Data query method, device and equipment based on authority control, medium and product

Abstract

The invention discloses a data query method, device and equipment based on authority control, a medium and a product. The method comprises the following steps: acquiring a natural language query text and a requester identifier; according to the natural language query text, based on pre-stored physical table structure information of at least one database table, generating an SQL data query statement; determining an operator role according to the request personnel identifier; obtaining a target execution statement of a target role dynamic view associated with the operator role from a role dynamic view mapping relation table according to the operator role; injecting the requester identifier as a permission parameter into the target execution statement to obtain the target execution statement after parameter injection so as to limit the data query permission range of the target operator; and calling a target execution statement used for executing a database user of the role dynamic view after the parameter is injected, and executing the SQL data query statement based on the target role dynamic view to obtain a statement query response result.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a data query method, apparatus, device, medium, and product based on access control. Background Technology

[0002] In the deepening stage of digital transformation in the financial industry, data has become a core production factor driving business decisions, optimizing customer service, and strengthening risk management. Financial institutions' daily operations heavily rely on data queries, from branch managers compiling statistics on customer asset size within their jurisdictions to compliance personnel verifying cross-branch business data; data queries permeate the entire financial business chain.

[0003] NL2SQL (Natural Language to SQL) technology, with its core advantage of automated natural language processing, breaks the dependence of traditional financial data queries on professional SQL (Structured Query Language) skills. It allows business personnel without technical backgrounds to directly initiate queries using natural language, significantly lowering the barrier to entry for financial data and improving business response efficiency.

[0004] However, after the large model returns the SQL query to the database, the program executes the SQL, but it cannot strictly control the data query results to match the queryer's permissions and roles. Existing technologies typically add query permissions to the SQL statement, replacing or modifying the original SQL statement generated by the large model. However, due to the complexity limitations of SQL statements in financial scenarios, it is impossible to accurately and efficiently add the permission component to the SQL statement. Furthermore, even if an SQL statement with permission restrictions is generated, directly executing that SQL for database queries can easily lead to data leaks, exhibiting deficiencies in data security, compliance, and reliability. Summary of the Invention

[0005] This invention provides a data query method, apparatus, device, medium, and product based on access control, to achieve role-based access control during the data query process, while also ensuring security, compliance, and reliability during the query process.

[0006] According to one aspect of the present invention, a data query method based on access control is provided, the method comprising:

[0007] In response to a data query request from a target operator, obtain the natural language query text and the requester's identifier;

[0008] Based on the natural language query text, and using the physical table structure information of at least one pre-stored database table, an SQL data query statement is generated.

[0009] The operator's role is determined based on the requester's identifier;

[0010] Based on the operator role, the target execution statement of the target role dynamic view associated with the operator role is obtained from the role dynamic view mapping table; the role dynamic view mapping table stores the mapping relationship between different operator roles and their corresponding role dynamic view execution statements;

[0011] The requester's identifier is injected as a permission parameter into the target execution statement to obtain the target execution statement after the parameter is injected, thereby restricting the data query permission range of the target operator;

[0012] The database user executing the target execution statement after injecting parameters is invoked to execute the dynamic view of the target role, and the SQL data query statement is executed based on the target dynamic view of the target role to obtain the statement query response result.

[0013] According to another aspect of the present invention, a data query device based on access control is provided, the device comprising:

[0014] The query text acquisition module is used to respond to data query requests from target operators and acquire natural language query text and requester identifiers.

[0015] The query statement generation module is used to generate an SQL data query statement based on the natural language query text and the physical table structure information of at least one pre-stored database table.

[0016] The role generation module is used to determine the operator's role based on the requester's identifier;

[0017] The dynamic view acquisition module is used to obtain the target execution statement of the target role dynamic view associated with the operator role from the role dynamic view mapping relationship table according to the operator role; the role dynamic view mapping relationship table stores the mapping relationship between different operator roles and their corresponding role dynamic view execution statements;

[0018] The permission parameter injection module is used to inject the requester's identifier as a permission parameter into the target execution statement to obtain the target execution statement after the injection parameter, so as to restrict the data query permission range of the target operator;

[0019] The query response module is used to call the database user to execute the target execution statement after injecting parameters for the target role dynamic view, and execute the SQL data query statement based on the target role dynamic view to obtain the statement query response result.

[0020] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0021] At least one processor; and

[0022] A memory communicatively connected to the at least one processor; wherein,

[0023] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the access control-based data query method according to any embodiment of the present invention.

[0024] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the access control-based data query method described in any embodiment of the present invention.

[0025] According to another aspect of the present invention, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the access control-based data query method described in any embodiment of the present invention.

[0026] This invention's technical solution generates an SQL data query statement based on the physical table structure information of at least one pre-stored database table from the natural language query text. The operator's role is determined based on the requester's identifier. According to the operator's role, the target execution statement of the target role dynamic view associated with the operator's role is obtained from the role dynamic view mapping table. The requester's identifier is injected as a permission parameter into the target execution statement, resulting in a parameter-injected target execution statement that restricts the target operator's data query permission range. The database user used to execute the role dynamic view executes the parameter-injected target execution statement, and the SQL data query statement is executed based on the target role dynamic view to obtain the query response result. This technical solution controls the operator's data viewing permissions through a role dynamic view, ensuring the scope control of the query results and implementing role-based permission control during the data query process. The created role dynamic view will only contain data within the role's permission range. Therefore, regardless of the generated SQL query statement, the statement response result will only return data within the operator's role's permission range, ensuring the data scope control issue of NL2SQL query data while also considering security, compliance, and reliability during the query process.

[0027] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart of a data query method based on access control according to Embodiment 1 of the present invention;

[0030] Figure 2A This is a flowchart illustrating the process of generating a dynamic view of an operator role according to Embodiment 2 of the present invention.

[0031] Figure 2B This is a flowchart illustrating a data query process based on access control according to Embodiment 2 of the present invention;

[0032] Figure 3 This is a schematic diagram of a data query device based on access control according to Embodiment 3 of the present invention;

[0033] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the data query method based on access control according to an embodiment of the present invention. Detailed Implementation

[0034] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0036] Example 1

[0037] Figure 1 This is a flowchart of a data query method based on access control provided in Embodiment 1 of the present invention. This embodiment can be applied to situations in financial scenarios where operators with different roles and permissions perform access data queries. The method can be executed by a data query device based on access control, which can be implemented in hardware and / or software and can be configured in an electronic device.

[0038] It's important to note that in data querying within financial scenarios based on NL2SQL technology, after the program executes the SQL query returned from the existing large model, it's impossible to control the query results and the queryer without modifying the original SQL. For example, it's impossible to strictly match the logged-in user's permissions and roles. Consider a securities company with over 100 branches. Each branch manager's access is limited to viewing only the customer details of their own branch; they cannot view customer data from other branches. Now, suppose the branch manager of branch 001 asks in natural language, "What are the customer details for my branch?" Under the current NL2SQL process, it cannot be guaranteed that the query results will only include customer data from branch 001. In other words, without modifying the original SQL statement generated by the large model—for example, by adding restrictions to the WHERE clause or modifying the query table by replacing the original query table with a subquery—it cannot be guaranteed that the query results will only include customer data from branch 001.

[0039] Furthermore, modifying the original SQL statement generated by the large model during multiple sessions can confuse the large model in the next round of SQL statement generation. It may mistakenly believe that the SQL statement modified by the user is the original SQL statement generated by the large model itself, thus causing unknown errors.

[0040] Therefore, the technical solution of this embodiment aims to allow users to define query permissions for each role using natural language. When a user inputs a natural language query, and the large model generates SQL based on the user's natural language question, the query results will strictly return only the data that the user has the permission to query, without modifying the original SQL generated by the large model. This embodiment provides a data query method based on permission control, such as... Figure 1 As shown, the method includes:

[0041] S110. In response to the data query request from the target operator, obtain the natural language query text and the requester's identifier.

[0042] S120. Based on the natural language query text and the physical table structure information of at least one pre-stored database table, generate an SQL data query statement.

[0043] S130. Determine the operator's role based on the requester's identifier.

[0044] S140. Based on the operator's role, retrieve the target execution statement of the target role dynamic view associated with the operator's role from the role dynamic view mapping table; the role dynamic view mapping table stores the mapping relationship between different operator roles and their corresponding role dynamic view execution statements.

[0045] S150. Inject the requester's identifier as a permission parameter into the target execution statement to obtain the target execution statement after the parameter is injected, so as to restrict the data query permission range of the target operator.

[0046] S160. Call the database user used to execute the dynamic view of the target role to execute the target execution statement after injecting the parameters, and execute the SQL data query statement based on the target role dynamic view to obtain the statement query response result.

[0047] The target operators can be individuals with data query needs. For example, in a financial scenario, the target operators could be branch managers and account managers. Data query requests can be initiated by the target operators through the client-side interface. The client-side interface can include input fields for different data formats, such as text or voice. Within these input fields, the target operators can input query information in natural language, i.e., natural language query text, according to their needs. For example, if the target operator is a branch manager, the natural language query text could be, "Please help me find out what my branch's customer details are."

[0048] The requester identifier is used to uniquely identify the operator. In a financial scenario, the operator could be an employee with different roles within the bank, such as an account manager or a branch manager. The requester identifier can be a personnel ID (identifier), for example, the target operator's requester identifier might be "001".

[0049] It should be noted that at least one database table can be defined in the pre-built database user BasicUser. Taking the financial scenario as an example, the database tables can be a customer information table (see Table 1), an operator permission table (see Table 2), a personnel information table (see Table 3), a personnel role table (see Table 4), and a personnel role association table (see Table 5).

[0050] Table 1

[0051] Customer Number Customer Name Business Department Number age other 01 Zhang San 00001 28 / 02 Li Si 00002 29 / … … … … …

[0052] Table 2

[0053] Operator identification Business Department Number Authorized customer number 001 00001 {01、02、…} 002 00001 {01、02、…} 003 00001 {02、03、…} … … …

[0054] Table 3

[0055] Operator identification Business Department Number 001 00001 002 00001 003 00001 … …

[0056] Table 4

[0057] Personnel Roles Character Description account Manager You can view the clients you have relationships with. Sales Manager You can view all customers in your branch. … …

[0058] Table 5

[0059] Operator identification Personnel Roles 001 account Manager 002 Sales Manager … …

[0060] Based on the natural language query text and the physical table structure information of at least one database table pre-stored in the database user BasicUser, an SQL data query statement is generated. The physical table structure information can include the table name, field names, and field descriptions. The table name indicates the data source, while the field names and descriptions clarify the relationships between data. Specifically, the natural language query text can be concatenated with the physical table structure information of each database table to obtain target prompts. These target prompts are then input into a pre-selected open-source intelligent question-answering model or information search engine to obtain the SQL data query statement output by the model or engine.

[0061] The aforementioned intelligent question-answering model or information search engine can determine the content to be searched by analyzing the natural language query text in the target prompt words. For example, if the natural language query text is "my branch customer details", then based on the physical table structure information of each data table, the branch number to which the target operator belongs can be found in the personnel information table based on the personnel request identifier of the target operator. Then, based on the branch number, customer information such as customer number in the customer information table can be associated to finally obtain the specific customer details information.

[0062] Based on the target operator's personnel identifier, information is retrieved from the personnel role association table to determine the target operator's role. For example, the operator role corresponding to the requesting personnel identifier 001 is Account Manager. Based on the operator role, the target execution statement of the target role dynamic view associated with the operator role is obtained from the role dynamic view mapping relationship table; the role dynamic view mapping relationship table stores the mapping relationship between different operator roles and their corresponding role dynamic view execution statements.

[0063] It should be noted that the role dynamic view serves as the foundational data for subsequent user query permissions, and the scope of user data query permissions is controlled by the role dynamic view. Different operator roles correspond to different execution statements for the role dynamic view, and these execution statements can be pre-built and stored. This embodiment also provides a method for generating execution statements for the role dynamic views of different operator roles.

[0064] In one optional embodiment, the character dynamic view mapping table is generated as follows:

[0065] Step a1: Obtain the operator role table, and based on the operator roles and their corresponding role descriptions in the operator role table, obtain the role-related data table corresponding to the corresponding operator role.

[0066] Step a2: Generate role permission description text, and based on the role permission description text and the physical table structure information of the role-related data table corresponding to the operator role, generate a view to generate natural language description text.

[0067] Step a3: Input the natural language description text generated by the view into the pre-selected natural language processing model to obtain the execution statement of the dynamic view of the corresponding operator role output by the model.

[0068] Step a4: Generate the mapping relationship between different operator roles and their corresponding role dynamic views execution statements, and store the mapping relationship in a pre-built role dynamic view mapping table.

[0069] Specifically, the obtained operator role table is used to retrieve table information, determine the role description information corresponding to different operator roles in the operator role table, and obtain role-related data tables corresponding to the corresponding operator roles based on the role description information, such as customer information table, operator permission table, and personnel role relationship table.

[0070] Generate role permission description text. This text can be a description of information used by relevant technical personnel, written in natural language, to restrict data access permissions for different operator roles. For example, the role permission description text could be "viewable customers related to oneself." Based on the role permission description text and the physical table structure information of the corresponding operator role's related data tables, generate a view and its natural language description text. This natural language description text can be a concatenation of the role permission description text and the physical table structure information of the role's related physical objects.

[0071] The view generates a natural language description text which is then input into a pre-selected natural language processing model. The model outputs the execution statements for the corresponding dynamic view of the operator role. The natural language processing model can be a pre-selected open-source intelligent question-answering model or an information search engine. The execution statements for the dynamic view are DDL (Data Definition Language) statements, specifically a subset of SQL used to define and manage database structures, and are used to create, modify, replace, and delete database objects, such as dynamic views.

[0072] The mapping relationship between different operator roles generated in the above manner and the execution statements of their corresponding role dynamic views is stored in a pre-built role dynamic view mapping table. The role dynamic view mapping table can be found in Table 6.

[0073] Table 6

[0074] Operator role Execution statements (DDL) for the character's dynamic view account Manager CREATE OR REPLACE VIEW ReadUser.CustomerInfo a select a.* fromBasicUser.CustomerInfo a join User_Customer_Relation b on a.custCode =b.custCode and b.userId = SYS_CONTEXT('APP_EMP_CONTEXT,''USER_ID') Sales Manager CREATE OR REPLACE VIEW ReadUser.CustomerInfo a select a.* fromBasicUser.CustomerInfo a join User_Info b on a.instCode = b.instCode andb.userId = SYS_CONTEXT('APP_EMP_CONTEXT,''USER_ID') …… ……

[0075] In an optional embodiment, after inputting the view-generated natural language description text into a pre-selected natural language processing model to obtain the execution statement of the role dynamic view corresponding to the corresponding operator role output by the model, the method further includes: creating a context namespace; the context namespace is used to dynamically store and pass the requester identifier corresponding to different operator roles; and embedding the context namespace into the execution statement of the role dynamic view corresponding to different operator roles as a dynamic parameter placeholder for permission filtering of the execution statement.

[0076] This involves creating a context namespace and embedding it into the execution statements of the role-based dynamic views corresponding to different operator roles. For example, the created context namespace could be "APP_EMP_CONTEXT", and the execution SQL statement for creating the context namespace would be "CREATE CONTEXT APP_EMP_CONTEXT USINGSYS.DBMS_SESSION".

[0077] It's important to note that the core function of the context namespace "APP_EMP_CONTEXT" is to dynamically store and transmit the requester identifier parameter during the generation of dynamic role views corresponding to different operator roles and subsequent user queries. It serves as the core carrier for adapting the same view to different operator permissions. When generating dynamic role views corresponding to operator roles, the context namespace APP_EMP_CONTEXT can be directly embedded into the execution statement DDL for generating dynamic role views based on the model, serving as a dynamic parameter placeholder for permission filtering. Using this placeholder during the definition of the dynamic role view, the requester identifier of the target logged-in operator can be dynamically read later, thereby restricting the target operator's access permissions.

[0078] After obtaining the target execution statement of the target role dynamic view associated with the operator's role, the requester's identifier is injected as a permission parameter into the target execution statement to obtain the target execution statement after the parameter injection, thereby restricting the target operator's data query permission scope. The database user ReadUser used to execute the role dynamic view is called to execute the target execution statement after the parameter injection, and an SQL data query statement is executed based on the target role dynamic view to obtain the query response result.

[0079] It should be noted that the database user BasicUser is only used to store physical data, i.e., several database tables. It is the core data storage user and does not directly provide query access to external users. The database user ReadUser is only used for data querying and does not store actual physical data (i.e., database tables). It only contains role-based dynamic views generated from the BasicUser database table. All generated SQL data query statements are executed through the ReadUser database user, thus achieving data access isolation.

[0080] Understandably, when executing the target execution statement DDL of the target role dynamic view, it's equivalent to creating a logical view under the ReadUser database user with the same name as the tables under the BasicUser database user. This logical view ensures that the results of subsequent SQL queries will never exceed the scope of authorized data. For example, in the financial customer service field, questions asked by either account managers or branch managers will be strictly limited to the data they have the right to view or access. There's no need to consider the flexibility of the SQL data query statements generated by the model, nor is there any need to intervene in the generated SQL data query statements. That is, there's no need to add or modify "where conditions" in the SQL data query statements using existing techniques, no need to replace the queried tables with temporary tables or other subqueries, and no need to make any changes to the SQL generated by the large model. Using logical views solves the access permission problem from the source and improves the query response results of SQL queries to a certain extent. This effectively avoids the problem of the large model being confused by human modification of the SQL generated by the large model in the multi-round question-and-answer mechanism, which could easily lead the large model to mistakenly believe that the manually modified SQL was generated by the large model itself, causing subsequent unknown errors.

[0081] It should be noted that in financial scenarios, since different user roles in different scenarios have different permissions, the scenario identifier of the current scenario can be combined during the generation of the dynamic role view to achieve dynamic generation of permissions for different scenarios and dynamic data access for different roles in different scenarios. For example, the scenario-based permission description relationship table for different operator roles with added scenario descriptions can be shown in Table 7.

[0082] Table 7

[0083] Scene identifier Scene Name Related roles Contextualized permission descriptions SC001 Daily Inquiry Sales Manager You can view the customer details of this branch. SC002 Report export Sales Manager The number of customers and total assets of this branch can be exported. SC003 Compliance Audit Sales Manager You can view the complete customer information of this branch. … … … …

[0084] Furthermore, to ensure the accuracy of the generated dynamic views of different operators, automated testing can be performed on the dynamic views after they are generated. In an optional embodiment, after generating the mapping relationship between the execution statements of different operator roles and their corresponding dynamic views, the method further includes:

[0085] Step b1: For any operator role, generate the tester identifier and view test SQL statement for that operator role, and determine the expected permission query result corresponding to the view test SQL statement.

[0086] Step b2: Inject the tester identifier as a permission parameter into the execution statement of the role dynamic view corresponding to the operator role, and call the database user used to execute the role dynamic view to execute the execution statement of the role dynamic view to obtain the test permission query result.

[0087] Step b3: Based on the expected permission query results and the test permission query results, test the execution statements of the dynamic view of the operator's role, generate the role view test results, and update the dynamic view based on the role view test results.

[0088] Specifically, for any operator role, generate an operator identifier and a view test SQL statement for that role. The view test SQL statement can be generated automatically or manually; for example, it could be something like "Query customer details belonging to this business department." The expected query result is the actual result corresponding to the view test SQL statement, accurately describing the real data that should be returned under the test SQL statement.

[0089] The tester identifier is injected as a permission parameter into the execution statement of the role dynamic view corresponding to the operator role, and the database user ReaderUser used to execute the role dynamic view is called to execute the execution statement of the role dynamic view, so as to obtain the test permission query result.

[0090] Comparing the expected permission query results with the test permission query results can be done by performing a similarity matching algorithm. If the similarity matching result is greater than a preset similarity threshold, the test result for the data query range of the operator's role view is considered passed, and the execution statement generation for the role's dynamic view is accurate. If the similarity matching result is not greater than the preset similarity threshold, the test result for the data query range of the operator's role view is considered failed, and the execution statement generation for the role's dynamic view is inaccurate. In this case, relevant technical personnel can intervene to re-generate the model or manually modify the execution statement for the role's dynamic view to ensure its accuracy. The similarity threshold can be preset by relevant technical personnel; for example, the similarity threshold can be set to 99%.

[0091] Furthermore, to ensure the accuracy of the dynamic view of operator roles, it can be updated periodically. However, periodic updates may result in operator permissions not changing by the update cycle, leading to decreased efficiency. Therefore, dynamic monitoring can be used to monitor role permissions and update the corresponding operator role's dynamic view only when permission updates are detected. The specific implementation can be as follows:

[0092] Monitor the operator permission tables in each database table, and when changes are detected in the table content, determine the personnel roles whose content has changed and need to be updated; based on the update role permission content corresponding to the personnel roles to be updated, update the execution statements of the dynamic view of the roles corresponding to the personnel roles to be updated.

[0093] Specifically, if a change in the data access permissions of any operator role in the operator permission table is detected, that operator role is identified as the role to be updated. Based on the updated role permissions corresponding to the role to be updated, the execution statement for the role dynamic view is regenerated. The specific generation method is the same as described above, and will not be repeated in this embodiment. The execution statement DDL of the regenerated role dynamic view is used to update the original execution statement DDL of the role dynamic view to be updated.

[0094] Furthermore, to ensure the accuracy of generated SQL data query statements in current scenarios, such as financial scenarios, a structured query language generation model for generating SQL data query statements can be pre-trained using sample data from this scenario. In an optional embodiment, based on the natural language query text and the physical table structure information of at least one pre-stored database table, an SQL data query statement is generated, including:

[0095] The natural language query text and the physical table structure information of at least one pre-stored database table are input into a pre-selected structured query language generation model to obtain the SQL data query statement output by the model. The structured query language generation model can be pre-trained by relevant technical personnel.

[0096] The training method for the structured query language generation model is as follows:

[0097] The process involves: acquiring historical query texts and physical table structure information of historical database targets over a given time period; using these as sample data and generating standard SQL query statements corresponding to the sample data as sample labels; inputting the sample data and their corresponding sample labels into a pre-selected network model to obtain the predicted SQL query statements output by the model; and training the network model based on the standard SQL query statements and predicted SQL query statements from the sample data until the preset model training termination conditions are met, thus obtaining a structured query language generation model.

[0098] The historical query text can be SQL query statements that have been queried during historical time periods, or SQL query statements manually generated by relevant technical personnel. The standard SQL query statement is the actual SQL statement corresponding to the historical query text, used to guide the network model's learning.

[0099] The sample data and its corresponding sample labels are input into the pre-selected network model to obtain the predicted SQL query statement output by the model; the current loss value is obtained based on the standard SQL query statement and the predicted SQL query statement of the sample data; the network model is trained based on the current loss value until the preset model training termination conditions are met, such as the current loss value reaching the set loss threshold, or the current loss value stabilizing, or the current iteration number reaching the set iteration number threshold, to obtain the structured query language generation model.

[0100] This invention's technical solution generates an SQL data query statement based on the physical table structure information of at least one pre-stored database table from the natural language query text. The operator's role is determined based on the requester's identifier. According to the operator's role, the target execution statement of the target role dynamic view associated with the operator's role is obtained from the role dynamic view mapping table. The requester's identifier is injected as a permission parameter into the target execution statement, resulting in a parameter-injected target execution statement that restricts the target operator's data query permission range. The database user used to execute the role dynamic view executes the parameter-injected target execution statement, and the SQL data query statement is executed based on the target role dynamic view to obtain the query response result. This technical solution controls the operator's data viewing permissions through a role dynamic view, ensuring the scope control of the query results and implementing role-based permission control during the data query process. The created role dynamic view will only contain data within the role's permission range. Therefore, regardless of the generated SQL query statement, the statement response result will only return data within the operator's role's permission range, ensuring the data scope control issue of NL2SQL query data while also considering security, compliance, and reliability during the query process.

[0101] Example 2

[0102] This embodiment provides a preferred example based on the above embodiments. It includes a process for generating a dynamic view of operator roles and a data query process based on access control.

[0103] like Figure 2A The diagram illustrates a process for generating a dynamic view of an operator role. The method includes the following steps:

[0104] S21. Create a context namespace; the context namespace is used to dynamically store and pass the requester identifier corresponding to different operator roles.

[0105] The context namespace to be created can be "APP_EMP_CONTEXT", and the SQL statement to create the context namespace is "CREATE CONTEXT APP_EMP_CONTEXT USING SYS.DBMS_SESSION".

[0106] In generating dynamic role views corresponding to different operator roles and subsequent user queries, the core function of the context namespace "APP_EMP_CONTEXT" is to dynamically store and pass the requester identifier parameter. It serves as the core carrier for adapting the same view to different operator permissions. When generating dynamic role views corresponding to operator roles, the context namespace APP_EMP_CONTEXT can be directly embedded into the execution statement DDL for generating dynamic role views based on the model, serving as a dynamic parameter placeholder for permission filtering. Using this placeholder during the definition of the dynamic role view, the requester identifier of the target logged-in operator can be dynamically read later, thereby restricting the target operator's access permissions.

[0107] S22. Obtain the operator role table, and based on the operator roles and their corresponding role descriptions in the operator role table, obtain the role-related data table corresponding to the corresponding operator role.

[0108] S23. Generate role permission description text, and generate a view to generate natural language description text based on the role permission description text and the physical table structure information of the role-related data table corresponding to the corresponding operator role.

[0109] The role permission description text can be "viewable customers related to oneself". Based on the role permission description text and the physical table structure information of the role-related data tables corresponding to the operator roles, a view is generated to produce a natural language description text. This natural language description text can be a concatenation of the role permission description text and the physical table structure information of the role-related physical objects.

[0110] S24. Input the natural language description text generated by the view into the pre-selected natural language processing model to obtain the execution statement of the dynamic view of the corresponding operator role output by the model.

[0111] The view generates a natural language description text, which is then input into a pre-selected natural language processing model. The model outputs the execution statements for the corresponding operator role's dynamic view. The natural language processing model can be a pre-selected open-source intelligent question-answering model or an information search engine. The execution statements for the dynamic view are DDL statements.

[0112] S25. Embed the context namespace into the execution statements of the role dynamic views corresponding to different operator roles, as placeholders for dynamic parameters of permission filtering in the execution statements.

[0113] For example, the execution statement for a character's dynamic view is as follows:

[0114] CREATE OR REPLACE VIEW ReadUser.CustomerInfo a select a.* fromBasicUser.CustomerInfo a join User_Customer_Relation b on a.custCode =b.custCode and b.userId = SYS_CONTEXT('APP_EMP_CONTEXT,''USER_ID').

[0115] Here, "APP_EMP_CONTEXT" is the context namespace, USER_ID is the unique identifier for the operator's role, "CustomerInfo" is the table name for the customer information table, "User_Customer_Relation" is the table name for the operator's permissions table, and "custCode" represents the customer number that the operator can view.

[0116] S26. Generate the mapping relationship between different operator roles and their corresponding role dynamic views, and store the mapping relationship in a pre-built role dynamic view mapping table.

[0117] like Figure 2B The diagram illustrates a data query process based on access control. The method includes the following steps:

[0118] S31. In response to the data query request initiated by the target operator based on the data query front-end page, obtain the natural language query text input by the target operator and the operator ID obtained by parsing the data query request.

[0119] S32. Input the natural language query text and the physical table structure information of at least one database table stored by the database user BasicUser into the pre-selected structured query language generation model to obtain the SQL data query statement output by the model.

[0120] S33. Retrieve the personnel role association table based on the operator ID to determine the operator role.

[0121] S34. Based on the operator's role, retrieve the target execution statement DDL of the target role dynamic view associated with the operator's role from the role dynamic view mapping table.

[0122] The Role Dynamic View Mapping Table stores the mapping relationship between different operator roles and their corresponding role dynamic views.

[0123] S35. Inject the requester's identifier as a permission parameter into the target execution statement to obtain the target execution statement DDL after the parameter is injected.

[0124] The target role dynamic view is used to restrict the scope of data query permissions for the target operator.

[0125] S36. Call the database user ReadUser used to execute the dynamic view of the role to execute the target execution statement after injecting parameters, and execute the SQL data query statement based on the target role dynamic view to obtain the statement query response result.

[0126] Example 3

[0127] Figure 3 This is a schematic diagram of a data query device based on access control provided in Embodiment 3 of the present invention. The data query device based on access control provided in this embodiment of the present invention is applicable to situations where operators with different roles and permissions in a financial setting perform access-based data queries. This data query device based on access control can be implemented in hardware and / or software, such as... Figure 3 As shown, the device includes: a query text acquisition module 301, a query statement generation module 302, a role generation module 303, a dynamic view acquisition module 304, a permission parameter injection module 305, and a query response module 306. Among them,

[0128] The query text acquisition module 301 is used to acquire natural language query text and requester identifier in response to data query requests from target operators;

[0129] The query statement generation module 302 is used to generate an SQL data query statement based on the natural language query text and the physical table structure information of at least one pre-stored database table.

[0130] The role generation module 303 is used to determine the operator role based on the requester identifier;

[0131] The dynamic view acquisition module 304 is used to obtain the target execution statement of the target role dynamic view associated with the operator role from the role dynamic view mapping relationship table according to the operator role; the role dynamic view mapping relationship table stores the mapping relationship between different operator roles and their corresponding role dynamic view execution statements;

[0132] The permission parameter injection module 305 is used to inject the requester's identifier as a permission parameter into the target execution statement to obtain the target execution statement after the injection parameter, so as to restrict the data query permission range of the target operator.

[0133] The query response module 306 is used to call the target execution statement after the database user executes the injected parameters for executing the dynamic view of the role, and executes the SQL data query statement based on the target dynamic view of the role to obtain the statement query response result.

[0134] This invention's technical solution generates an SQL data query statement based on the physical table structure information of at least one pre-stored database table from the natural language query text. The operator's role is determined based on the requester's identifier. According to the operator's role, the target execution statement of the target role dynamic view associated with the operator's role is obtained from the role dynamic view mapping table. The requester's identifier is injected as a permission parameter into the target execution statement, resulting in a parameter-injected target execution statement that restricts the target operator's data query permission range. The database user used to execute the role dynamic view executes the parameter-injected target execution statement, and the SQL data query statement is executed based on the target role dynamic view to obtain the query response result. This technical solution controls the operator's data viewing permissions through a role dynamic view, ensuring the scope control of the query results and implementing role-based permission control during the data query process. The created role dynamic view will only contain data within the role's permission range. Therefore, regardless of the generated SQL query statement, the statement response result will only return data within the operator's role's permission range, ensuring the data scope control issue of NL2SQL query data while also considering security, compliance, and reliability during the query process.

[0135] Optionally, the device further includes:

[0136] The role table acquisition module is used to acquire the operator role table and, based on the operator roles and their corresponding role descriptions in the operator role table, acquire the role-related data table corresponding to the corresponding operator role.

[0137] The view text generation module is used to generate role permission description text, and generate view generation natural language description text based on the role permission description text and the physical table structure information of the role-related data table corresponding to the corresponding operator role.

[0138] The execution statement generation module is used to input the view-generated natural language description text into a pre-selected natural language processing model to obtain the execution statement of the corresponding operator role's dynamic view output by the model.

[0139] The view mapping table construction module is used to generate the mapping relationship between different operator roles and their corresponding role dynamic views execution statements, and store the mapping relationship in a pre-built role dynamic view mapping table.

[0140] Optionally, the device further includes:

[0141] The namespace creation module is used to create a context namespace after the view-generated natural language description text is input into a pre-selected natural language processing model to obtain the execution statement of the corresponding operator role's dynamic view output by the model; the context namespace is used to dynamically store and transmit the requester identifier corresponding to different operator roles.

[0142] The parameter embedding module is used to embed the context namespace into the execution statements of the role dynamic views corresponding to different operator roles, so as to serve as dynamic parameter placeholders for permission filtering of the execution statements.

[0143] Optionally, the device further includes:

[0144] The data table monitoring module is used to monitor the table data of the operator permission table in each of the database tables, and when the table content changes, it determines the role of the personnel whose content has changed and needs to be updated.

[0145] The dynamic view update module is used to update the execution statements of the dynamic view of the role corresponding to the role to be updated, based on the update role permission content corresponding to the role to be updated.

[0146] Optionally, the query statement generation module 302 is specifically used for:

[0147] The natural language query text and the physical table structure information of at least one pre-stored database table are input into a pre-selected structured query language generation model to obtain the SQL data query statement output by the model.

[0148] The training method for the structured query language generation model is as follows:

[0149] Retrieve historical query text and physical table structure information of historical database targets within historical time periods;

[0150] The historical query text and the physical table structure information of the historical database target are used as sample data, and the standard SQL query statement corresponding to the sample data is generated as sample label.

[0151] The sample data and its corresponding sample labels are input into a pre-selected network model to obtain the predicted SQL query statement output by the model.

[0152] The network model is trained based on the standard SQL query statement and the predicted SQL query statement of the sample data until the preset model training termination condition is met, thus obtaining the structured query language generation model.

[0153] The data query device based on access control provided in the embodiments of the present invention can execute the data query method based on access control provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0154] Example 4

[0155] Figure 4 A schematic diagram of an electronic device 40 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0156] like Figure 4 As shown, the electronic device 40 includes at least one processor 41 and a memory, such as a read-only memory (ROM) 42 or a random access memory (RAM) 43, communicatively connected to the at least one processor 41. The memory stores computer programs executable by the at least one processor. The processor 41 can perform various appropriate actions and processes based on the computer program stored in the ROM 42 or loaded from storage unit 48 into the RAM 43. The RAM 43 may also store various programs and data required for the operation of the electronic device 40. The processor 41, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0157] Multiple components in electronic device 40 are connected to I / O interface 45, including: input unit 46, such as keyboard, mouse, etc.; output unit 47, such as various types of monitors, speakers, etc.; storage unit 48, such as disk, optical disk, etc.; and communication unit 49, such as network card, modem, wireless transceiver, etc. Communication unit 49 allows electronic device 40 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0158] Processor 41 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 41 performs the various methods and processes described above, such as access control-based data query methods.

[0159] In some embodiments, the access control-based data query method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 40 via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by processor 41, one or more steps of the access control-based data query method described above may be performed. Alternatively, in other embodiments, processor 41 may be configured to perform the access control-based data query method by any other suitable means (e.g., by means of firmware).

[0160] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0161] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0162] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0163] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0164] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0165] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0166] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and no limitation is imposed herein.

[0167] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data query method based on access control, characterized in that, include: In response to a data query request from a target operator, obtain the natural language query text and the requester's identifier; Based on the natural language query text, and using the physical table structure information of at least one pre-stored database table, an SQL data query statement is generated. The operator's role is determined based on the requester's identifier; Based on the operator role, the target execution statement of the target role dynamic view associated with the operator role is obtained from the role dynamic view mapping table; the role dynamic view mapping table stores the mapping relationship between different operator roles and their corresponding role dynamic view execution statements; The requester's identifier is injected as a permission parameter into the target execution statement to obtain the target execution statement after the parameter is injected, thereby restricting the data query permission range of the target operator; The database user executing the target execution statement after injecting parameters is invoked to execute the dynamic view of the target role, and the SQL data query statement is executed based on the target dynamic view of the target role to obtain the statement query response result.

2. The method according to claim 1, characterized in that, The generation method of the character dynamic view mapping table is as follows: Obtain the operator role table, and based on the operator roles and their corresponding role descriptions in the operator role table, obtain the role-related data table corresponding to the corresponding operator role; Generate role permission description text, and generate view to generate natural language description text based on the role permission description text and the physical table structure information of the role-related data table corresponding to the corresponding operator role; The view generates a natural language description text which is then input into a pre-selected natural language processing model to obtain the execution statement of the dynamic view of the corresponding operator role output by the model. Generate a mapping relationship between different operator roles and their corresponding role dynamic views' execution statements, and store the mapping relationship in a pre-built role dynamic view mapping table.

3. The method according to claim 2, characterized in that, After inputting the view-generated natural language description text into a pre-selected natural language processing model to obtain the execution statement of the corresponding operator role's dynamic view output by the model, the method further includes: Create a context namespace; the context namespace is used to dynamically store and transmit requester identifiers corresponding to different operator roles; The context namespace is embedded into the execution statements of the role dynamic views corresponding to different operator roles, serving as dynamic parameter placeholders for permission filtering of the execution statements.

4. The method according to claim 2, characterized in that, Following the mapping relationship between the execution statements that generate different operator roles and their corresponding dynamic role views, the following is also included: For any operator role, generate a tester identifier and view test SQL statement for that operator role, and determine the expected permission query result corresponding to the view test SQL statement; The tester identifier is injected as a permission parameter into the execution statement of the role dynamic view corresponding to the operator role, and the database user used to execute the role dynamic view is called to execute the execution statement of the role dynamic view to obtain the test permission query result. Based on the expected permission query results and the test permission query results, the execution statements of the dynamic view corresponding to the operator's role are tested, the role view test results are generated, and the dynamic view is updated based on the role view test results.

5. The method according to claim 1, characterized in that, The method further includes: Monitor the operator permission tables in each of the database tables, and when changes are detected in the table content, determine the roles of the personnel whose content has changed and need to be updated. Based on the update role permission content corresponding to the role to be updated, update the execution statement of the role dynamic view corresponding to the role to be updated.

6. The method according to claim 1, characterized in that, The step of generating an SQL data query statement based on the natural language query text and the physical table structure information of at least one pre-stored database table includes: The natural language query text and the physical table structure information of at least one pre-stored database table are input into a pre-selected structured query language generation model to obtain the SQL data query statement output by the model. The training method for the structured query language generation model is as follows: Retrieve historical query text and physical table structure information of historical database targets within historical time periods; The historical query text and the physical table structure information of the historical database target are used as sample data, and the standard SQL query statement corresponding to the sample data is generated as sample label. The sample data and its corresponding sample labels are input into a pre-selected network model to obtain the predicted SQL query statement output by the model. The network model is trained based on the standard SQL query statement and the predicted SQL query statement of the sample data until the preset model training termination condition is met, thus obtaining the structured query language generation model.

7. A data query device based on access control, characterized in that, include: The query text acquisition module is used to respond to data query requests from target operators and acquire natural language query text and requester identifiers. The query statement generation module is used to generate an SQL data query statement based on the natural language query text and the physical table structure information of at least one pre-stored database table. The role generation module is used to determine the operator's role based on the requester's identifier; The dynamic view acquisition module is used to obtain the target execution statement of the target role dynamic view associated with the operator role from the role dynamic view mapping relationship table according to the operator role; the role dynamic view mapping relationship table stores the mapping relationship between different operator roles and their corresponding role dynamic view execution statements; The permission parameter injection module is used to inject the requester's identifier as a permission parameter into the target execution statement to obtain the target execution statement after the injection parameter, so as to restrict the data query permission range of the target operator; The query response module is used to call the database user to execute the target execution statement after injecting parameters for the target role dynamic view, and execute the SQL data query statement based on the target role dynamic view to obtain the statement query response result.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the access control-based data query method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the access control-based data query method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the data query method based on access control according to any one of claims 1-6.

Images