Data permission management and control method, device and equipment and storage medium

Abstract

The invention relates to the technical field of data permission determination, in particular to a data permission management and control method, device and equipment and a storage medium, and the method comprises the following steps: in response to the absence of an initial execution plan corresponding to first key information, determining an initial syntax tree and permission management and control metadata based on the first key information; wherein the authority control metadata and the corresponding role information are dynamically configured by a console; generating a target SQL template based on the initial syntax tree and the authority control metadata; determining a target execution plan based on the target SQL template, and determining a double-layer mapping key value pair based on the initial SQL template in the first key information, the role information and the target execution plan; and in response to the obtained second key information comprising the target SQL template and the role information in the double-layer mapping key value pair, performing data access based on the target execution plan. According to the invention, the data authority control dynamic adjustment capability, the data access performance and the scene compatibility of the service system during data access can be improved.

Description

Technical Field

[0001] This application relates to the field of data access control technology, and in particular to a data access control method, apparatus, device and storage medium. Background Technology

[0002] Data in business systems is of paramount importance, especially data in financial information systems. To ensure data security, it is necessary to control data access permissions.

[0003] Current data access control schemes are generally based on the RBAC model (based on Role for permission division and control), and are divided into three types of access control schemes according to the data access lifecycle: pre-event, during-event, and post-event.

[0004] Among them, the in-process access control scheme (hard-coded scheme) pre-configures access control in its design and implementation. Access control-related content is bound to application layer parameter passing, business logic processing, and database access commands. Due to the strong coupling between business logic and access control, this scheme introduces many maintenance and expansion problems and determines that it does not have the ability to dynamically adjust data access control. Every change requires redesign and recoding. In addition, the pre-event and post-event access control schemes (both proxy schemes) use a proxy to embed access control as a cross-section into the overall process. Although the proxy scheme meets the design principle of loose coupling, access control introduces additional DBIO operations, resulting in poor data access performance and poor compatibility with multi-role data access and complex multi-table data access scenarios. Summary of the Invention

[0005] To facilitate the improvement of the dynamic adjustment capability of data access control, data access performance, and scenario compatibility of business systems when accessing data, this application provides a data access control method, apparatus, device, and storage medium.

[0006] Firstly, this application provides a data access control method, including:

[0007] In response to the absence of an initial execution plan corresponding to the first key information, an initial syntax tree and permission control metadata are determined based on the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console;

[0008] Based on the initial syntax tree and the permission control metadata, a target SQL template is generated;

[0009] The target execution plan is determined based on the target SQL template, and a two-level mapping key-value pair is determined based on the initial SQL template in the first key information, the role information, and the target execution plan.

[0010] In response to obtaining the second key information, which includes the target SQL template and the role information in the two-layer mapping key-value pair, data access is performed based on the target execution plan.

[0011] Secondly, this application provides a data access control device, comprising:

[0012] The data preparation module is used to determine the initial syntax tree and permission control metadata based on the first key information in response to the absence of an initial execution plan corresponding to the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console;

[0013] The template generation module is used to generate a target SQL template based on the initial syntax tree and the permission control metadata;

[0014] The key-value pair determination module is used to determine the target execution plan based on the target SQL template, and to determine the two-level mapping key-value pairs based on the initial SQL template in the first key information, the role information, and the target execution plan.

[0015] The data access module is used to perform data access based on the target execution plan in response to obtaining the second key information, which includes the target SQL template and the role information in the two-layer mapping key-value pair.

[0016] Thirdly, this application provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the method described above.

[0017] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-described method.

[0018] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0019] The aforementioned data access control method, apparatus, device, and storage medium, in response to the absence of an initial execution plan corresponding to the first key information, determine an initial syntax tree and access control metadata based on the first key information; wherein, the access control metadata and corresponding role information are dynamically configured by a console; a target SQL template is generated based on the initial syntax tree and the access control metadata; a target execution plan is determined based on the target SQL template; a two-level mapping key-value pair is determined based on the initial SQL template in the first key information, the role information, and the target execution plan; in response to obtaining second key information including the target SQL template and the role information in the two-level mapping key-value pair, data access is performed based on the target execution plan.

[0020] Through the above implementation, firstly, compared to the in-process access control scheme, the business logic and access control in this scheme are not tightly coupled. Role information and the corresponding access control metadata can be flexibly configured through the console, thereby improving the dynamic adjustment capability of data access control when the business system accesses data. Secondly, compared to the pre-process access control scheme, this scheme does not require querying access control information first and then performing business queries on the database based on the access control information. Instead, the configured access control information (metadata) can be directly integrated into the target execution plan of the business query, and the business query can be performed directly, effectively reducing the number of DBIO operations. In addition, compared to the post-process access control scheme, this scheme does not require first querying the database based on the access control information. Instead of retrieving a certain amount of data from the database and then using the query's permission control information to prune the retrieved data to obtain the required data, the configured permission control information (metadata) can be directly integrated into the target execution plan of the business query. The target execution plan then retrieves the required data corresponding to the permission control information, thus reducing the amount of DBIO data transfer. By reducing the number of DBIO operations and the amount of data transfer, the data access performance of the business system can be effectively improved. Thirdly, the two-layer mapping key-value pairs generated in this solution also contain role information, which allows multiple roles to be compatible under the same initial SQL template, thereby effectively improving the compatibility of data access scenarios.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of a data access control method provided in the embodiments of this application;

[0024] Figure 2 This is a schematic diagram of an abstract syntax tree provided in the embodiments of this application;

[0025] Figure 3 This is a schematic diagram illustrating the process of generating a target syntax tree from an initial syntax tree, as provided in an embodiment of this application.

[0026] Figure 4 This is a schematic diagram of a pre-compilation process provided in an embodiment of this application;

[0027] Figure 5 This is a flowchart of another data access control method provided in the embodiments of this application;

[0028] Figure 6 This is a schematic diagram of the structure of a data access control device provided in the embodiments of this application;

[0029] Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application;

[0030] Figure 8 This is an internal structural diagram of a computer-readable storage medium provided in an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this disclosure.

[0032] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings herein are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0033] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0034] Example 1

[0035] Figure 1 A flowchart of a data access control method provided in Embodiment 1 of this application is shown below. Figure 1 The method can be executed by a device that performs the method, which can be implemented in software and / or hardware, and the method includes:

[0036] S110. In response to the absence of an initial execution plan corresponding to the first key information, an initial syntax tree and permission control metadata are determined based on the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console.

[0037] It should be noted that users can access the database through business systems. To improve the efficiency of data access, business systems often cache execution plans in advance through pre-compilation. When a user accesses data, the application layer of the business system (software) sends the corresponding SQL template to the data layer. During the pre-compilation process, this SQL template undergoes parsing and optimization to generate the corresponding execution plan. The SQL template is an abstraction of the specific SQL through parameterization, while the execution plan is the specific step-by-step plan for executing the SQL, generated by the database optimizer. The cached execution plan is recorded as the initial execution plan. In this embodiment, the initial execution plan is stored as a key-value pair, where the initial execution plan is the "value" in the key-value pair, and the "key" of the key-value pair is recorded as the first key information. The first key information contains the SQL template and role information (data accessor).

[0038] Specifically, to improve data access efficiency through pre-compilation, after generating the first key information, it checks if a key-value pair containing that first key information exists in the cache. If it does, the "value" of that key-value pair, i.e., the initial execution plan, is retrieved. This eliminates the need for numerous steps to generate the initial execution plan using an SQL template; instead, the cached initial execution plan can be directly invoked for data access, thus improving efficiency. If the cache does not contain a key-value pair containing that first key information, the corresponding execution plan must be regenerated.

[0039] It should be noted that in order to regenerate the execution plan, the corresponding SQL template needs to be determined first. In addition, when different visitors (roles) access data in the database, the roles have different data permissions due to their different identities. In this embodiment, it is necessary to restrict the data access of the role according to the data permissions of different roles in order to improve data security. Therefore, this embodiment intends to incorporate the data permission control information corresponding to the role into the SQL template that needs to be determined.

[0040] Specifically, in this embodiment, a corresponding syntax tree can be generated based on the SQL template in the first key information, so that the data permission control information of the role information in the first key information can be updated to the syntax tree in the future.

[0041] It should be noted that this embodiment has a pre-set console, through which different role information and the data permission control information corresponding to each role information can be dynamically and flexibly configured, and the data permission control information corresponding to the role information is recorded as permission control metadata.

[0042] S120. Based on the initial syntax tree and the permission control metadata, generate the target SQL template.

[0043] It should be noted that the SQL template can be parsed to generate a corresponding syntax tree, and the syntax tree can be processed to generate a corresponding SQL template. In order to generate an execution plan with data permission control information, this embodiment intends to first integrate the permission control metadata of the role information into the SQL template.

[0044] Specifically, after the SQL template in the first key information is parsed to generate the corresponding syntax tree, the permission control metadata of the role information in the first key information is also obtained, and the permission control metadata of the role information is updated to the syntax tree to form a new syntax tree. Then, the new syntax tree is processed to generate an SQL template with data permission control information, which is denoted as the target SQL template.

[0045] S130. Determine the target execution plan based on the target SQL template, and determine the two-level mapping key-value pair based on the initial SQL template in the first key information, the role information, and the target execution plan.

[0046] It should be noted that in the database caching mechanism, SQL templates can generate corresponding execution plans through parsing and optimization.

[0047] Specifically, the target SQL template is parsed and optimized to generate a corresponding execution plan, denoted as the target execution plan.

[0048] It should also be noted that the roles accessing the same database are diverse. For example, roles could be salesperson, manager, general manager, etc., but are not specifically limited. Different roles have different data access permissions. In existing technology, SQL templates and corresponding execution plans are cached in the form of key-value pairs. For example, this key-value pair is [SQL template: execution plan], which is a single-level mapping key-value pair, meaning one SQL template corresponds to one execution plan. When using this key-value pair during the pre-compilation process, since the SQL template is not associated with role information, it is difficult to determine the target execution plan corresponding to the role information. Different role information has different permission control information in the target SQL template and the target execution plan, making it difficult to determine the corresponding execution plan based on different role information during the pre-compilation process. Therefore, this embodiment is based on the initial SQL template, Role information and target execution plan are used to generate corresponding key-value pairs. Specifically, the key-value pair is [Initial SQL Template: Role Information: Target Execution Plan]; where "Initial SQL Template, Role Information" is the "key" of the key-value pair, the initial SQL template is the initial template in the first key information, and the target execution plan is the "value" of the key-value pair. This key-value pair is recorded as a two-level mapping key-value pair. Through this two-level mapping key-value pair, the initial SQL template can correspond to different role information, and different role information can correspond to different target execution plans, thereby achieving compatibility between different roles and effectively improving the role compatibility of the business system when accessing data.

[0049] S140. In response to obtaining the second key information including the target SQL template and the role information in the two-layer mapping key-value pair, data access is performed based on the target execution plan.

[0050] The target execution plan is cached in the form of a two-level mapping key-value pair. The "initial SQL template: role information" in the two-level mapping key-value pair is the "key" and is recorded as the second key information. During the pre-compilation process, if the second key information is obtained that is the same as the "key" in the two-level mapping key-value pair, it means that the target execution plan in the cache can be called to access the database.

[0051] It should be noted that in this embodiment, in response to the absence of an initial execution plan corresponding to the first key information, an initial syntax tree and permission control metadata are determined based on the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console; a target SQL template is generated based on the initial syntax tree and the permission control metadata; a target execution plan is determined based on the target SQL template; a two-level mapping key-value pair is determined based on the initial SQL template in the first key information, the role information, and the target execution plan; in response to obtaining second key information including the target SQL template and the role information in the two-level mapping key-value pair, data access is performed based on the target execution plan.

[0052] Through the above implementation, firstly, compared to the in-process access control scheme, the business logic and access control in this scheme are not tightly coupled. Role information and the corresponding access control metadata can be flexibly configured through the console, thereby improving the dynamic adjustment capability of data access control when the business system accesses data. Secondly, compared to the pre-process access control scheme, this scheme does not require querying access control information first and then performing business queries on the database based on the access control information. Instead, the configured access control information (metadata) can be directly integrated into the target execution plan of the business query, and the business query can be performed directly, effectively reducing the number of DBIO operations. In addition, compared to the post-process access control scheme, this scheme does not require first querying the database based on the access control information. Instead of retrieving a certain amount of data from the database and then using the query's permission control information to prune the retrieved data to obtain the required data, the configured permission control information (metadata) can be directly integrated into the target execution plan of the business query. The target execution plan then retrieves the required data corresponding to the permission control information, thus reducing the amount of DBIO data transfer. By reducing the number of DBIO operations and the amount of data transfer, the data access performance of the business system can be effectively improved. Thirdly, the two-layer mapping key-value pairs generated in this solution also contain role information, which allows multiple roles to be compatible under the same target SQL template, thereby effectively improving the compatibility of data access scenarios.

[0053] Example 2

[0054] This application provides a data access control method in Embodiment 2, which optimizes the "determining the initial syntax tree and access control metadata based on the first key information" in Embodiment 1. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. The method includes:

[0055] S211. In response to the absence of an initial execution plan corresponding to the first key information, generate an initial syntax tree based on the initial SQL template in the first key information.

[0056] It should be noted that during the pre-compilation process, the initial execution plan is cached in the form of key-value pairs, and the "key" of the key-value pair is recorded as the first key information. In this embodiment, the first key information includes the initial SQL template and role information. The initial SQL template can be parsed to generate a syntax tree. In this embodiment, the syntax tree is an abstract syntax tree (AST structure).

[0057] Specifically, the initial SQL template is segmented to obtain the corresponding lexical unit sequence; then, according to the SQL syntax rules, each lexical unit in the lexical unit sequence is organized into a hierarchical structure, and a corresponding tree node is created for each hierarchical structure to form an abstract syntax tree.

[0058] For example, the abstract syntax tree corresponding to an initial SQL template is as follows: Figure 2 As shown.

[0059] S212. Obtain the permission control metadata of the role information in the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console.

[0060] In this embodiment, the preset console is used to dynamically configure role information and the corresponding permission control metadata. The role information (Role) is used to determine the identity of the role (data accesser), and the permission control metadata is used to limit the role's access permissions to the data.

[0061] The role information and permission control metadata in the first key information are obtained from the business context. The initial SQL template and the role information can constitute the first key information [initial SQL template + Role].

[0062] Through the above implementation, the obtained access control metadata can be used to update the initial syntax tree corresponding to the initial SQL template, thereby facilitating the addition of access control metadata to the initial SQL template. In this way, when the execution plan corresponding to the initial SQL template with access control metadata is accessed in the database, data access control can be implemented based on the access control metadata, thus improving data security.

[0063] S220. Based on the initial syntax tree and the permission control metadata, generate the target SQL template.

[0064] S230. Determine the target execution plan based on the target SQL template, and determine the two-level mapping key-value pair based on the initial SQL template in the first key information, the role information, and the target execution plan.

[0065] S240. In response to obtaining the second key information including the target SQL template and the role information in the two-layer mapping key-value pair, data access is performed based on the target execution plan.

[0066] Example 3

[0067] This application provides a data access control method in Embodiment 3, which optimizes the "generating a target SQL template based on the initial syntax tree and the access control metadata" in Embodiment 1. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. The method includes:

[0068] S310. In response to the absence of an initial execution plan corresponding to the first key information, an initial syntax tree and permission control metadata are determined based on the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console.

[0069] S321. Based on the initial syntax tree and the column permission control metadata in the permission control metadata, determine the target data column set.

[0070] It should be noted that a database table has data rows and data columns. Access control metadata includes metadata that controls access permissions to data columns, referred to as column access control metadata. Column access control metadata is a type of column access control condition used to restrict the data columns that a role can access in the data table; for example, the column access control condition is "cannot access the amount in the data table".

[0071] Among them, see Figure 2 The initial syntax tree contains all the data columns of the data table that the initial SQL template needs to access. All the data columns form a list of data columns, corresponding to... Figure 2 The "Selectlist" in the initial syntax tree shown is a list of data columns that encompasses multiple data columns, such as... Figure 2 The columns shown are “Column:task_id”, “Column:amount”, “Column:update_time”, etc.; while column permission control metadata can control the data columns that roles can access in the data table. Therefore, through column permission control metadata, the initial syntax tree can be further controlled to delete data columns that roles cannot access. After deletion, the remaining data columns in the initial syntax tree are the data columns that roles can access, and the remaining data columns in the initial syntax tree are recorded as the target data column set.

[0072] For example, refer to Figure 3Assuming the column permission control condition is "cannot access the amount in the data table", that is, cannot access the amount column in the data table, the node "Column:amount" corresponding to the amount column in the initial syntax tree can be deleted through the column permission control metadata. Then, the other nodes under Selectlist (corresponding to different data columns) constitute the target data column set.

[0073] S322. Based on the row permission control metadata in the permission control metadata, construct row permission control conditions.

[0074] It should be noted that the access control metadata also includes row access control metadata, which is a row access control condition used to determine the data rows that a role can access; by parsing the row access control metadata, nodes are obtained for adding to the initial syntax tree. Figure 3 The red nodes shown are the line permission control conditions.

[0075] For example, if the row access control condition is "only data rows with an ID value of 01 can be accessed", then parsing the row access control metadata will yield the following: Figure 3 The three red nodes are shown.

[0076] S323. Based on the target data column set, the row permission control conditions, and the initial syntax tree, determine the target syntax tree.

[0077] It should be noted that the target data set can replace the original data set in the initial syntax tree, while row permission control conditions can be directly added to the initial syntax tree. In this way, the initial syntax tree can be updated through the target data set and row permission control conditions, and the new syntax tree obtained after updating the initial syntax tree is recorded as the target syntax tree.

[0078] S324. Based on the target syntax tree, determine the target SQL template.

[0079] It should be noted that the target syntax tree can be converted into the corresponding SQL template, denoted as the target SQL template.

[0080] Specifically, the entire conversion process uses a depth-first, post-order traversal approach to access each node of the target syntax tree, starting from the leaf nodes and building string fragments upwards, finally combining them into a complete SQL template at the root node.

[0081] It should be noted that, on the one hand, since the target syntax tree update includes access control metadata, which is used to determine the access permissions of roles to data rows and columns in a data table, the data obtained after subsequent data access in the database based on the target SQL template generated by this target syntax tree all conform to the access control metadata, thus ensuring data security. On the other hand, during the subsequent data retrieval process using the target SQL template with access control metadata, there is no need to first query access permissions and then access the database based on those permissions, nor is it necessary to first access the database data, then query access permissions, and then use those permissions to delete the accessed data. Instead, the target SQL template with access control metadata can directly access the database to retrieve data that conforms to the corresponding role's data permissions, effectively reducing the number of DBIOs and the amount of data transmitted, thereby effectively reducing the performance overhead of data access in the business system.

[0082] S330. Determine the target execution plan based on the target SQL template, and determine the two-level mapping key-value pair based on the initial SQL template in the first key information, the role information, and the target execution plan.

[0083] S340. In response to obtaining the second key information including the target SQL template and the role information in the two-layer mapping key-value pair, data access is performed based on the target execution plan.

[0084] Example 4

[0085] This application provides a data access control method in Embodiment 4, which optimizes the "determining a target data column set based on the initial syntax tree and the column access control metadata in the access control metadata" in Embodiment 3. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. The method includes:

[0086] S410. In response to the absence of an initial execution plan corresponding to the first key information, an initial syntax tree and permission control metadata are determined based on the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console.

[0087] S421A. Based on the initial syntax tree, determine the initial data column set.

[0088] It should be noted that, see Figure 2The initial syntax tree contains all the data columns in the data table corresponding to the initial SQL template in the first key information, such as "Column:task_id", "Column:amount", "Column:update_time", etc.; and the set of these multiple data columns is denoted as the initial data column set.

[0089] S421B. Calculate the intersection of the initial data column set and the data column set corresponding to the column permission control metadata in the permission control metadata to obtain the target data column set.

[0090] The access control metadata includes column access control metadata, which specifies the data columns that a role can access. The set of data columns that a role can access as specified by the column access control metadata is denoted as the data column set corresponding to the column access control metadata. In this embodiment, the initial syntax tree is intended to contain only the data columns corresponding to the column access control metadata.

[0091] Specifically, first determine that an initial data column set originally exists in the initial syntax tree, then calculate the intersection of this initial data column set and the data column set corresponding to the column permission control metadata, and record this intersection as the target data column set.

[0092] It should be noted that the target data column set is subsequently used to replace the initial data column set, thereby modifying the column permissions of the initial syntax tree. After the modified syntax tree generates the corresponding SQL template, the SQL template itself can carry the column permission control metadata in the permission control metadata. Thus, the SQL template can perform data access while also controlling data permissions for roles.

[0093] S422. Based on the row permission control metadata in the permission control metadata, construct row permission control conditions.

[0094] S423. Determine the target syntax tree based on the target data column set, the row permission control conditions, and the initial syntax tree.

[0095] S424. Based on the target syntax tree, determine the target SQL template.

[0096] S430. Determine the target execution plan based on the target SQL template, and determine the two-level mapping key-value pair based on the initial SQL template in the first key information, the role information, and the target execution plan.

[0097] S440. In response to obtaining the second key information including the target SQL template and the role information in the two-layer mapping key-value pair, data access is performed based on the target execution plan.

[0098] Example 5

[0099] This application provides a data access control method in Embodiment 5, which optimizes the "determining a target syntax tree based on the target data column set, the row access control conditions, and the initial syntax tree" in Embodiment 3. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. The method includes:

[0100] S510. In response to the absence of an initial execution plan corresponding to the first key information, an initial syntax tree and permission control metadata are determined based on the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console.

[0101] S521. Based on the initial syntax tree and the column permission control metadata in the permission control metadata, determine the target data column set.

[0102] S522. Based on the row permission control metadata in the permission control metadata, construct row permission control conditions.

[0103] S523A: Replace the initial data set in the initial syntax tree with the target data set to obtain an intermediate syntax tree.

[0104] The target data column set consists of the data columns that roles can access in the data table, as defined by role-based data permissions in the row access control metadata. At this point, the initial syntax tree also contains an initial data column set, which may contain data columns that roles do not have access to. Therefore, the target data column set can replace the initial data column set existing under the Selectlist node in the initial syntax tree, thereby... Figure 3 The target data column set is regenerated under the Selectlist node shown, and the new syntax tree is obtained after replacing the target data column set with the initial syntax tree. This is called the intermediate syntax tree.

[0105] S523B. Add the row permission control conditions to the intermediate syntax tree to obtain the target syntax tree; wherein, the row permission control conditions include database table fields and row permission control parameters.

[0106] Among them, see Figure 3 The intermediate syntax tree also contains a condition node, namely the WhereClause node, under which the row permission control conditions generated in step S522 can be attached; in this embodiment, the row permission control condition BinaryExpression specifically includes the database table field Column and the row permission control parameter Literal.

[0107] Specifically, the row permission control conditions generated in step S522 are attached to the condition nodes of the intermediate syntax tree to obtain the target syntax tree.

[0108] It should be noted that the target syntax tree contains both the corresponding SQL template content and the permission control metadata. When accessing the database, the SQL template generated based on the target syntax tree can directly obtain the data that meets the corresponding role permissions without having to query for role permissions again. This facilitates the improvement of data access efficiency and performance.

[0109] S524. Based on the target syntax tree, determine the target SQL template.

[0110] S530. Determine the target execution plan based on the target SQL template, and determine the two-level mapping key-value pair based on the initial SQL template in the first key information, the role information, and the target execution plan.

[0111] S540. In response to obtaining the second key information including the target SQL template and the role information in the two-layer mapping key-value pair, data access is performed based on the target execution plan.

[0112] Example 6

[0113] This application provides a data access control method in Embodiment Six, which optimizes the "data access based on the target execution plan" in Embodiment One. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. The method includes:

[0114] S610. In response to the absence of an initial execution plan corresponding to the first key information, an initial syntax tree and permission control metadata are determined based on the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console.

[0115] S620. Based on the initial syntax tree and the permission control metadata, generate the target SQL template.

[0116] S630. Determine the target execution plan based on the target SQL template, and determine the two-level mapping key-value pair based on the initial SQL template in the first key information, the role information, and the target execution plan.

[0117] S641. In response to obtaining the second key information including the target SQL template and the role information in the two-layer mapping key-value pair, obtain the business parameters and row permission control parameters bound to the target SQL template corresponding to the target execution plan.

[0118] After the target execution plan is generated, it is cached in the form of a two-level mapping key-value pair. For example, the two-level mapping key-value pair is [Initial SQL Template: Role Information: Target Execution Plan]. The key in this two-level mapping key-value pair is "Initial SQL Template: Role Information", and the value is "Target Execution Plan". This key is recorded as the second key information.

[0119] Subsequently, the same key information as the second key information may be obtained. If it is obtained, it means that there is a target execution plan corresponding to the second key information in the cache. Then, the parameter binding query stage can be entered, that is, the parameters required for the query are added to the target execution plan so that the target execution plan becomes the final execution plan for accessing data in the database.

[0120] It should be noted that the target execution plan is generated after parsing and optimizing the corresponding target SQL template, as shown in the reference. Figure 4 The pre-compilation process shown involves the application layer of the business system sending an initial SQL template (PreparedStatement) to the ORM (Object-Relational Mapping). The first interceptor set up by the ORM executes steps S610-S620 to obtain the target SQL template. Then, the business system's database generates a corresponding target execution plan based on this target SQL template and caches it in the form of two-level mapping key-value pairs. The ORM also has a second interceptor, which binds business parameters (the business query parameters that need to be bound) and row permission control parameters to the target SQL template. The business parameters represent the range of data that a role needs to query, such as data tables, data rows, and data columns. The row permission control parameters originate from permission control metadata. The second interceptor can obtain the business parameters and row permission control parameters bound to the target SQL template.

[0121] S642. Based on the business parameters, the row permission control parameters, and the target execution plan, perform data access.

[0122] In this context, the business system's database can add business parameters and row permission control parameters to the target execution plan to form the final execution plan required for data access. Through this final execution plan, data can be accessed from the database to obtain data with the corresponding role permissions.

[0123] Example 7

[0124] This application provides a data access control method in Embodiment 7, which supplements the method described in Embodiment 2. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. Figure 5 The method includes:

[0125] S711. In response to the absence of an initial execution plan corresponding to the first key information, generate an initial syntax tree based on the initial SQL template in the first key information.

[0126] S712. Obtain the permission control metadata of the role information in the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console.

[0127] S720. Based on the initial syntax tree and the permission control metadata, generate the target SQL template.

[0128] S730. Determine the target execution plan based on the target SQL template, and determine the two-level mapping key-value pair based on the initial SQL template in the first key information, the role information, and the target execution plan.

[0129] S740. In response to obtaining the second key information including the target SQL template and the role information in the two-layer mapping key-value pair, data access is performed based on the target execution plan.

[0130] S750. In response to the absence of an original execution plan corresponding to the initial SQL template, a first execution plan for the initial SQL template is generated.

[0131] It should be noted that this embodiment also uses the initial SQL template as the key in the key-value pair to determine whether the original execution plan corresponding to the initial SQL template currently exists in the database cache.

[0132] It should also be noted that the database cache also stores key-value pairs in the form of [initial SQL template: original execution plan].

[0133] Specifically, it is determined whether there is a key in each key-value pair in the database cache that is consistent with the initial SQL template; if not, the original execution plan corresponding to the initial SQL template needs to be generated according to the technical approach of S711-S730, which is recorded as the first execution plan; and the first execution plan is cached in the form of key-value pairs.

[0134] S760. In response to the existence of a target stored procedure in the stored procedure library that corresponds to the role information, a second execution plan for the target stored procedure is generated.

[0135] It should be noted that the data accessed by a character in the database sometimes requires a series of logical operations on multiple data tables before it can be generated; for example, if a character wants to access data in data table A, it needs to perform certain logical operations on data tables B, C, and D before it can obtain the data in data table A.

[0136] To improve the efficiency of role-based data access, similar to generating execution plans, this implementation generates corresponding stored procedures for different role information. The stored procedure includes an initial SQL template and logical operation code, which represents the logical operations required when accessing data from multiple data tables. The stored procedures corresponding to each role information are stored in a preset stored procedure library. For example, role information and corresponding stored procedures can also be stored in key-value pairs, where role information is the key and the corresponding stored procedure is the value.

[0137] Specifically, the database can receive role information sent by the application layer, traverse the cache to determine if there is a key-value pair containing that role information, and if so, parse out the stored procedure.

[0138] It should be noted that by parsing and optimizing the stored procedure, a corresponding execution plan can be generated, and this execution is recorded as the second execution plan.

[0139] S770: Replace the first execution plan with the second execution plan, and perform data access based on the second execution plan.

[0140] It should be noted that the role information has both a corresponding first execution plan and a corresponding second execution plan. However, the first execution plan is only generated based on the initial SQL template and cannot perform tasks that query data across multiple tables, while the second execution plan can perform tasks that query data across multiple tables. Therefore, the second execution plan can be replaced with the first execution plan, and then parameters can be bound to the second execution plan to generate the final execution plan. The final execution plan can then be used to perform data queries across multiple tables.

[0141] It should be noted that if a role involves complex multi-table queries or simple multi-table join queries during data access, and the first execution plan cannot meet the needs of cross-table data queries, a second execution plan can be generated to satisfy the requirements. This improves the compatibility of the business system with cross-table data query scenarios. When complex multi-table queries or simple multi-table join queries are required, the data query for this situation (complex multi-table queries, simple multi-table join queries) can be achieved through the steps shown in S750-S770.

[0142] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0143] Example 8

[0144] Based on the same inventive concept, this embodiment also provides a data access control device for implementing the data access control method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more data access control device embodiments provided below can be found in the limitations of the data access control method described above, and will not be repeated here.

[0145] In this embodiment, as Figure 6 As shown, a data access control device is provided, comprising:

[0146] The data preparation module is used to determine the initial syntax tree and permission control metadata based on the first key information in response to the absence of an initial execution plan corresponding to the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console;

[0147] The template generation module is used to generate a target SQL template based on the initial syntax tree and the permission control metadata;

[0148] The key-value pair determination module is used to determine the target execution plan based on the target SQL template, and to determine the two-level mapping key-value pairs based on the initial SQL template in the first key information, the role information, and the target execution plan.

[0149] The data access module is used to perform data access based on the target execution plan in response to obtaining the second key information, which includes the target SQL template and the role information in the two-layer mapping key-value pair.

[0150] Each module in the aforementioned data access control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0151] It should be noted that in this embodiment, in response to the absence of an initial execution plan corresponding to the first key information, an initial syntax tree and permission control metadata are determined based on the first key information; wherein, the permission control metadata and the corresponding role information are dynamically configured by the console; a target SQL template is generated based on the initial syntax tree and the permission control metadata; a target execution plan is determined based on the target SQL template; a two-level mapping key-value pair is determined based on the initial SQL template in the first key information, the role information, and the target execution plan; in response to obtaining second key information including the target SQL template and the role information in the two-level mapping key-value pair, data access is performed based on the target execution plan.

[0152] Through the above implementation, firstly, compared to the in-process access control scheme, the business logic and access control in this scheme are not tightly coupled. Role information and the corresponding access control metadata can be flexibly configured through the console, thereby improving the dynamic adjustment capability of data access control when the business system accesses data. Secondly, compared to the pre-process access control scheme, this scheme does not require querying access control information first and then performing business queries on the database based on the access control information. Instead, the configured access control information (metadata) can be directly integrated into the target execution plan of the business query, and the business query can be performed directly, effectively reducing the number of DBIO operations. In addition, compared to the post-process access control scheme, this scheme does not require first querying the database based on the access control information. Instead of retrieving a certain amount of data from the database and then using the query's permission control information to prune the retrieved data to obtain the required data, the configured permission control information (metadata) can be directly integrated into the target execution plan of the business query. The target execution plan then retrieves the required data corresponding to the permission control information, thus reducing the amount of DBIO data transfer. By reducing the number of DBIO operations and the amount of data transfer, the data access performance of the business system can be effectively improved. Thirdly, the two-layer mapping key-value pairs generated in this solution also contain role information, which allows multiple roles to be compatible under the same target SQL template, thereby effectively improving the compatibility of data access scenarios.

[0153] In an optional embodiment, determining the initial syntax tree and access control metadata based on the first key information includes:

[0154] Generate an initial syntax tree based on the initial SQL template in the first key information;

[0155] Obtain the permission control metadata of the role information in the first key information.

[0156] In an optional embodiment, generating the target SQL template based on the initial syntax tree and the access control metadata includes:

[0157] Based on the initial syntax tree and the column permission control metadata in the permission control metadata, determine the target data column set;

[0158] Based on the row permission control metadata in the aforementioned permission control metadata, row permission control conditions are constructed;

[0159] Based on the target data column set, the row permission control conditions, and the initial syntax tree, determine the target syntax tree;

[0160] Based on the target syntax tree, the target SQL template is determined.

[0161] In an optional embodiment, determining the target data column set based on the initial syntax tree and the column permission control metadata in the permission control metadata includes:

[0162] Based on the initial syntax tree, determine the initial data column set;

[0163] The intersection of the initial data column set and the data column set corresponding to the column permission control metadata in the permission control metadata is calculated to obtain the target data column set.

[0164] In an optional embodiment, determining the target syntax tree based on the target data column set, the row permission control conditions, and the initial syntax tree includes:

[0165] Replace the initial data set in the initial syntax tree with the target data set to obtain an intermediate syntax tree;

[0166] The row permission control conditions are added to the intermediate syntax tree to obtain the target syntax tree; wherein, the row permission control conditions include database table fields and row permission control parameters.

[0167] In an optional embodiment, the data access based on the target execution plan includes:

[0168] Obtain the business parameters and row permission control parameters bound to the target SQL template corresponding to the target execution plan;

[0169] Data access is performed based on the business parameters, the row permission control parameters, and the target execution plan.

[0170] In an optional embodiment, the data access control device further includes:

[0171] The first execution plan generation module is used to generate a first execution plan for the initial SQL template in response to the absence of an original execution plan corresponding to the initial SQL template.

[0172] The second execution plan generation module is used to generate a second execution plan for the target stored procedure in response to the existence of a target stored procedure in the stored procedure library that corresponds to the role information.

[0173] The plan replacement module is used to replace the first execution plan based on the second execution plan and to access data based on the second execution plan.

[0174] Example 9

[0175] In this embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows. Figure 7 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a data access control method.

[0176] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present disclosure and does not constitute a limitation on the computer device to which the present disclosure is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0177] Example 10

[0178] In this embodiment, a computer-readable storage medium is provided, such as... Figure 8 As shown, a computer program is stored thereon, and when the computer program is executed by the processor, it implements the steps in the above-described method embodiments.

[0179] Example 11

[0180] In this embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0181] It should be noted that the information collected is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and it does not violate public order and good morals. Corresponding operation portals are provided for users to choose to authorize or refuse.

[0182] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this disclosure can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this disclosure may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this disclosure may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0183] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0184] The embodiments described above are merely illustrative of several implementations of this disclosure, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent disclosure. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this disclosure, and these all fall within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the appended claims.

Claims

1. A data authority management method, characterized in that, The method comprises: in response to the absence of an initial execution plan corresponding to the first key information, determining an initial syntax tree and permission control metadata based on the first key information; wherein the permission control metadata and the corresponding role information are dynamically configured by a console; generating a target SQL template based on the initial syntax tree and the permission control metadata; determining a target execution plan based on the target SQL template, determining a double-layer mapping key-value pair based on the initial SQL template in the first key information, the role information, and the target execution plan; in response to obtaining second key information including the target SQL template and the role information in the double-layer mapping key-value pair, performing data access based on the target execution plan.

2. The method of claim 1, wherein, The method comprises: generating an initial syntax tree based on the initial SQL template in the first key information; obtaining the permission control metadata of the role information in the first key information.

3. The method of claim 1, wherein, The method comprises: determining a target data column set based on the initial syntax tree and column permission control metadata in the permission control metadata; constructing a row permission control condition based on the row permission control metadata in the permission control metadata; determining a target syntax tree based on the target data column set, the row permission control condition, and the initial syntax tree; determining a target SQL template based on the target syntax tree.

4. The method of claim 3, wherein, The method comprises: determining an initial data column set based on the initial syntax tree; calculating the intersection of the initial data column set and the data column set corresponding to the column permission control metadata in the permission control metadata to obtain a target data column set.

5. The method of claim 3, wherein, The method comprises: replacing the initial data column set in the initial syntax tree with the target data column set to obtain an intermediate syntax tree; adding the row permission control condition to the intermediate syntax tree to obtain a target syntax tree; wherein the row permission control condition includes a database table field and a row permission control parameter.

6. The method of claim 1, wherein, The method comprises: obtaining business parameters and row permission control parameters bound to the target SQL template corresponding to the target execution plan; performing data access based on the business parameters, the row permission control parameters, and the target execution plan.

7. The method of claim 2, wherein, The method further comprises: in response to the absence of an original execution plan corresponding to the initial SQL template, generating a first execution plan for the initial SQL template; in response to the presence of a target stored procedure corresponding to the role information in the stored procedure library, generating a second execution plan for the target stored procedure; replacing the first execution plan with the second execution plan and performing data access based on the second execution plan.

8. A data authority management device, characterized by, The device comprises: The data preparation module is configured to, in response to the absence of an initial execution plan corresponding to the first key information, determine an initial syntax tree and permission control metadata based on the first key information, wherein the permission control metadata and corresponding role information are dynamically configured by a console. The template generation module is configured to generate a target SQL template based on the initial syntax tree and the permission control metadata. The key-value pair determination module is configured to determine a target execution plan based on the target SQL template, and determine a double-layer mapping key-value pair based on an initial SQL template in the first key information, the role information, and the target execution plan. The data access module is configured to, in response to obtaining second key information including the target SQL template and the role information in the double-layer mapping key-value pair, perform data access based on the target execution plan. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 7.

Images