[0036] S103. Evaluate the basic ternary information and context information of the access request based on dynamic permission conditions to allow or deny the access request.
[0037] In some embodiments of this application, the basic ternary information and context information of the access request are evaluated based on dynamic permission conditions to allow or deny the access request, specifically including: Based on the basic ternary information, one or more target permission policies that are associated with the basic ternary information are retrieved from the preset policy library. It is then determined whether the basic ternary information of the access request matches the static configuration fields of the target permission policy. If a static match is successful, the dynamic permission conditions of the target permission policy are parsed, and it is determined whether the context information conforms to the rules defined by the dynamic permission conditions. If it does, the target permission policy is marked as the currently evaluated effective policy. Based on the authorization items of all effective policies, the permission determination result for the access request is generated.
[0038] The target permission policy is a permission policy retrieved from the policy library that is associated with the basic three-element information of the access request. The static configuration fields are the pre-defined authorization object fields in the permission policy, namely, the allowed users / user groups, the managed resource field, the data resource to be affected, and the permission item field, the allowed operation. The effective policy is the target permission policy that simultaneously satisfies both successful static matching and met dynamic conditions. The authorization item is the allow or deny access instruction defined in the policy.
[0039] For example, when a user / user group accesses data resources that fall within the scope of the policy-controlled resource field in the policy authorization object field, and the requested operation is consistent with the policy permission item field, it indicates that the basic ternary information of the access request matches the static configuration field of the target permission policy.
[0040] In some embodiments of this application, the permission determination result of the access request is generated based on the authorization items of all effective policies, specifically including: If any effective policy contains a deny permission entry, an access denied permission decision is generated. If all effective policies contain only allow permission entries, an access allowed permission decision is generated.
[0041] The priority of the access denial item may be higher than the priority of the access permission item, for example.
[0042] For example, if there is no effective policy, a permission decision result of access denial is generated.
[0043] Further, to ensure the integrity of the permission evaluation, the method further comprises: If the dynamic permission condition of the target permission policy involves external attributes of the user, the specific value of the external attribute of the user is obtained through a predefined external attribute interface, and the attribute value is added to the context information.
[0044] The method provided in the application upgrades the policy from fixed configuration to flexible adaptation by assigning dynamic effective conditions to the permission item, supports various dynamic security requirements. A dynamic policy can replace hundreds of static policies, and only the expression logic needs to be modified to quickly respond to changes in business requirements, greatly reducing the cost of policy configuration and maintenance. By collecting the basic three-element information and context information of the access request, comprehensive data support is provided for subsequent dynamic evaluation. The internal context information and external user attributes are integrated to provide data basis for the requirement that the user only accesses the data of the department to which the user belongs. Through double determination of static matching and dynamic verification, the accuracy and security of the permission decision are ensured. By centralized management of permission rules, the dispersion of permission logic is avoided, and the maintenance cost is reduced.
[0045] It should be noted that, although the embodiments of the application are introduced and described in sequence with reference to Figure 1 steps S101 to S103, this does not mean that steps S101 to S103 must be executed in strict sequence. The embodiments of the application introduce and describe steps S101 to S103 in sequence as shown in Figure 1 in order to facilitate the understanding of the technical solution of the embodiments of the application by those skilled in the art. In other words, in the embodiments of the application, the sequence of steps S101 to S103 can be adjusted as needed.
[0046] Based on the method Figure 1 , the present specification also provides some specific embodiments and extended schemes of the method, which will be described below.
[0047] Further, to solve the problem that the condition of the row-level / column-level control in the prior art is a static SQL fragment and cannot dynamically adapt to user attributes, the method further comprises: When the access request is an allowed access, a dynamic permission condition is parsed and processed to generate a screening condition corresponding to a row-level filtering and a column-level desensitization rule. The screening condition is integrated into an original data operation statement corresponding to the access request to obtain data rows that meet the permission requirements. Based on the column-level desensitization rule, the data rows that meet the permission requirements are subjected to column-level desensitization processing to obtain a final response result of the access request.
[0048] The method implements dynamic condition-driven row-level filtering and column-level desensitization, and further improves the granularity of data security management. Different users / departments do not need to be separately configured with filtering / desensitization rules, thereby reducing the complexity of policy management.
[0049] Figure 2 A schematic diagram of a table-level new column data permission operation page provided by an embodiment of the present application is shown in FIG. 1. As shown in FIG. 1, the basic information area includes a policy name and a description. The policy name is used to uniquely identify the permission policy, facilitating subsequent retrieval and management. The description is used to supplement the business description of the policy, such as applicable scenarios, rule notes, etc. Figure 2
[0050] The permission level and hierarchical configuration area includes a level, a hierarchical type, and a data warehouse hierarchy. The level indicates that the policy controls the access behavior of the data table dimension. The hierarchical type indicates that the policy manages the data permission of the data layer. The data warehouse hierarchy specifies the data warehouse hierarchy to which the policy belongs, which is used for hierarchical organization and management of data.
[0051] The data table selection and permission configuration area includes a left data table list, a right permission detail list, and a table name. The left data table list lists the selectable data tables in the form of check boxes. Currently, hudi.hd1302.hd1302_ta1 to hudi.hd1302.hd1302_ta5 are selected, and hudi.hd1302.hd1302_ta6 is not selected.
[0052] The right permission detail list displays the detailed information and permission configuration of the selected data tables. Each row corresponds to a table, including a table name, a data warehouse hierarchy name, a database name, a data source type, a permission type, and an operation. The table name is the identification name of the data table. The data warehouse hierarchy name is hd1302 (h1302), which is consistent with the left data warehouse hierarchy configuration. The database name is hd1302, indicating the database to which the data table belongs. The data source type is Hudi, indicating that these tables are stored based on Hudi. The permission type provides read-write and read single selection options. Currently, all tables are selected for reading, indicating that only read operations are allowed on these tables. The operation includes a delete button that can remove the permission configuration of the corresponding table.
[0053] The operation button area includes: cancel, determine. Wherein, the cancel indicates that the current configuration is abandoned after being clicked, and the interface is closed. The determine indicates that the configuration is saved after being clicked, and the table level data access permission policy is effective.
[0054] Based on the same idea, some embodiments of the present application also provide a device and a non-volatile computer storage medium corresponding to the above method.
[0055] Figure 3 A structural schematic diagram of a distributed data service access permission control device provided by an embodiment of the present application includes: at least one processor; and a memory in communication with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the distributed data service access permission control method described in any one of the above.
[0056] Each of the embodiments in the present application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each embodiment mainly describes the difference from other embodiments. In particular, the device and medium embodiments are basically similar to the method embodiments, so the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.
[0057] The device and method provided by the embodiments of the present application are one-to-one correspondence, so the device also has the similar beneficial technical effects as the method. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the device will not be described here.
[0058] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.
[0059] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.
[0060] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.
[0061] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.
[0062] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.
[0063] The memory can include non-persistent memory and / or volatile memory, such as a random access memory (RAM) including a cache area for the temporary storage of data. A
[0064] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.
[0065] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or apparatus that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.
[0066] The above only describes the embodiments of the present application and is not intended to limit the present application. Those skilled in the art can make various modifications and changes to the present application. Any modification, equivalent replacement, improvement, etc. made within the technical principles of the present application shall fall within the protection scope of the present application.
Claims
1. A method for controlling access rights to a distributed data service, characterized in that The method comprises: In the data structure corresponding to the data authority policy of the distributed data system, a dynamic authority condition is constructed for the security requirements of data resources; When receiving a user's access request for data resources, basic triadic information and context information of the access request are collected; Based on the dynamic authority condition, the basic triadic information and context information of the access request are evaluated to allow or reject the access request.
2. The method of claim 1, wherein, The dynamic authority condition is constructed in the data structure corresponding to the data authority policy of the distributed data system, specifically comprising: In the data structure corresponding to the data authority policy, a dynamic authority condition field is added to each authority item field in the data structure; In the dynamic authority condition field of each authority item, a dynamic rule that meets the authority effect is defined by a script language or an expression.
3. The method of claim 2, wherein, The dynamic authority condition field is added to each authority item field in the data structure, specifically comprising: In the policy configuration sub-data structure associated with each authority item field, a dynamic authority condition field for storing dynamic rules is added.
4. The method of claim 1, wherein, The basic triadic information includes: user, data resource and operation information; The context information includes: at least one of system time information, client network address information, client type identification information, session label information, user session attribute, user identity attribute and resource classification label.
5. The method of claim 1, wherein, Based on the dynamic authority condition, the basic triadic information and context information of the access request are evaluated to allow or reject the access request, specifically comprising: According to the basic triadic information, one or more target authority policies associated with the basic triadic information are retrieved from a preset policy library; It is judged whether the basic triadic information of the access request matches the static configuration field of the target authority policy; If the static matching is successful, the dynamic authority condition of the target authority policy is parsed, and it is judged whether the context information meets the rule defined by the dynamic authority condition; If it is met, the target authority policy is marked as the current effective policy; Based on the authorization items of all effective policies, a permission judgment result of the access request is generated.
6. The method of claim 5, wherein, Based on the authorization items of all effective policies, a permission judgment result of the access request is generated, specifically comprising: If there is any effective policy including a denial type authorization item, a permission judgment result of denying access is generated; If all effective policies only have permission type authorization items, a permission judgment result of allowing access is generated.
7. The method of claim 5, wherein, The method further comprises: If there is no any effective policy, a permission judgment result of denying access is generated.
8. The method of claim 5, wherein, The method further comprises: If the dynamic authority condition of the target authority policy involves external attributes of the user, the specific values of the external attributes of the user are obtained through a predefined external attribute interface, and the attribute values are added to the context information.
9. The method of claim 1, wherein, The method further comprises: When the access request is allowed to access, the dynamic authority condition is parsed and processed to generate a screening condition corresponding to row-level filtering and a column-level desensitization rule; The screening condition is integrated into the original data operation statement corresponding to the access request to obtain only the data rows that meet the authority requirements; Based on the column-level desensitization rule, a data row meeting the permission requirement is subjected to column-level desensitization processing to obtain a final response result of the access request.
10. An access right control device for a distributed data service, characterized by comprising: Comprise: At least one processor; And, The memory is in communication connection with the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the access permission control method of any one of claims 1-9.