Data access method and device
By constructing a permission framework, the system dynamically identifies and updates the user's target permission areas, solving the problems of cumbersome and delayed permission management in existing technologies and achieving efficient and secure data access.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA MOBILE COMM GRP CO LTD
- Filing Date
- 2025-12-24
- Publication Date
- 2026-04-17
AI Technical Summary
In existing technologies, user permission management is cumbersome and prone to oversights, resulting in low data access efficiency and an inability to respond promptly to user permission adjustments, thus affecting data access efficiency and security.
By constructing a permission framework, the system dynamically identifies the user's target permission area, updates permission points in real time based on identity information and permission data, accurately maps the user's permission scope, avoids permission omissions, and achieves automated permission management.
It improves data access efficiency, enhances data security and access control accuracy, ensures smooth access to authorized data, and reduces delays and interruptions in permission allocation.
Smart Images
Figure CN121887464A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data processing technology, and in particular to a data access method and apparatus. Background Technology
[0002] While providing efficient computing and data processing capabilities, computing networks also suffer from problems such as malicious attacks, data leaks, and network failures, which seriously threaten user privacy and data security.
[0003] To improve data security, existing technologies employ data encryption to ensure that data is not stolen or tampered with during transmission, and allow administrators to assign permissions to users, enabling users to query data of corresponding sensitivity levels based on their different permissions.
[0004] However, existing user permission management is usually list-based, where each permission point is discrete and independent. When a new task involving multiple resources needs to be assigned to a user, the administrator must manually assign all relevant permission points one by one. This process is not only tedious and inefficient, but also prone to missing some related permissions, causing users to be interrupted when accessing data due to insufficient permissions, resulting in low data access efficiency. Summary of the Invention
[0005] This application provides a data access method and apparatus to solve the technical problem of low data access efficiency in the prior art.
[0006] This application provides a data access method, including the following steps: Obtain the user's data access request; Determine the target permission area corresponding to the user in the pre-built permission framework; Based on the target permission area, respond to the user's data access request.
[0007] According to a data access method provided in this application, determining the target permission region corresponding to the user in a pre-built permission framework includes: Obtain the user's identity information; Based on the identity information, the user's first permission data is determined; Based on the first permission data, the target permission area is determined.
[0008] According to a data access method provided in this application, determining the target permission region corresponding to the user in a pre-built permission framework further includes: All edge points of the target permission area are used as the first permission points; If any first permission point is updated to a second permission point, the line connecting the first permission point and the second permission point is used as a border, and the border is filled to obtain the updated target permission area.
[0009] According to a data access method provided in this application, the construction steps of the permission framework include: Retrieve basic data within the preset permission range; The basic data is divided into multiple different permission sub-regions; The permission framework is constructed based on the permission sub-regions.
[0010] According to a data access method provided in this application, the basic data includes one or more of the following: Personal data; Internal management data; Daily operational data; Business data; Externally available data.
[0011] According to a data access method provided in this application, dividing the basic data into multiple different permission sub-regions includes: Based on the types of the basic data, the basic data is divided into different levels of sensitive data; De-identified data is selected from the different levels of sensitive data; The de-identified data is then subjected to string replacement to obtain standard data; The sensitive data and the standard data are divided into multiple different permission sub-regions.
[0012] According to a data access method provided in this application, before responding to the user's data access request, the method further includes: Obtain the user's login information; The login information is verified to obtain the verification result; The verification result is determined to be successful.
[0013] This application also provides a data access device, including the following modules: The acquisition module is used to acquire users' data access requests; The determination module is used to determine the target permission area corresponding to the user in a pre-built permission framework; The response module is used to respond to the user's data access request based on the target permission area.
[0014] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement any of the data access methods described above.
[0015] This application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data access method as described above.
[0016] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the data access methods described above.
[0017] The data access method and apparatus provided in this application acquire user data access requests; determine the target permission area corresponding to the user in a pre-built permission framework, thereby accurately mapping the user's permission scope through the permission framework, dynamically identifying authorized areas, avoiding access interruption problems caused by missing user permissions, and thus enhancing data security and the accuracy of access control; based on the target permission area, respond to the user's data access request, and respond according to the target permission area to ensure that authorized data is successfully accessed and improve data access efficiency. Attached Figure Description
[0018] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0019] Figure 1 This is a flowchart illustrating the data access method provided in this application.
[0020] Figure 2 This is one of the target permission area diagrams provided in this application.
[0021] Figure 3 This is the second schematic diagram of the target permission area provided in this application.
[0022] Figure 4 This is a schematic diagram of the data access device provided in this application.
[0023] Figure 5 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation
[0024] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0025] With the rapid development of computing network technology, its applications in fields such as intelligent manufacturing, smart cities, intelligent transportation, and healthcare are becoming increasingly widespread. However, while providing efficient computing and data processing capabilities, computing networks also face severe challenges in data security and privacy protection. Malicious attacks, data breaches, and network failures occur frequently, seriously threatening user privacy and data security.
[0026] To enhance data security, data encryption is currently employed. When data is transmitted over the network, encryption technology is used to ensure that the data is not stolen or tampered with during transmission. For example, different encryption methods are used according to the sensitivity level of the data. In the data query system, administrators can assign permissions, allowing query users to query data of corresponding sensitivity levels based on their different permissions.
[0027] To ensure data security, users need to be assigned appropriate access permissions, and their permissions must be verified upon access. Existing technology obtains user permission information based on login details; it then uses this permission information to determine if the user has read / write permissions; if the user has read / write permissions, the technology encrypts uploaded data and decrypts downloaded data. This approach eliminates the need for administrators to manually assign permissions to each user, automatically determining the scope of user permissions for more accurate management and reducing the likelihood of errors when manually assigning permissions.
[0028] However, while the aforementioned technologies can confirm user permission information, when users adjust permissions, such as when a higher-level user assigns a task with new permissions to a lower-level user, the associated permissions cannot be accessed. The task can only be executed after subsequent permission reallocation, resulting in low data access efficiency. Therefore, this application proposes a data access method and apparatus to further improve data access efficiency in computing networks while ensuring data security.
[0029] The following is combined with Figures 1 to 5 This application describes the data access method and apparatus.
[0030] Figure 1 This is a flowchart illustrating the data access method provided in this application, such as... Figure 1 As shown, the method includes the following: Step 101: Obtain the user's data access request; Step 102: Determine the target permission area corresponding to the user in the pre-built permission framework; Step 103: Based on the target permission area, respond to the user's data access request.
[0031] Specifically, a permission framework can be pre-built based on the data in the computing network. This permission framework enables dynamic access control, meaning that when responding to a user's data access request, the user can only access data within their authorized area, including various data access requests such as data upload, data download, and data query.
[0032] For example, in one embodiment, a system administrator (User A) needs to access internal company operational data, including information on newly added departments and employee personal information. User A submits a query request on the system interface: "Get information on newly added dispatched departments this month and contact information of relevant personnel." Based on User A's identity information (administrator role), the system determines their corresponding target permission area. The system dynamically maps User A to the target permission area and responds to the data access request: it executes the query for newly added department information and employee personal information within the target permission area, and the response only returns data within the target permission area, avoiding unauthorized access.
[0033] For example, in another embodiment, a regular user (User C) submits a data access request on the system interface: "Access the marketing department's product supply data for the previous quarter." The system verifies User C's login information (login ID "Wang Wu 333", password "98765432333") and detects that their current permissions (regular user) only allow access to their own resources and public resources (i.e., the target permission area is a low-permission area), and they cannot directly access business data. At this point, the administrator assigns User C a new permission point (e.g., "market data query" permission). The system first queries all of User C's permission points (including the new permission point), then uses all edge points as borders to delineate the permission area, and uses a filling algorithm to associate all permission points, updating the low-permission area to obtain a high-permission area, which becomes the target permission area. In this case, User C's target permission area covers the business data. Based on the updated target permission area, the system responds to User C's request, directly returning the marketing department's product supply data for the previous quarter as a readable result, such as "Products supplied last quarter: 1000 tables, 2000 chairs."
[0034] This application's embodiments dynamically restrict the data scope through a permission framework, ensuring that users only access authorized content and improving data security. Through a permission point filling mechanism, the user's target permission area is adjusted in real time, avoiding the delay problem of needing to reallocate permissions in the prior art. This allows ordinary users to quickly obtain temporary authorization without waiting for a complex process, thereby improving data access efficiency and enhancing user experience.
[0035] The data access method provided in this application obtains the user's data access request; determines the target permission area corresponding to the user in a pre-built permission framework, thereby accurately mapping the user's permission scope through the permission framework, dynamically identifying the authorized area, avoiding access interruption caused by missing user permissions, thus enhancing data security and the accuracy of access control; and responds to the user's data access request based on the target permission area, ensuring that authorized data is successfully accessed and improving data access efficiency.
[0036] Furthermore, the construction steps of the permission framework include: Retrieve basic data within the preset permission range; The basic data is divided into multiple different permission sub-regions; The permission framework is constructed based on the permission sub-regions.
[0037] Furthermore, the basic data includes one or more of the following: Personal data; Internal management data; Daily operational data; Business data; Externally available data.
[0038] Furthermore, the division of the basic data into multiple different permission sub-regions includes: Based on the types of the basic data, the basic data is divided into different levels of sensitive data; De-identified data is selected from the different levels of sensitive data; The de-identified data is then subjected to string replacement to obtain standard data; The sensitive data and the standard data are divided into multiple different permission sub-regions.
[0039] Specifically, the process first acquires basic data within a preset permission range from the computing power network; then, it divides the basic data into different levels of sensitive data, encrypts the sensitive data, and queries the sensitive data for desensitized data; then, it performs string replacement on the desensitized data to obtain standard data; finally, it divides the sensitive data and standard data into multiple different permission sub-regions, thereby obtaining a dynamic permission framework that includes multiple permission sub-regions of different sizes.
[0040] For example, one or more of the following data sensitivity levels can be set for basic data: Level 1 sensitivity level, Level 2 sensitivity level, and Level 3 sensitivity level, etc.
[0041] Data classified as Level 1 Sensitive Data may include personal data such as addresses, names, phone numbers, identity IDs, and biometric data. For example, if "Zhang San's phone number is 11123456789 and his home address is Building 1, Unit 1, ** Road, ** Community", then this data would be classified as Level 1 Sensitive Data.
[0042] Level 2 sensitive data can include internal management data, daily operational data, etc. For example, if the data is "Our company has added an overseas dispatch department based on operational development," then the sensitivity level of this data is classified as Level 2 sensitive data.
[0043] Level 3 sensitive data can include publicly available external data (such as information that can be accessed publicly on websites) and general business data. For example, data such as "Our company supplied tables and chairs last quarter" or "Based on the content at URL **" would be classified as Level 3 sensitive data.
[0044] In a computing network, a dataset typically includes multiple sensitive data with different sensitivity levels. Therefore, the sensitivity level of each data point in the dataset can be obtained separately, and these multiple sensitivity levels can be represented by sensitivity identifiers. For example, if the dataset includes the statement "Based on operational development, our company has added an outsourcing department. The current department head is Zhang San. Zhang San's phone number is 11123456789, and his home address is at **Road**, **Community**, Building 1, Unit 1," then since "Based on operational development, our company has added an outsourcing department" is a Level 2 sensitivity level, "The current department head is Zhang San" is a Level 2 sensitivity level, and "Zhang San's phone number is 11123456789, and his home address is at **Road**, **Community**, Building 1, Unit 1, Unit 1" is a Level 1 sensitivity level, the sensitivity levels can be converted into corresponding identifiers. For example, Level 1 sensitivity level corresponds to identifier 1, Level 2 sensitivity level corresponds to identifier 2, and Level 3 sensitivity level corresponds to identifier 3, resulting in a sensitivity identifier of 221 for the dataset.
[0045] It is understandable that the encryption requirements for sensitive data vary depending on the level of sensitivity.
[0046] For example, in one embodiment, sensitive data of level 1 sensitivity needs to be encrypted using a high-security method, such as asymmetric encryption. The dataset includes the statement, "Due to operational development, our company has added an outpost department. Zhang San is currently the department head. Zhang San's phone number is 11123456789, and his home address is Building 1, Unit 1, ** Road, ** Community." Therefore, "Due to operational development, our company has added an outpost department" is classified as Level 2 sensitivity, "Zhang San is currently the department head" is Level 2 sensitivity, and "Zhang San's phone number is 11123456789, and his home address is Building 1, Unit 1, ** Road, ** Community" is Level 1 sensitivity. The sensitivity levels are converted into corresponding identifiers. For example, Level 1 sensitivity corresponds to identifier 1, Level 2 sensitivity corresponds to identifier 2, and Level 3 sensitivity corresponds to identifier 3. Therefore, the sensitivity identifier for the dataset is 221. Depending on actual needs, sensitive data with a sensitivity identifier of 1 (or other sensitive identifiers, which are not limited in this application embodiment) can be encrypted using an asymmetric encryption method. The asymmetric encryption algorithm can be any of the following: RSA encryption algorithm, Digital Signature Algorithm (DSA), Elliptic Curve Cryptography (ECC), etc.
[0047] For example, in another embodiment, for sensitive data at the second level of sensitivity, an encryption method that can verify data integrity is required, such as using a hash function or asymmetric encryption. The dataset includes the statement "Based on operational development, our company has added an outpost department. The current department head is Zhang San. Zhang San's phone number is 11123456789, and his home address is Building 1, Unit 1, ** Road, ** Community". Therefore, "Based on operational development, our company has added an outpost department" is classified as Level 2 sensitivity, "The current department head is Zhang San" is Level 2 sensitivity, and "Zhang San's phone number is 11123456789, and his home address is Building 1, Unit 1, ** Road, ** Community" is Level 1 sensitivity. The sensitivity level is converted into a corresponding identifier. For example, Level 1 sensitivity corresponds to identifier 1, Level 2 sensitivity corresponds to identifier 2, and Level 3 sensitivity corresponds to identifier 3. Therefore, the sensitivity identifier of the dataset is 221. Based on actual needs, a hash function (such as MD5, SHA-1, SHA-256, SHA-512, etc.) is used to map input data of arbitrary length to a fixed-length output (hash value) for sensitive data with a sensitivity identifier of 2 (or other sensitive identifiers; this application embodiment does not limit this).
[0048] For example, in another embodiment, for sensitive data at sensitivity level 3, a highly efficient encryption method is required, such as symmetric encryption. For example, data such as "Our company supplied tables and chairs last quarter" or "Content based on the URL **" are denoted by 3. Based on actual needs, symmetric encryption is used for sensitive data with a sensitivity denoted by 3 (or other sensitivity denoteds; this application embodiment does not limit this). This encryption method is fast and efficient, suitable for encrypting large amounts of data. The symmetric encryption algorithm can be any of the following: Advanced Encryption Standard (AES), Data Encryption Standard (DES), Triple Data Encryption Algorithm (3DES), etc.
[0049] This application's embodiments first establish data sensitivity levels, dividing basic data into different levels of sensitive data; then, it obtains the sensitivity levels of multiple data points in the dataset and synthesizes these multiple sensitivity levels into a sensitivity identifier; finally, it selects an encryption method for the data according to the sensitivity identifier and encrypts the data in the dataset. Thus, by classifying data according to its sensitivity, different encryption methods are used for different sensitive data, enabling encryption based on different data types, adjusting encryption effectiveness and efficiency, improving the security performance of sensitive data, and ultimately enhancing the privacy and security performance of data in the computing network.
[0050] If the dataset includes the statement "Based on operational development, our company has added an outpost department. The current department head is Zhang San. Zhang San's phone number is 11123456789, and his home address is Building 1, Unit 1, ** Road, ** Community," then the statement "Based on operational development, our company has added an outpost department" is classified as Level 2 sensitivity, "The current department head is Zhang San" is classified as Level 2 sensitivity, and "Zhang San's phone number is 11123456789, and his home address is Building 1, Unit 1, ** Road, ** Community" is classified as Level 1 sensitivity. The sensitivity levels are then converted to corresponding identifiers. For example, Level 1 sensitivity corresponds to identifier 1, Level 2 sensitivity corresponds to identifier 2, and Level 3 sensitivity corresponds to identifier 3. Therefore, the sensitivity identifier for the dataset is 221.
[0051] Depending on the actual needs, if data identified as 1 in the sensitive identifier (other sensitive identifiers can also be selected, and this application embodiment does not limit this) needs to be desensitized, and the data identified as 1 in the sensitive identifier uses an asymmetric encryption method, then the SUBSTITUTE function or REPLACE function can be used in combination with the REPT function to replace the phone number string and obtain standard data.
[0052] For example, if you want to desensitize an identity ID, you can use the following formula: =REPLACE(A1,7,8,"********"); Assuming the identity ID is stored in cell A1, this formula means that starting from the 7th digit, the middle 8 digits will be replaced with 8 asterisks "*".
[0053] For example, by using a masking method to de-identify home addresses and replacing the house number with a string, the de-identified standard data is "Building 1, XX Community, XX Road".
[0054] Even after anonymization, the data can still be used for statistics or display, but it cannot be directly linked to individuals, thus reducing the risk of data leakage. Compared to traditional full-scale anonymization, the embodiments of this application reduce the amount of data processed through identifier-based filtering, which can reduce computing resource consumption by more than 30% in computing networks, achieving efficient anonymization.
[0055] The de-identified standard data and the un-identified basic data are divided into different permission sub-regions, thus obtaining the permission framework. Within the permission framework, users can access data after logging in.
[0056] Furthermore, before responding to the user's data access request, the method further includes: Obtain the user's login information; The login information is verified to obtain the verification result; The verification result is determined to be successful.
[0057] Specifically, a user database is used to store each user's identity information, which includes at least their name, phone number, and verification password.
[0058] For example, a user database may include the following user and identity information: User A: Name: Zhang San, Phone Number: 11123456789, Verification Password: 98765432111; User B: Name: Li Si, Phone Number: 22223456789, Verification Password: 98765432222; User C: Name: Wang Wu, Phone Number: 33323456789, Verification Password: 98765432333.
[0059] In some embodiments, to prevent information leakage caused by multiple users having the same name and verification password, each user can be assigned a unique login identifier, which consists of characters, such as user A's login identifier being Zhang San 111, user B's login identifier being Li Si 222, and user C's login identifier being Wang Wu 333.
[0060] Before a user can make a data access request, they must first provide login information, which includes at least a login identifier and a verification password. Then, the login information is verified: if the provided login identifier and verification password are the same as those in the user database, the verification result is considered successful, and the user can make a data access request; if the provided login identifier and verification password are different from those in the user database, the verification result is considered unsuccessful, and the user cannot make an access request.
[0061] For example, before making a data access request, user A verifies the following login information: 1. The user enters the login identifier: Zhang San 111; verification password: 98765432111. At this time, the login identifier and verification password are the same as those in the user database, and the login information verification is successful. 2. The user enters the login identifier: Zhang San 122; verification password: 98765432111. At this time, the login identifier is different from the one in the user database, and the verification password cannot be verified. The login information verification fails in this case. 3. The user enters the login identifier: Zhang San 111; verification password: 98765432222. At this time, the login identifier is the same as that in the user database, but the verification password is different from that in the user database. Therefore, the login information verification fails in this case.
[0062] This application embodiment improves the overall security of the system by verifying login information, prevents unauthorized access, and forms a dual protection by combining with the permission framework, thereby reducing security vulnerabilities.
[0063] Further, determining the target permission region corresponding to the user in the pre-built permission framework includes: Obtain the user's identity information; Based on the identity information, the user's first permission data is determined; Based on the first permission data, the target permission area is determined.
[0064] Specifically, the user's identity information is first obtained, including at least name, phone number, verification password, and login identifier; then, user roles can be defined based on the identity information, and each user has a different role, such as administrator and ordinary user.
[0065] In one embodiment, different roles can be assigned based on the following user and identity information: User A is the administrator: Name is Zhang San, Phone number is 11123456789, Verification password is 98765432111, Login ID is Zhang San 111; User B is a regular user: Name is Li Si, Phone number is 22223456789, Verification password is 98765432222, Login ID is Li Si222; User C is a regular user: Name is Wang Wu, Phone number is 33323456789, Verification password is 98765432333, Login ID is Wang Wu 333.
[0066] If the primary permissions for administrators are pre-defined to include resource monitoring, security policy formulation and enforcement, and resource allocation, while the primary permissions for ordinary users include access to their own resources and public resources, then the target permission area for each user within the permission framework can be determined based on the primary permission data corresponding to their role. For example, the target permission area for ordinary users is the middle low-permission area, which includes their own resources and public resources; the target permission area for administrators is a higher-level area that expands outward from the low-permission area in a circular or regular polygonal pattern, including resource monitoring, security policy formulation and enforcement, and resource allocation.
[0067] The system verifies whether a user's data access request matches their target permission area, and performs operations such as data querying, data downloading, or data uploading within the target permission area upon successful matching. For example, user A can issue access requests for resource monitoring, security policy formulation and enforcement, and resource allocation, while users B and C can issue access requests for their own resources and public resources.
[0068] This application embodiment dynamically derives permission data through user identity information, ensuring the accuracy and personalization of permission allocation; by matching target permission areas for users, it enhances the precision of permission control; by automating identity verification, it reduces human allocation errors and improves system response efficiency, thereby improving data access efficiency and reliability.
[0069] Furthermore, determining the target permission region corresponding to the user in the pre-built permission framework further includes: All edge points of the target permission area are used as the first permission points; If any first permission point is updated to a second permission point, the line connecting the first permission point and the second permission point is used as a border, and the border is filled to obtain the updated target permission area.
[0070] Specifically, Figure 2 This is one of the target permission area diagrams provided in this application, such as... Figure 2 As shown, all edge points of the target permission area are taken as first permission points, and the area within all first permission points is the target permission area.
[0071] Figure 3This is the second schematic diagram of the target permission area provided in this application, as shown below. Figure 3 As shown, when user permissions are updated (e.g., when an administrator assigns a new task to a user), any corresponding permission point is updated to obtain a second permission point. At this time, the line connecting the first and second permission points is used as the border to depict the area, and the updated target permission area is obtained by filling in all associated permission points.
[0072] For example, if user A assigns a task with new permissions to user B and only temporarily updates one permission point, then after user B obtains the new permissions, all of its permission points (including all first and second permission points) are first identified, and then the region boundary is updated with the edge points among all permission points, and finally filled into a complete permission region to obtain the updated target permission region.
[0073] This application embodiment adjusts the permission area in real time by changing the edge permission points, ensuring the continuity and integrity of the permission point set, and realizing the real-time update of the target permission area. This avoids the problem of delayed permission update leading to untimely or interrupted data access in traditional methods, and improves the user's data access efficiency in dynamic task allocation scenarios.
[0074] The data access apparatus provided in this application is described below. The data access apparatus described below can be referred to in correspondence with the data access method described above.
[0075] Figure 4 This is a schematic diagram of the data access device provided in this application, such as... Figure 4 As shown. An embodiment of this application provides a data access device, including an acquisition module 401, a determination module 402, and a response module 403, wherein: The acquisition module 401 is used to acquire the user's data access request; the determination module 402 is used to determine the target permission area corresponding to the user in the pre-built permission framework; and the response module 403 is used to respond to the user's data access request based on the target permission area.
[0076] The data access method and apparatus provided in this application acquire user data access requests; determine the target permission area corresponding to the user in a pre-built permission framework, thereby accurately mapping the user's permission scope through the permission framework, dynamically identifying authorized areas, avoiding access interruption problems caused by missing user permissions, and thus enhancing data security and the accuracy of access control; based on the target permission area, respond to the user's data access request, and respond according to the target permission area to ensure that authorized data is successfully accessed and improve data access efficiency.
[0077] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a data access method, which includes: Obtain the user's data access request; Determine the target permission area corresponding to the user in the pre-built permission framework; Based on the target permission area, respond to the user's data access request.
[0078] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0079] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the data access methods provided by the above methods, the method including: Obtain the user's data access request; Determine the target permission area corresponding to the user in the pre-built permission framework; Based on the target permission area, respond to the user's data access request.
[0080] In another aspect, this application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the data access methods provided by the methods described above, the method comprising: Obtain the user's data access request; Determine the target permission area corresponding to the user in the pre-built permission framework; Based on the target permission area, respond to the user's data access request.
[0081] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0082] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.
[0083] In this application's embodiments, "determine B based on A" means that factor A must be considered when determining B. It is not limited to "B can be determined based solely on A," but should also include: "determine B based on A and C," "determine B based on A, C, and E," "determine C based on A, and further determine B based on C," etc. Additionally, it can include using A as a condition for determining B, for example, "when A meets the first condition, determine B using the first method"; another example, "when A meets the second condition, determine B," etc.; another example, "when A meets the third condition, determine B based on the first parameter," etc. Of course, it can also be a condition where A is a factor in determining B, for example, "when A meets the first condition, determine C using the first method, and further determine B based on C," etc.
[0084] It should also be noted that the terms "target," "first," and "second" in this application are used to distinguish similar objects, and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, and the number of objects is not limited; for example, the first object can be one or more.
[0085] In this application, the term "multiple" refers to two or more, and other quantifiers are similar.
[0086] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.
Claims
1. A data access method, characterized in that, include: Obtain the user's data access request; Determine the target permission area corresponding to the user in the pre-built permission framework; Based on the target permission area, respond to the user's data access request.
2. The data access method according to claim 1, characterized in that, Determining the target permission region corresponding to the user in the pre-built permission framework includes: Obtain the user's identity information; Based on the identity information, the user's first permission data is determined; Based on the first permission data, the target permission area is determined.
3. The data access method according to claim 2, characterized in that, Determining the target permission region corresponding to the user in the pre-built permission framework further includes: All edge points of the target permission area are used as the first permission points; If any first permission point is updated to a second permission point, the line connecting the first permission point and the second permission point is used as a border, and the border is filled to obtain the updated target permission area.
4. The data access method according to claim 2, characterized in that, The construction steps of the permission framework include: Retrieve basic data within the preset permission range; The basic data is divided into multiple different permission sub-regions; The permission framework is constructed based on the permission sub-regions.
5. The data access method according to claim 4, characterized in that, The basic data includes one or more of the following: Personal data; Internal management data; Daily operational data; Business data; Externally available data.
6. The data access method according to claim 5, characterized in that, The process of dividing the basic data into multiple different permission sub-regions includes: Based on the types of the basic data, the basic data is divided into different levels of sensitive data; De-identified data is selected from the different levels of sensitive data; The de-identified data is then subjected to string replacement to obtain standard data; The sensitive data and the standard data are divided into multiple different permission sub-regions.
7. The data access method according to claim 1, characterized in that, Before responding to the user's data access request, the method further includes: Obtain the user's login information; The login information is verified to obtain the verification result; The verification result is determined to be successful.
8. A data access device, characterized in that, include: The acquisition module is used to acquire users' data access requests; The determination module is used to determine the target permission area corresponding to the user in a pre-built permission framework; The response module is used to respond to the user's data access request based on the target permission area.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the data access method as described in any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the data access method as described in any one of claims 1 to 7.