Template-based data authority control method and device
By introducing permission templates and role mappings into data permission control, the problems of scattered and complex data permission configuration logic are solved, enabling the reuse of permission rules and improving development efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-22
- Publication Date
- 2026-04-03
AI Technical Summary
In existing technologies, data permission configuration logic is scattered, difficult to manage, difficult to reuse across different systems, and the configuration is complex and inefficient, especially when assigning permissions among employees with different positions within an enterprise, the operation is cumbersome.
The system configures data permission policies by pre-setting information, including multiple data permission rules. Each rule contains a permission template and a rule value. The data permission policies are mapped to role information. The system receives user information to determine role information and obtains the corresponding permission policy configuration information based on the role information. The system then accesses the target data through a unified interface call.
It enables the reuse of permission rules and simplifies configuration logic, thereby improving the efficiency of data permission development.
Smart Images
Figure CN121786875A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of data access control technology, and in particular to a template-based data access control method and apparatus. Background Technology
[0002] In enterprise application architectures, data access control is a crucial consideration for every system. Fine-grained data access control effectively prevents sensitive data (such as customer information, financial data, and core technical documents) from being accessed, leaked, or tampered with by unauthorized personnel; this is the lifeline of enterprise data security. Data systems typically assign different data permissions to different users. For example, within an enterprise data system, finance personnel can view or edit financial data such as financial statements, while business personnel can view or edit business-related data.
[0003] Typical systems implement this through AOP and SQL interception within the system, which presents several problems: the implementation logic is scattered and difficult to manage; the implementation is limited to a specific system, making the logic difficult to reuse; and the data permission logic is hardcoded into the system or has complex configurations. For employees with different roles within an enterprise, assigning data permissions sequentially to employees with different roles is cumbersome and inefficient.
[0004] Therefore, simplifying data permission configuration logic and improving the efficiency of data permission development are urgent technical problems that need to be solved. Summary of the Invention
[0005] To address the aforementioned technical problems, this disclosure provides a template-based data access control method and apparatus.
[0006] A first aspect of this disclosure provides a template-based data access control method, comprising:
[0007] Preset data permission policy configuration information, which includes multiple data permission rules. Each data permission rule includes a permission template and a rule value. The data permission policy is mapped to role information.
[0008] Receive user information and determine the role information corresponding to the user information based on the user information;
[0009] Based on the role information, obtain the data permission policy configuration information corresponding to the role information;
[0010] Obtain the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and access the corresponding target data based on the data permission rules.
[0011] A second aspect of this disclosure provides a template-based data access control device, comprising:
[0012] The data permission policy configuration preset module is used to preset data permission policy configuration information. The data permission policy configuration information includes multiple data permission rules. Each data permission rule includes a permission template and a rule value. The data permission policy is mapped to role information.
[0013] The user role information acquisition module is used to receive user information and determine the role information corresponding to the user information based on the user information.
[0014] The data permission policy configuration acquisition module is used to obtain the data permission policy configuration information corresponding to the role information based on the role information.
[0015] The execution module is used to obtain the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and to access the corresponding target data based on the data permission rules.
[0016] A third aspect of this disclosure provides an electronic device, including a processor and a memory:
[0017] The memory is used to store program code and transfer the program code to the processor; the processor is used to execute the template-based data access control method described in the first aspect above, according to the instructions in the program code.
[0018] A fourth aspect of this disclosure provides a computer-readable storage medium for storing program code for executing the template-based data access control method of the first aspect above.
[0019] The technical solution provided in this disclosure has the following advantages compared with the prior art:
[0020] This disclosure provides a template-based data permission control method and apparatus. It includes preset data permission policy configuration information, which comprises multiple data permission rules, each including a permission template and a rule value. The data permission policy is mapped to role information. The method involves receiving user information, determining the corresponding role information based on the user information, obtaining the corresponding data permission policy configuration information based on the role information, obtaining the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and accessing the corresponding target data based on the data permission rules. This allows for the reuse of permission rules through templates and simplifies data permission configuration logic through a unified interface call, thereby improving the efficiency of data permission development. Attached Figure Description
[0021] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.
[0022] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0023] Figure 1 This is a flowchart illustrating a template-based data access control method provided in an embodiment of this disclosure;
[0024] Figure 2 This is a flowchart illustrating another template-based data access control method provided in this disclosure.
[0025] Figure 3 This is a schematic table of the Data Permission Description (DSL) field provided in the embodiments of this disclosure;
[0026] Figure 4 This is a structural block diagram of a template-based data access control device provided in an embodiment of this disclosure;
[0027] Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of this disclosure;
[0028] Figure 6 This is a structural block diagram of a computer-readable storage medium provided in an embodiment of this disclosure. Detailed Implementation
[0029] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.
[0030] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.
[0031] It should be understood that the steps described in the embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.
[0032] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.
[0033] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".
[0034] Typically, data systems assign different data permissions to different users. For example, in an enterprise's data system, finance personnel can view or edit financial data such as financial statements, while business personnel can view or edit business data. Assigning data permissions sequentially to employees with different roles within the enterprise is cumbersome and inefficient. Furthermore, the logic is difficult to reuse; the data permission logic is either hardcoded into the system or has complex configurations. To address this issue, this disclosure provides a template-based data permission control method, which will be described below with reference to specific embodiments.
[0035] Figure 1 This is a flowchart illustrating a template-based data access control method provided in an embodiment of this disclosure. The method specifically includes the following steps:
[0036] Step S101: Preset data permission policy configuration information. The data permission policy configuration information includes multiple data permission rules. Each data permission rule includes a permission template and a rule value. The data permission policy configuration information is mapped to role information.
[0037] In this embodiment of the invention, the data permission configuration information is information used to configure different types of data permissions. These data permissions include at least one of the following: viewing, modifying, deleting, and adding target data.
[0038] For example, data access permissions for a certain system need to be controlled from the following dimensions: sales staff can only see their own data; sales managers in each region can only see data for their respective regions (the sales manager of the Anhui region can only see data for the Anhui region); similarly, the leaders in charge of a business group can only see the data of their respective business group; and finance staff can only see data with amounts less than 10,000.
[0039] Optionally, the essence of the above dimensions is data permission rules. Each data permission rule includes a permission template and a rule value, and the data permission policy is mapped to role information.
[0040] Optionally, the permission template includes rule fields and rule expressions, but does not contain specific rule values. Rule fields include, but are not limited to, creator, region, and sales amount. Rule expressions are set based on different rule fields and include, but are not limited to, =, in, <, or >. Rule values are set corresponding to the rule fields. When the rule field is creator, the corresponding rule value can be the currently logged-in user; when the rule field is region, the corresponding rule value can be Anhui region, Hubei region, etc.; when the rule field is sales amount, the corresponding rule value can be the specific amount.
[0041] Example: (1) Rule field: Creator, rule expression: =, rule value: Current logged-in user; (2) Rule field: Region, rule expression: in, rule value: Anhui Region, Hubei Region; (3) Rule field: Sales amount, rule expression: <, rule value: 10000.
[0042] In the embodiments of this disclosure, the rule template only contains rule fields and rule expressions, and does not contain specific rule values. For example: Creator = . By creating different rule templates, rules can be reused, improving the configuration efficiency of permission rules.
[0043] Furthermore, the essence of data permission rules is adding specific rule values to a rule template. For example: Creator = 'zhangsan'. By setting corresponding permission rules, permissions can be configured based on different roles, thus improving the efficiency of permission rule configuration.
[0044] Furthermore, the data permission policy configuration information, also known as the data permission policy, includes a set of related data permission rules. Different data permission policy configuration information is mapped to different role information, and thus the corresponding data permission policy configuration information can be assigned to users based on the corresponding role information.
[0045] For example, the data permission policy here, which is the data permission policy configuration information, can be understood as the data permission rules under different business scenarios. For instance, in many companies' business scenarios, the rules for dividing data permissions are relatively clear. For example, a certain planner role can only see data from one or a few channels, a certain sales role is only responsible for orders related to East China, and so on. These data permission rules can then be abstracted into data permission policies.
[0046] Step S102: Receive user information and determine the role information corresponding to the user information.
[0047] In this embodiment of the invention, role information includes at least one or more of the following: job title, department, and region. Different users have different role information.
[0048] For example, the roles here can be: administrator, director, ordinary employee, etc. Roles can be divided based on different job levels or different regions or set in advance.
[0049] Step S103: Based on the role information, obtain the data permission policy configuration information corresponding to the role information.
[0050] In this embodiment of the invention, corresponding data permission policy configuration information is obtained through the set role information. This data permission configuration information can be understood as a combination of multiple data permission rules. By packaging and configuring all relevant data permission rules corresponding to the role information into a single package for that role, the efficiency of data permission configuration can be greatly improved.
[0051] Optionally, the data permission configuration information here is pre-configured and can be directly retrieved.
[0052] Step S104: Obtain the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and access the corresponding target data based on the data permission rules.
[0053] In this embodiment of the invention, based on the data permission policy configuration information assigned to the user, the corresponding data permission rules are obtained, and then the corresponding target data can be accessed based on these data permission rules.
[0054] In this embodiment of the invention, by pre-setting data permission policy configuration information, which includes multiple data permission rules, each data permission rule includes a permission template and a rule value, and the data permission policy is mapped to role information; receiving user information, determining the role information corresponding to the user information; obtaining the data permission policy configuration information corresponding to the role information; obtaining the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and accessing the corresponding target data based on the data permission rules, thereby enabling the reuse of permission rules through templates and simplifying the data permission configuration logic through unified interface calls, thus improving the efficiency of data permission development.
[0055] This disclosure provides embodiments based on the above embodiments. Figure 2 This is a flowchart illustrating another template-based data access control method provided in this disclosure. Figure 2 As shown, this template-based data access control method specifically includes the following steps:
[0056] Step S201: Preset data permission policy configuration information. The data permission policy configuration information includes multiple data permission rules. Each data permission rule includes a permission template and a rule value. The data permission policy is mapped to role information. The data permission rule includes a permission template and a rule value. The permission template includes a rule field and a rule expression. The rule value corresponds to the rule field.
[0057] Specifically, data permission rules include permission templates and rule values. Permission templates include rule fields and rule expressions, and rule values correspond to rule fields.
[0058] Optionally, data permission policy configuration information is mapped to role information. Specifically, this refers to the preset mapping relationship between data permission policy configuration information and role information, with different role information corresponding to different data permission policy configuration information.
[0059] Step S202: Receive user information and determine the role information corresponding to the user information based on the user information.
[0060] Specifically, different users have different role information, which includes, but is not limited to, at least one or more of the following: job title, department, and region.
[0061] Step S203: Based on the role information, obtain the data permission policy configuration information corresponding to the role information.
[0062] In this embodiment of the disclosure, data permission policy configuration information corresponding to the role information is obtained based on the role information. Specifically, this means obtaining data permission policy configuration information corresponding to the role information based on a unified external interface, which includes permission conversion functions.
[0063] Optionally, the unified external interface here includes a permission conversion function. When a user performs a permission conversion, the conversion function can perform the conversion based on the user's role information.
[0064] Step S204: Obtain the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and access the corresponding target data based on the data permission rules.
[0065] Optionally, the method of accessing the corresponding target data based on the data permission policy configuration information corresponding to the role information specifically refers to obtaining an SQL query statement with permission rules through a unified external interface based on the original SQL query statement, and then accessing the corresponding target data based on the SQL query statement with permission rules.
[0066] Furthermore, based on the original permission query conditions, information related to permission policies configured according to permission roles is added, which is essentially permission concatenation. Specifically, this means adding conditions to the SQL, which requires adding query conditions to the original SQL based on the user's configured permission roles and the query table in the SQL.
[0067] Optionally, data access control policies can be described using a YAML file. This file primarily configures the conditions under which data is generated, the logic for permission concatenation, and the applicable data types. An example is provided below:
[0068]
[0069]
[0070] Optionally, the data permission policy configuration means that when a query SQL queries the T_TXN_ORDER or T_MST_ITEM tables, permission configuration needs to be added to restrict access to data from certain brands and channels. Which brands and channels can be accessed is configured in the permission module (system) through the user's UI. (The `fieldsource` field specifies the source of the field value, which can be an enumeration value, a list of database table field values, or an API, etc., allowing the user's front-end UI to configure the specific value.)
[0071] Optional, Figure 3 Further explanations of the DSL fields involved in the data permission description are provided, through... Figure 3Knowing the specific meaning of different DSL fields is helpful for configuring data permission policies.
[0072] This embodiment of the disclosure uses preset data permission policy configuration information, which includes multiple data permission rules. Each data permission rule includes a permission template and a rule value. The data permission policy is mapped to role information. The system receives user information, determines the role information corresponding to the user information, obtains the data permission policy configuration information corresponding to the role information, obtains the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and accesses the corresponding target data based on the data permission rules. This allows for the reuse of permission rules through templates and simplifies the data permission configuration logic through a unified interface call, thereby improving the efficiency of data permission development.
[0073] Correspondingly, this application also provides a template-based data access control device. Figure 4 This is a structural block diagram of a template-based data access control device according to an embodiment of this application. Figure 4 As shown, a template-based data access control device may include:
[0074] The data permission policy configuration preset module 401 is used to preset data permission policy configuration information. The data permission policy configuration information includes multiple data permission rules. Each data permission rule includes a permission template and a rule value. The data permission policy is mapped to role information.
[0075] User role information acquisition module 402 is used to receive user information and determine the role information corresponding to the user information based on the user information.
[0076] The data permission policy configuration acquisition module 403 is used to acquire data permission policy configuration information corresponding to the role information based on the role information.
[0077] The execution module 404 is used to obtain the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and to access the corresponding target data based on the data permission rules.
[0078] Therefore, this embodiment of the application presets data permission policy configuration information, which includes multiple data permission rules. Each data permission rule includes a permission template and a rule value, and the data permission policy is mapped to role information. It receives user information, determines the role information corresponding to the user information, obtains the data permission policy configuration information corresponding to the role information, obtains the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and accesses the corresponding target data based on the data permission rules. Thus, permission rules are reused through templates, and the unified interface call simplifies the data permission configuration logic, thereby improving the efficiency of data permission development.
[0079] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.
[0080] This application also provides an electronic device 500, such as... Figure 5 As shown, it includes one or more processors 501, communication interface 502, memory 503 and communication bus 504, wherein the processor 501, communication interface 502 and memory 503 communicate with each other through communication bus 504.
[0081] Memory 503 is used to store computer programs;
[0082] When the processor 501 executes the program stored in the memory 503, it implements the steps of the template-based data access control method described above. For example, when the processor 501 executes the program stored in the memory 503, it implements the following steps:
[0083] Preset data permission policy configuration information, which includes multiple data permission rules. Each data permission rule includes a permission template and a rule value. The data permission policy is mapped to role information.
[0084] Receive user information and determine the role information corresponding to the user information based on the user information;
[0085] Based on the role information, obtain the data permission policy configuration information corresponding to the role information;
[0086] Obtain the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and access the corresponding target data based on the data permission rules.
[0087] Processor 501 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.
[0088] Memory 503 may include mass storage for data or instructions. For example, and not limitingly, memory 503 may include a hard disk drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where suitable, memory 503 may include removable or non-removable (or fixed) media. In a particular embodiment, memory 503 is a non-volatile solid-state memory. In a particular embodiment, memory 503 includes read-only memory (ROM). Where suitable, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.
[0089] Communication bus 504 includes hardware, software, or both, for coupling the aforementioned components together. For example, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, the bus may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.
[0090] This application also provides a computer-readable storage medium 600, such as... Figure 6 As shown, the computer-readable storage medium 600 stores a computer program that, when executed by a processor, implements the steps of the template-based data access control method described above. For example, the computer program is configured to store program code 601, which is used to perform the following steps:
[0091] Preset data permission policy configuration information, which includes multiple data permission rules. Each data permission rule includes a permission template and a rule value. The data permission policy is mapped to role information.
[0092] Receive user information and determine the role information corresponding to the user information based on the user information;
[0093] Based on the role information, obtain the data permission policy configuration information corresponding to the role information;
[0094] Obtain the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and access the corresponding target data based on the data permission rules.
[0095] If an integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. Computer-readable media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. Of course, there are other types of readable storage media, such as quantum memories, graphene memories, etc. It should be noted that the content contained in computer-readable media may be appropriately added to or subtracted from the requirements of legislation and patent practice in a jurisdiction. For example, in some jurisdictions, computer-readable media may not include electrical carrier signals and telecommunication signals, in accordance with legislation and patent practice.
[0096] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.
[0097] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0098] This application uses specific embodiments to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A template-based data access control method, characterized in that, include: The system includes preset data permission policy configuration information, which includes multiple data permission rules. Each data permission rule includes a permission template and a rule value. The data permission policy is mapped to role information. Receive user information, and determine the role information corresponding to the user information based on the user information; Based on the role information, obtain the data permission policy configuration information corresponding to the role information; The corresponding data permission rules are obtained based on the data permission policy configuration information corresponding to the role information, and the corresponding target data is accessed based on the data permission rules.
2. The template-based data access control method according to claim 1, characterized in that, The preset data permission policy configuration information includes multiple data permission rules, each of which includes a permission template and a rule value. The data permission policy configuration information is mapped to role information and also includes: The data permission rules include permission templates and rule values. The permission templates include rule fields and rule expressions, and the rule values correspond to the rule fields.
3. The template-based data access control method according to claim 1, characterized in that, The preset data permission policy configuration information includes multiple data permission rules, each of which includes a permission template and a rule value. The data permission policy configuration information is mapped to role information and also includes: A mapping relationship between the data permission policy configuration information and role information is preset, and different role information corresponds to different data permission policy configuration information.
4. The template-based data access control method according to claim 1, characterized in that, The method for obtaining the data permission policy configuration information corresponding to the role information based on the role information further includes: Based on a unified external interface, the data permission policy configuration information corresponding to the role information is obtained, and the unified external interface includes permission conversion functions.
5. The template-based data access control method according to claim 4, characterized in that, The method for accessing the corresponding target data based on the data permission policy configuration information corresponding to the role information further includes: obtaining an SQL query statement with permission rules through a unified external interface based on the original SQL query statement, and accessing the corresponding target data based on the SQL query statement with permission rules.
6. The template-based data access control method according to claim 1, characterized in that, The data permissions include at least one of the following: viewing, modifying, deleting, and adding the target data.
7. The template-based data access control method according to claim 1, characterized in that, The role information includes at least one or more of the following: job title, department, and region.
8. A template-based data access control device, characterized in that, include: A data permission policy configuration preset module is used to preset data permission policy configuration information. The data permission policy configuration information includes multiple data permission rules, each of which includes a permission template and a rule value. The data permission policy is mapped to role information. The user role information acquisition module is used to receive user information and determine the role information corresponding to the user information based on the user information. The data permission policy configuration acquisition module is used to acquire the data permission policy configuration information corresponding to the role information based on the role information. The execution module is used to obtain the corresponding data permission rules based on the data permission policy configuration information corresponding to the role information, and to access the corresponding target data based on the data permission rules.
9. An electronic device, characterized in that, The device includes a memory and a processor: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the template-based data access control method according to any one of claims 1-7 according to the instructions in the program code.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code for executing the template-based data access control method according to any one of claims 1-7.