Rule configuration engine-based multi-dimensional data permission filtering method and system

Abstract

The invention relates to the field of computer data processing, in particular to a multi-dimensional data permission filtering method and system based on a rule configuration engine, and the method comprises the steps: obtaining an identity label and role information of a user in response to the sending of a query request of the user, constructing context information of the user according to the identity label, the role information and the query request, and filtering the context information of the user. The method comprises the following steps: acquiring a column permission set and a row permission set containing a dynamic placeholder, analyzing the row permission set by adopting a preset placeholder analysis engine, converting the dynamic placeholder into a data range set according to context information, generating a corresponding row filtering condition according to the data range set, and filtering the row filtering condition according to the corresponding row filtering condition. Filtering the target field according to the column permission set, recombining an original screening condition by utilizing a row filtering condition, generating a target query object, finally converting the target query object into a database query statement, executing the database query statement, and returning a query result. The method of the embodiment is lower in maintenance cost and higher in flexibility.

Description

Technical Field

[0001] This invention relates to the field of computer data processing technology. More specifically, this invention relates to a multi-dimensional data permission filtering method and system based on a rule configuration engine. Background Technology

[0002] In big data reporting and analysis systems or business intelligence (BI) systems, it is often necessary to restrict access permissions for users at different levels or roles to prevent unauthorized access or leakage of confidential information. Traditional access control schemes are often hard-coded and scattered throughout the business code. Whenever new business rules are added or the organizational structure is adjusted, the code needs to be modified and redeployed, resulting in extremely high maintenance costs. Furthermore, traditional access control schemes typically use static configuration to restrict access permissions, failing to flexibly adjust dynamically to changes in user roles or subordinates. For example, when a department manager wants to view the data of all newly added subordinates, access permissions for each new subordinate's data must be configured individually. More seriously, to ensure information security, these traditional solutions often require large-scale data filtering processes in memory, leading to poor query performance in big data reporting and analysis systems.

[0003] Therefore, the access permission function in existing big data reporting and analysis systems mainly suffers from high maintenance costs and poor flexibility. Summary of the Invention

[0004] To address the technical problems of high maintenance costs and poor flexibility in the access permission functions of existing big data reporting and analysis systems, this invention discloses a multi-dimensional data permission filtering method and system based on a rule configuration engine.

[0005] In a first aspect, this invention discloses a multi-dimensional data permission filtering method based on a rule configuration engine, comprising: In response to a user's query request, obtain the user's identity and role information; The query request includes the target field and the original filter conditions; Based on the user's identity, role information, and query request, construct the user's context information and obtain the column permission set and the row permission set containing dynamic placeholders; The preset placeholder parsing engine is used to parse the row permission set, and the dynamic placeholders are converted into a data range set according to the context information; Generate corresponding row filtering conditions based on the data range set; The target field is filtered based on the column permission set, and the original filtering conditions are reorganized using the row filtering conditions to generate the target query object. The target query object is converted into a database query statement and executed, and the query results are returned.

[0006] Beneficial Effects: The method of this invention decouples permission logic from specific data through the combination of dynamic placeholder configuration and a parsing engine. Specifically, it transforms abstract placeholders into specific data range values ​​in real time based on user context, and automatically reorganizes the generated row filtering conditions and column permission sets with the original query request. This allows for a set of data ranges that can dynamically adapt to different roles, avoiding the redundancy and maintenance difficulties of traditional static configuration. Furthermore, without intruding on business code, it enforces dual fine-grained control of row-level data isolation and column-level privacy protection, significantly improving the flexibility of the access permission constraint function and reducing its maintenance costs.

[0007] Preferably, before parsing the row permission set using a preset placeholder parsing engine, the method of the present invention includes: Establish a mapping relationship between placeholder feature characters and parsing strategy functions in the preset parsing strategy registry.

[0008] Preferably, a preset placeholder parsing engine is used to parse the row permission set, and the dynamic placeholders are converted into a data range set based on the context information, specifically: Iterate through and identify placeholder character features in the set of line permissions; Based on the placeholder characteristic characters, match the corresponding parsing strategy function in the parsing strategy registry; The context information is injected as a parameter into the target parsing strategy function for execution, resulting in a data range set.

[0009] Preferably, based on the data range set, corresponding row filtering conditions are generated, including: Determine if the data range set is an empty set; If so, construct an equality condition pointing to a non-existent value or an inclusion condition containing a preset null value identifier as a row filtering condition to block data return at the database level.

[0010] Preferably, the target field is filtered based on the column permission set, including: Identify the metric fields and dimension grouping fields in the target field; Calculate the intersection of the metric field and the column permission set, and retain the metric fields that are located within the intersection; If the metric field after the intersection operation is empty, an "unauthorized" exception will be thrown or an empty data structure containing only the dimension grouping field will be returned.

[0011] Preferably, the original screening criteria are reorganized using row filtering conditions, including: The original filtering criteria are parsed into a subtree of the first abstract syntax tree; Parse the row filtering conditions into a second abstract syntax tree subtree; Construct a root node that is logically ANDed with type AND; The first and second abstract syntax tree subtrees are attached to the child nodes of the root node and reorganized to obtain the target query object.

[0012] Preferably, the target query object is converted into a database query statement, including: Iterate through all primitive aliases in the target query object; The original alias is encoded using a hash algorithm to generate a unique hash alias; Establish a mapping relationship between the original alias and the hash alias, and replace the original alias with the hash alias when generating database query statements.

[0013] Preferably, converting the target query object into a database query statement further includes: Obtain the type identifier of the target database; Select the corresponding dialect adapter based on the type identifier; A dialect adapter is used to convert the target query object into a function or syntax structure supported by the corresponding database.

[0014] Preferably, the row permission set is stored in a JSON tree structure.

[0015] Secondly, the present invention discloses a multi-dimensional data permission filtering system based on a rule configuration engine, including a processor and a memory. The memory stores computer program instructions, and when the computer program instructions are executed by the processor, the multi-dimensional data permission filtering method based on a rule configuration engine described in the first aspect is implemented.

[0016] The beneficial effects of this invention are as follows: Compared with existing technologies, the method of this invention supports fine-grained control of both column and row permissions, and can dynamically adjust access permissions based on user context, thereby solving the technical problems of high maintenance cost and poor flexibility of access permission functions in existing big data report analysis systems. Attached Figure Description

[0017] The above and other objects, features, and advantages of exemplary embodiments of the present invention will become readily apparent upon reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of the invention are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein: Figure 1 This is a flowchart of the multi-dimensional data permission filtering method based on a rule configuration engine in Embodiment 1 of the present invention; Figure 2This is a schematic diagram of the structure of the multi-dimensional data permission filtering system based on the rule configuration engine in Embodiment 2 of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0020] Example 1 like Figure 1 As shown, this embodiment discloses a multi-dimensional data permission filtering method based on a rule configuration engine, including: S10: In response to a user query request, obtain the user's identity and role information. In this embodiment, the user enters query information in the query bar of the big data report analysis system and clicks the query button, triggering the aforementioned step S10. The query request includes the target field, i.e., the text content of the query information; it also includes original filtering conditions, i.e., user-defined filtering query rules. When performing the query, the user needs to complete a login verification operation, which verifies the user's password, token, token code, and account status. The technical basis of this verification process is the JWT (JSON Web Token) standard, RSA asymmetric encryption storage technology, and an automatic token refresh mechanism. After successful verification, login is complete. At this point, all user interactions within the big data report analysis system are recorded in the log, allowing direct access to the user's identity and role information. The identity can be the user's login ID.

[0021] S20: Based on the identity identifier, role information and query request, construct the user's context information, and obtain the column permission set and the row permission set containing dynamic placeholders.

[0022] It should be explained that step S10 above relies on the system's front-end for acquisition, while the context information is generated by the back-end based on the front-end's Token or Sensation parsing / database query. This context information includes column permission sets and row permission sets. The column permission set represents the "visibility attributes" and "field dimensions" of the data, essentially introducing a whitelist mechanism. The row permission set represents the "jurisdiction" or "content boundaries" of the data, defining the range of data that a user can see appropriate to their identity. In this embodiment, the row permission set is stored in a JSON tree structure.

[0023] It should be explained that, in this embodiment, a policy registry is pre-configured for each identity or role information. This table represents the mapping relationship between placeholder feature characters and parsing policy functions. For example, this table can be:

[0024] It should be noted that the above-mentioned parsing strategy registry can be predefined according to actual conditions to simplify the backend query process.

[0025] S30: The preset placeholder parsing engine is used to parse the row permission set and the dynamic placeholders are converted into a data range set according to the context information.

[0026] Step S30 above includes: S31: Traverse and identify placeholder feature characters in the row permission set.

[0027] Specifically, the script iterates through the placeholders to traverse and identify the placeholder characteristic characters in the line permission set.

[0028] S32: Match the corresponding parsing strategy function in the parsing strategy registry based on the placeholder characteristic character.

[0029] Specifically, after obtaining the specific placeholder characteristic characters, the system relies on the policy registry mentioned above to match and retrieve the corresponding parsing policy function.

[0030] S33: Inject the context information as a parameter into the target parsing strategy function for execution, and obtain the data range set.

[0031] It should be explained that, in the method of this embodiment, the data range set is an intermediate medium for translating abstract permission rules into specific database query conditions. It is the substantive basis for determining which data rows a user will ultimately see.

[0032] Through the above steps S31-S33, the method of this embodiment can automatically and conveniently obtain placeholder feature characters and data range sets using scripts to advance the execution of subsequent steps.

[0033] S40: Generate corresponding row filtering conditions based on the data range set.

[0034] Step S40 above includes: S41: Determine whether the data range set is an empty set.

[0035] In this embodiment, the `resultList()` data parser is invoked via a script to parse the aforementioned data range. This is a MyBatis result set mapping component that converts the database result set into a list of Java objects after the SQL query is executed, thereby supporting complex mapping logic. In this process, the method in this embodiment introduces a null value safety handling mechanism, namely, step S42.

[0036] S42: If so, construct an equality condition pointing to a non-existent value or an inclusion condition containing a preset null value identifier as a row filtering condition to block data return at the database level.

[0037] S43: If not, return the numerical or string values ​​of the data range as the row filter condition.

[0038] For example, at the code level, the specific execution process of steps S42-S43 above is as follows: If resultList is empty: / / Null value safety handling: Ensure SQL queries return no results val="null" ELSE IF resultList elements are numeric: / / Number format: 123,456,789 val = resultList.join(",") ELSE: / / String format: requires quotation marks: "abc","def","ghi" val=resultList.map(s->"\""+s+"\"").join(",") / / String replacement rowConfig=rowConfig.replace(placeholder,val) / / Return the processed configuration RETURN rowConfig It should be explained that, when the value is not empty, the above data range can be in numeric or string format. The actual returned result can contain multiple numeric values ​​or multiple strings, which are then returned as row filtering conditions.

[0039] S50: Filter the target field based on the column permission set, and reorganize the original filtering conditions using row filtering conditions to generate the target query object.

[0040] In step S50, filtering the target field based on the column permission set includes: S51: Identify the metric field and dimension grouping field in the target field.

[0041] S52: Calculate the intersection of the metric field and the column permission set, and retain the metric fields that are located in the intersection.

[0042] S53: If the metric field after the intersection operation is empty, throw an "unauthorized" exception or return an empty data structure containing only the dimension grouping field.

[0043] It should be explained that steps S51-S53 above involve field intersection operations, and the code for these operations on the database at the code level can be as follows: allowedColumns = permission.columns / / Only retain metrics that the user has permission to access. filteredIndicators = reportQuery.indicators .filter(indicator ->allowedColumns.contains(indicator)) reportQuery.indicators = filteredIndicators / / Filter information column fields filteredInfoColumns = reportQuery.infoColumns .filter(column ->allowedColumns.contains(column)) reportQuery.infoColumns = filteredInfoColumns / / Check if there are any searchable fields IF reportQuery.indicators=null AND reportQuery.infoColumns=null: RETURN EMPTY_RESULT For example, suppose the original input is: [click, conversion, revenue, cost]; The column permission set is: [click, conversion, cost]; The corresponding output is: [click, conversion, cost] (revenue is filtered).

[0044] By following steps S51-S53 above, information filtering for the column permission dimension can be completed.

[0045] Furthermore, in step S50 above, the original screening conditions are reorganized using row filtering conditions, including: S54: Parse the original filtering conditions into a subtree of the first abstract syntax tree.

[0046] In this embodiment, the original filtering conditions are user-defined filtering query rules. They can be some words used by the user in the query or constraints that the user selects. The first abstract syntax tree subtree can be a simplified representation of keywords based on the original filtering conditions.

[0047] S55: Parse the row filtering conditions into a second abstract syntax tree subtree.

[0048] In this embodiment, step S43 returns the row filtering conditions, which are further converted and parsed into a second abstract syntax tree subtree.

[0049] S56: Construct a root node of type AND.

[0050] S57: Attach the first abstract syntax tree subtree and the second abstract syntax tree subtree to the child nodes of the root node, and reorganize them to obtain the target query object.

[0051] For example, suppose the first abstract syntax tree subtree after parsing the original filter conditions is "budget" and the root node is "AND", and the corresponding second abstract syntax tree subtree is the string advertiser a, b, c. Then, the target query object obtained by reorganization can be "budget AND advertiser a", "budget AND advertiser b", or "budget AND advertiser c".

[0052] Through steps S54-S57 above, based on column permission filtering, the method of this embodiment also introduces row permission query, thereby supporting fine-grained control of column permissions and row permissions.

[0053] S60: Convert the target query object into a database query statement and execute it, returning the query results.

[0054] Step S60 includes the process of hash alias encoding, specifically as follows: S61: Iterate through all primitive aliases in the target query object.

[0055] S62: Use a hash algorithm to encode the original alias and generate a unique hash alias.

[0056] Specifically, in this embodiment, the method introduces an alias encoding algorithm encodeAlias(), which first calculates the hash value of the original alias, then takes the last 8 digits of the hash value, and then adds the date to its prefix to avoid cache conflicts. After adding the date, the unique hash alias is obtained.

[0057] S63: Establish a mapping relationship between the original alias and the hash alias, and replace the original alias with the hash alias when generating database query statements.

[0058] By following steps S61-S63, SQL keyword conflicts and special character conflicts can be avoided. Specifically, regarding keyword conflicts, the original alias may contain identifiers with the same names as SQL keywords such as ORDER, SELECT, and WHERE. Direct concatenation of these can lead to syntax errors or parsing ambiguity. Hash aliases, however, have no semantic meaning and completely eliminate conflicts with reserved words, ensuring the syntactic security of the query statement. Regarding special character conflicts, the original alias may contain special characters such as spaces, quotation marks, semicolons, and parentheses. These characters require escaping in SQL and can be maliciously used for SQL injection attacks. Hash aliases, however, are constrained to a standard format containing only alphanumeric characters and underscores, requiring no escaping and naturally resisting injection attacks, simplifying the security handling of string concatenation.

[0059] Furthermore, step S60 above also involves a query transformation process at the database layer, specifically including: S64: Get the type identifier of the target database.

[0060] In this embodiment, the target database primarily refers to MySQL; however, in other embodiments, it could also be different databases such as ClickHouse or Presto. The type identifier is a unique identifier used to identify different types of databases.

[0061] S65: Select the corresponding dialect adapter based on the type identifier.

[0062] S66: Use a dialect adapter to convert the target query object into a function or syntax structure supported by the corresponding database.

[0063] In this embodiment, a dialect adapter is used to convert OSQL (Object SQL) into a specific database syntax for different database types.

[0064] Steps S64-S66 achieve decoupling between query logic and database platform by dynamically identifying the database type and adapting to the corresponding dialect. This embodiment's method allows the same query object to be automatically converted into functions or syntax structures specific to different databases (such as MySQL, ClickHouse, and Presto), effectively shielding the differences between databases in function naming, date handling, and aggregation syntax. This not only significantly improves code reusability and portability, reduces the technical costs of cross-database migration or supporting multiple data sources, but also ensures that the generated SQL statements can fully utilize the performance characteristics and native optimizations of different databases, enhancing the system's flexibility and scalability from an architectural perspective.

[0065] Through the above steps S10-S60, compared with the prior art, the method of this embodiment has the following advantages in different dimensions:

[0066] Through the aforementioned dynamic placeholder parsing engine and two-dimensional orthogonal filtering process, the method in this embodiment solves the problems of high maintenance costs and poor flexibility in the access permission function of existing big data report analysis systems.

[0067] Example 2 like Figure 2 As shown, this embodiment discloses a multi-dimensional data permission filtering system based on a rule configuration engine, including a processor and a memory. The memory stores computer program instructions, and when the computer program instructions are executed by the processor, the multi-dimensional data permission filtering method based on a rule configuration engine described in Embodiment 1 is implemented.

[0068] The system in this embodiment also includes other components well known to those skilled in the art, such as communication interfaces. Their settings and functions are known in the art, and therefore will not be described in detail here.

[0069] In this invention, the aforementioned memory can be any tangible medium containing or storing a program that can be used or combined with an instruction execution system, apparatus, or device. For example, a computer-readable storage medium can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc., or any other medium that can be used to store desired information and can be accessed by an application, module, or both. Any such computer storage medium can be part of a device or accessible to or connected to a device. Any application or module described in this invention can be implemented using computer-readable / executable instructions that can be stored or otherwise maintained by such a computer-readable medium.

[0070] In the description of this specification, "multiple" means at least two, such as two, three or more, etc., unless otherwise expressly and specifically defined.

[0071] While this specification has shown and described numerous embodiments of the invention, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will occur to those skilled in the art without departing from the spirit and essence of the invention. It should be understood that various alternatives to the embodiments of the invention described herein may be employed in the practice of this invention.

Claims

1. A multi-dimensional data permission filtering method based on a rule configuration engine, characterized in that, include: In response to a user's query request, obtain the user's identity and role information; The query request includes the target field and the original filter conditions; Based on the identity identifier, the role information, and the query request, construct the user's context information and obtain the column permission set and the row permission set containing dynamic placeholders; The set of row permissions is parsed using a preset placeholder parsing engine, and the dynamic placeholders are converted into a data range set based on the context information; Generate corresponding row filtering conditions based on the data range set; The target field is filtered according to the column permission set, and the original filtering conditions are reorganized using the row filtering conditions to generate the target query object; The target query object is converted into a database query statement and executed, and the query results are returned.

2. The multi-dimensional data permission filtering method based on a rule configuration engine according to claim 1, characterized in that, Before parsing the set of line permissions using a preset placeholder parsing engine, the method includes: Establish a mapping relationship between placeholder feature characters and parsing strategy functions in the preset parsing strategy registry.

3. The multi-dimensional data permission filtering method based on a rule configuration engine according to claim 2, characterized in that, The set of row permissions is parsed using a preset placeholder parsing engine, and the dynamic placeholders are converted into a data range set based on the context information, specifically: Traverse and identify placeholder feature characters in the set of line permissions; Based on the placeholder feature character, match the corresponding parsing strategy function in the parsing strategy registry; The context information is injected as a parameter into the target parsing strategy function for execution, thereby obtaining the data range set.

4. The multi-dimensional data permission filtering method based on a rule configuration engine according to claim 1, characterized in that, Based on the data range set, generate corresponding row filtering conditions, including: Determine whether the data range set is an empty set; If so, an equality condition pointing to a non-existent value or an inclusion condition containing a preset null value identifier is constructed as the row filtering condition to block data return at the database level.

5. The multi-dimensional data permission filtering method based on a rule configuration engine according to claim 1, characterized in that, Filtering the target field based on the column permission set includes: Identify the metric field and dimension grouping field in the target field; Calculate the intersection of the metric field and the column permission set, and retain the metric fields located within the intersection; If the metric field after the intersection operation is empty, an "unauthorized" exception will be thrown or an empty data structure containing only the dimension grouping field will be returned.

6. The multi-dimensional data permission filtering method based on a rule configuration engine according to claim 1, characterized in that, Reorganizing the original filtering conditions using the row filtering conditions includes: The original filtering conditions are parsed into a first abstract syntax tree subtree; The row filtering conditions are parsed into a second abstract syntax tree subtree; Construct a root node that is logically ANDed with type AND; The first and second abstract syntax tree subtrees are attached to the child nodes of the root node and reorganized to obtain the target query object.

7. The multi-dimensional data permission filtering method based on a rule configuration engine according to claim 1, characterized in that, Converting the target query object into a database query statement includes: Iterate through all original aliases in the target query object; The original alias is encoded using a hash algorithm to generate a unique hash alias; Establish a mapping relationship between the original alias and the hash alias, and replace the original alias with the hash alias when generating database query statements.

8. The multi-dimensional data permission filtering method based on a rule configuration engine according to claim 1, characterized in that, Converting the target query object into a database query statement also includes: Obtain the type identifier of the target database; Select the corresponding dialect adapter based on the type identifier; The dialect adapter is used to convert the target query object into a function or syntax structure supported by the corresponding database.

9. The multi-dimensional data permission filtering method based on a rule configuration engine according to claim 1, characterized in that, The set of row permissions is stored in a JSON tree structure.

10. A multi-dimensional data permission filtering system based on a rule configuration engine, characterized in that, It includes a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the multidimensional data permission filtering method based on the rule configuration engine as described in any one of claims 1-9 is implemented.

Images