Data access method and device, equipment and medium

Abstract

The embodiment of the invention discloses a data access method and device, equipment and a medium, and the method comprises the steps: querying a pre-established user attribute mapping table according to a target user identifier, and obtaining at least one user tag matched with the target user identifier; querying a pre-constructed data field mapping table, and obtaining at least one controlled permission dimension corresponding to the target data table and a target data table field corresponding to each controlled permission dimension; according to each permission strategy, the user tag, the controlled permission dimension and the target data table field, generating a permission filtering condition constructed by the target data table field and the user attribute value; according to the permission filtering conditions, the data query request of the target user is reconstructed, a reconstructed query request is obtained, and the query result matched with the reconstructed query request is fed back to the target user, the data access efficiency can be improved, and the data security can be guaranteed.

Description

Technical Field

[0001] This invention relates to the field of data security, and in particular to a data access method, apparatus, device, and medium. Background Technology

[0002] Data security is a crucial foundation for ensuring the stable operation of information systems and protecting user privacy. To prevent data leakage, tampering, or misuse, strict access control must be implemented. Only authenticated and authorized users or systems can access specific data based on their roles and responsibilities. Establishing a robust access control system can effectively reduce internal and external security risks and ensure the confidentiality, integrity, and availability of data.

[0003] However, in current technical solutions, users are often unaware of the specific data covered by their permissions. To ensure compliance, systems typically require users to submit a complete access request first, and then the permission mechanism determines whether access is allowed. However, if the request contains any content beyond the user's permissions, the system will directly reject the entire request. This forces users to repeatedly try and manually adjust the request content until it fully matches their permission scope. This method is inefficient and affects data access efficiency. Summary of the Invention

[0004] This invention provides a data access method, apparatus, device, and medium. Through the technical solutions of the embodiments of this invention, data access efficiency can be improved and data security can be guaranteed by automatically modifying the user's data query request and returning only the data within the user's permissions.

[0005] In a first aspect, embodiments of the present invention provide a data access method, including:

[0006] Obtain the target user's data query request, and extract the target user's target user identifier and the target data table to be queried from the data query request;

[0007] Based on the target user identifier, query the pre-established user attribute mapping table to obtain at least one user tag that matches the target user identifier. The user tag includes user attribute values ​​under the standard permission dimension.

[0008] Query the pre-built data field mapping table to obtain at least one controlled permission dimension corresponding to the target data table, and the target data table fields corresponding to each controlled permission dimension;

[0009] Based on each permission policy, user tag, controlled permission dimension, and target data table field, generate permission filtering conditions constructed from target data table fields and user attribute values;

[0010] Based on the aforementioned permission filtering conditions, the data query request of the target user is reconstructed to obtain a reconstructed query request, and the query results matching the reconstructed query request are fed back to the target user.

[0011] Secondly, embodiments of the present invention provide a data access device, including:

[0012] The acquisition module is used to acquire the data query request of the target user and extract the target user identifier and the target data table to be queried from the data query request.

[0013] The matching module is used to query a pre-established user attribute mapping table based on the target user identifier and obtain at least one user tag that matches the target user identifier. The user tag includes user attribute values ​​under the standard permission dimension.

[0014] The query module is used to query a pre-built data field mapping table, obtain at least one controlled permission dimension corresponding to the target data table, and the target data table fields corresponding to each controlled permission dimension.

[0015] The filtering module is used to generate permission filtering conditions based on various permission policies, user tags, controlled permission dimensions, and target data table fields, which are constructed from target data table fields and user attribute values.

[0016] The reconstruction module is used to reconstruct the data query request of the target user according to the aforementioned permission filtering conditions, obtain the reconstructed query request, and return the query results that match the reconstructed query request to the target user.

[0017] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising:

[0018] At least one processor; and,

[0019] A memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data access method described in any one of the embodiments of the present invention.

[0021] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer instructions that are used to cause a processor to execute and implement the data access method described in any one of the embodiments of the present invention.

[0022] The technical solution of this invention involves obtaining a target user's data query request and extracting the target user identifier and the target data table to be queried from the data query request; querying a pre-established user attribute mapping table based on the target user identifier to obtain at least one user tag matching the target user identifier, where the user tag includes user attribute values ​​under standard permission dimensions; querying a pre-constructed data field mapping table to obtain at least one controlled permission dimension corresponding to the target data table, and target data table fields corresponding to each controlled permission dimension; generating permission filtering conditions constructed from the target data table fields and user attribute values ​​based on each permission policy, user tag, controlled permission dimension, and target data table fields; reconstructing the target user's data query request based on each of the permission filtering conditions to obtain a reconstructed query request, and feeding back the query results matching the reconstructed query request to the target user. Specifically, the system obtains the corresponding user tag (including user attribute values ​​under standard permission dimensions) based on the user identifier, and obtains the corresponding controlled permission dimension and target data table fields based on the target data table. Based on this, and in conjunction with a preset permission policy, it adaptively generates permission filtering conditions constructed from the target data table fields and user attribute values. These permission filtering conditions are used to reconstruct the original data query request, forming a reconstructed query request. Finally, the system executes the reconstructed query request and returns the matching query results to the target user. The beneficial effects of this are: because the permission filtering conditions are generated in real-time based on user tags, controlled permission dimensions, etc., they can accurately match the user's actual permissions, thus ensuring that the data returned to the target user is limited to their authorized scope. This not only improves the efficiency of data access (avoiding the processing and transmission of invalid data), but more importantly, by embedding permission constraints at the query source, it effectively ensures data security and prevents unauthorized access. The entire process is completed adaptively, reducing the complexity of manual configuration. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 A flowchart of a data access method provided in Embodiment 1 of the present invention;

[0025] Figure 2 This is a flowchart of a data access method provided in Embodiment 2 of the present invention;

[0026] Figure 3This is a schematic diagram of the structure of a data access device provided in Embodiment 3 of the present invention;

[0027] Figure 4 This is a schematic diagram of the structure of the electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] It should be noted that the collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0031] Example 1

[0032] Figure 1 The flowchart illustrates a data access method provided in Embodiment 1 of the present invention. This method is specifically applicable to situations where users access restricted data. The method can be implemented using a data access device, which can be composed of software and / or hardware and configured in a computer or server.

[0033] like Figure 1 As shown, it includes:

[0034] Step 110: Obtain the target user's data query request, and extract the target user identifier and the target data table to be queried from the data query request.

[0035] The data query request from the target user represents the target user's access requirement for specific data. For example, the data query request includes a JavaScript object representation request body containing the target user identifier (e.g., user ID "U123"), the target data table (e.g., "sales_order"), and query conditions and scope, or a structured query language query statement in the form of "SELECT * FROM sales_order WHERE user_id=U123". The target user identifier is used to uniquely identify the target user, representing the target user's specific identity information in the system; for example, the target user identifier can be a numeric user ID, email address, or hash value. The target data table is the data table that the target user needs to access. The target data table categorizes or summarizes the data using table headers or data table fields; for example, the table headers or data table fields can be "Region", "Department", and "Position".

[0036] Step 120: Query the pre-established user attribute mapping table based on the target user identifier to obtain at least one user tag that matches the target user identifier. The user tag includes user attribute values ​​under the standard permission dimension.

[0037] The user attribute mapping table stores the correspondence between target user identifiers and multi-dimensional user attribute values. Standard permission dimensions define the user attribute classification framework, standardizing attribute categories in permission management; each user attribute value corresponds to a standard permission dimension. In the example above, the job title dimension, the region under management dimension, and the department dimension are the user's standard permission dimensions. As the benchmark for permission control, standard permission dimensions can be integrated with the field classifications of the target data table, enabling refined control of sensitive data.

[0038] Specifically, the user attribute values ​​corresponding to the target user identifier can be determined through a user attribute mapping table, and then at least one user tag can be generated based on the target user's standard permission dimensions and user attribute values. The user tag is the target user's user attribute value under the standard permission dimensions.

[0039] Optionally, step 120 includes:

[0040] Obtain a pre-constructed user attribute mapping table, wherein the user attribute mapping table records a first mapping relationship between each user attribute in the user information table and the matching standard permission dimension; according to the target user identifier, query the user information table to obtain the target user attribute value under each target user attribute that matches the target user identifier; according to the first mapping relationship, obtain the standard permission dimension corresponding to each target user attribute, and combine each standard permission dimension with the matching target user attribute value to obtain at least one user tag that matches the target user identifier.

[0041] Specifically, the target user attribute value can be determined in the user information table using the target user identifier. Then, based on the first mapping relationship, the standard permission dimension corresponding to the target user attribute value can be determined. Finally, each standard permission dimension and the target user attribute value are combined according to a preset tag format to obtain the user tag matching the target user identifier. For example, the user tag can be in the following form: {DIM_REGION: ["Beijing"], DIM_DEPT: ["Sales Department"]}, where DIM_REGION and DIM_DEPT are the standard permission dimensions, and Beijing and Sales Department are the corresponding target user attribute values.

[0042] For example, a user attribute mapping table can be in the following form:

[0043] DIM_REGION (Region of Responsibility) DIM_DEP (Department Dimension);

[0044] Beijing Sales Department;

[0045] Directors in Beijing, Tianjin, and Nanjing;

[0046] For example, a user information table can be in the following form:

[0047] ID name region department

[0048] 001 Zhang San, Beijing Sales Department;

[0049] 002 Li Si, Director of Beijing, Tianjin and Nanjing;

[0050] Specifically, the template user attribute values ​​of the target user can be determined from the user information table through user identifiers. For example, Zhang San's region is Beijing and his department is the sales department. Then, through the user attribute mapping table, it can be determined that the standard permission dimension corresponding to Beijing is the responsible region dimension, and the sales department is the department dimension.

[0051] This generates the user's tag {DIM_REGION: ["Beijing"], DIM_DEPT: ["Sales Department"]}.

[0052] Step 130: Query the pre-built data field mapping table to obtain at least one controlled permission dimension corresponding to the target data table, and the target data table fields corresponding to each controlled permission dimension.

[0053] The data field mapping table includes the controlled permission dimensions for each data table and the corresponding target data table fields for each controlled permission dimension. For example, the controlled permission dimension for data table A is the region dimension, and the controlled permission dimensions for data table B are the region dimension and the job dimension. It should be noted that for any given data table, there can be multiple controlled permission dimensions, and different controlled data in the data table can select any number of these dimensions for permission settings. For example, the controlled permission dimension for controlled data 'a' in data table B is the region dimension, and the controlled permission dimensions for controlled data 'b' are the region dimension and the job dimension. The data field mapping table also records the correspondence between at least one controlled permission dimension of each data table and the target data table fields.

[0054] For example, the controlled permission dimension of data table A is the geographic dimension, and the corresponding target data table fields are "Region," "Location," "Service Location," etc. It can be understood that controlled data can be subject to permission control from multiple dimensions, such as geographic dimension, job title dimension, and position dimension. Therefore, the dimension from which permissions are restricted for the controlled data in the target data table is the controlled permission dimension. Target data table fields are either the table headers of the target data table or fields used to classify the data in the target data table; different target data table fields can represent different data areas within the target data table.

[0055] For example, a data field mapping table can be in the following form:

[0056] Table Name | Table Fields | Controlled Permissions Dimensions

[0057] Region A, DIM_REGION (responsible for the region dimension);

[0058] Department B DIM_DEP (Department Dimension);

[0059] Step 140: Generate permission filtering conditions based on each permission policy, user tag, controlled permission dimension, and target data table fields, constructed from the target data table fields and user attribute values.

[0060] The permission policy refers to the preset permission conditions for the controlled data in the target data table, and it corresponds to the controlled permission dimension. For example, when the controlled permission dimension is the region dimension, the permission policy is a judgment condition related to the region dimension. By judging whether the target user's region dimension user attribute value meets the permission policy, it can be determined whether the target user can access the controlled data in the target data table. The permission filtering condition is used to determine the controlled data in the target data table that the target user can access. Specifically, if the target user's data query request is to access all data, but the target user's permissions are limited to only accessing part of the controlled data in the target data table, then the target user's data query request needs to be modified so that the database returns only the controlled data in the target data table that the target user can access based on the modified data query request. Therefore, the permission filtering condition is essentially a filter statement in the form of code, used to add to the target user's data query request, so that the target user is unaware of and does not need to manually modify the data query request to automatically return the controlled data in the target data table that the target user can access.

[0061] Optionally, before accessing the target data table, the method further includes: activating at least one permission policy of the target data table according to preset security requirements, and configuring it in the controlled data of the target data table.

[0062] Specifically, different target data tables have different permission requirements. Permissions for any target data table can be set from multiple different controlled permission dimensions. Based on the preset security requirements of different target data tables, any number of permission policies can be activated from all permission policies to restrict access to controlled data in the target data table. Therefore, if it is necessary to change the access restrictions of the target data table, only the number of activated permission policies or the content of the activated permission policies needs to be changed, improving the efficiency of permission modification.

[0063] Step 150: Based on the aforementioned permission filtering conditions, reconstruct the target user's data query request to obtain a reconstructed query request, and return the query results that match the reconstructed query request to the target user.

[0064] Specifically, the various permission filtering conditions are added to the query condition section of the target user's data query request to obtain a reconstructed query request. The query results matching the reconstructed query request (controlled data in the target data table accessible to the target user) are then fed back to the target user. For example, by executing the reconstructed query request, the controlled data in the target data table accessible to the target user can be determined.

[0065] This invention provides a data access method, comprising: acquiring a data query request from a target user, and extracting a target user identifier and a target data table to be queried from the data query request; querying a pre-established user attribute mapping table based on the target user identifier to obtain at least one user tag matching the target user identifier, wherein the user tag includes user attribute values ​​under standard permission dimensions; querying a pre-constructed data field mapping table to obtain at least one controlled permission dimension corresponding to the target data table, and target data table fields corresponding to each controlled permission dimension; generating permission filtering conditions constructed from the target data table fields and user attribute values ​​based on each permission policy, user tag, controlled permission dimension, and target data table fields; reconstructing the target user's data query request based on each of the permission filtering conditions to obtain a reconstructed query request, and feeding back the query results matching the reconstructed query request to the target user. The system obtains the corresponding user tag (including user attribute values ​​under standard permission dimensions) based on the user identifier, and obtains the corresponding controlled permission dimension and target data table fields based on the target data table. Based on this, and in conjunction with a preset permission policy, it adaptively generates permission filtering conditions constructed from the target data table fields and user attribute values. These permission filtering conditions are used to reconstruct the original data query request, forming a reconstructed query request. Finally, the system executes the reconstructed query request and returns the matching query results to the target user. The beneficial effects of this are: because the permission filtering conditions are generated in real-time based on user tags, controlled permission dimensions, etc., they can accurately match the user's actual permissions, thus ensuring that the data returned to the target user is limited to their authorized scope. This not only improves the efficiency of data access (avoiding the processing and transmission of invalid data), but more importantly, by embedding permission constraints at the query source, it effectively ensures data security and prevents unauthorized access. The entire process is completed adaptively, reducing the complexity of manual configuration.

[0066] Example 2

[0067] Figure 2 This is a flowchart of a data access method provided in Embodiment 2 of the present invention. This method further limits some steps of the above embodiments, such as... Figure 2 As shown, it includes:

[0068] Step 210: Obtain the target user's data query request, and extract the target user identifier and the target data table to be queried from the data query request.

[0069] Step 220: Query the pre-established user attribute mapping table based on the target user identifier to obtain at least one user tag that matches the target user identifier. The user tag includes user attribute values ​​under the standard permission dimension.

[0070] Step 230: Obtain a pre-built data field mapping table, wherein the data field mapping table records the mapping relationship between data table name, database fields and controlled permission dimensions.

[0071] Step 240: Filter the data field mapping table according to the data table name of the target data table to obtain at least one controlled permission dimension corresponding to the target data table, and the target data table field corresponding to each controlled permission dimension.

[0072] Specifically, by retrieving the target data table name from the data field mapping table, at least one controlled permission dimension corresponding to the target data table is determined, along with the target data table fields corresponding to each controlled permission dimension. The target user's user tag contains the target user's user attribute values, which correspond to standard permission dimensions. Controlled permission dimensions are the permission dimensions corresponding to controlled data in the target data table, and these dimensions are mapped to the target data table fields through the data field mapping table. Therefore, through the above steps, the mapping relationship between the target user's user attribute values ​​and the target data table fields is successfully established; that is, the target user's user attribute values ​​can be used to determine whether the target user has data access permissions to the target data table fields.

[0073] Optionally, the user attribute mapping table also records the number of attribute values ​​corresponding to each user attribute.

[0074] Accordingly, each standard permission dimension is combined with the target user attribute value to obtain at least one user tag that matches the target user identifier, which may include:

[0075] In each standard permission dimension, the current standard permission dimension is obtained sequentially, and the number of target attribute values ​​matching the current standard permission dimension is obtained. If the number of target attribute values ​​is a single value, the current standard permission dimension is combined with the unique target user attribute value to obtain a user tag matching the current target user identifier. If the number of target attribute values ​​is multiple, the multiple target user attribute values ​​corresponding to the current standard permission dimension are combined into an attribute value set, and then the current standard permission dimension is combined with the attribute value set to obtain a user tag matching the current target user identifier.

[0076] Among them, the target attribute value quantity information is the number of target user attribute values, that is, the total number of target user attribute values ​​that the target user has under a certain standard permission dimension.

[0077] Specifically, the number of target user attribute values ​​under a specific standard permission dimension can be one or more. For example, when the standard permission dimension is the responsible region dimension, the number of target attribute values ​​can be one, such as the target user attribute value being "Beijing"; or it can be multiple, such as the target user attribute value being "Beijing, Tianjin, and Hebei". Therefore, the user tag format can include various forms, such as {DIM_REGION: ["Beijing"]} and {DIM_REGION: ["Beijing", "Tianjin", "Hebei"]}. This method ensures that when a target user accesses data, all accessible data corresponding to the target user attribute values ​​can be fully obtained.

[0078] Step 250: Obtain the target permission dimension corresponding to each permission policy, and filter out the target user tags that match the standard permission dimension and the target permission dimension from each user tag.

[0079] Step 260: Match the standard permission dimensions in each target user tag with each controlled permission dimension, and obtain the target data table fields corresponding to each target user tag based on the matching results.

[0080] Specifically, there is a clear correlation between permission policies and their corresponding target permission dimensions. For example, when a permission policy is set to "regional conditions" (i.e., requiring target users to meet specific regional requirements to access controlled data in a target data table), the associated target permission dimension is either the "regional dimension" or the "responsible region dimension." Therefore, to determine whether a target user has the permission to access controlled data in a target data table, the key is to determine whether the target user's attribute values ​​meet the requirements of the permission policy. Since user tags store standard permission dimensions and their corresponding target user attribute values, the following operations are performed: First, among each user tag, target user tags whose standard permission dimensions match the target permission dimension corresponding to the currently processed permission policy are selected. Second, for each target user tag, the standard permission dimensions contained in the target user tag are matched with the controlled permission dimensions. Based on the matching results, the target data table fields that the target user associated with the target user tag can access are finally determined.

[0081] For example, for a permission policy of "regional conditions", which belongs to the "regional dimension" (standard permission dimension), the system filters out target user tags that contain the "regional dimension" and whose target user attribute values ​​meet the requirements from the target user tags, and then determines the target data table fields that the target user can access under the "regional dimension".

[0082] Step 270: Based on the user attribute values ​​in each target user tag and the target data table fields corresponding to each target user tag, construct at least one permission filtering condition.

[0083] Step 280: Based on the aforementioned permission filtering conditions, reconstruct the target user's data query request to obtain a reconstructed query request, and return the query results matching the reconstructed query request to the target user.

[0084] Specifically, permission filtering conditions are used to modify the data query requests of target users. Essentially, this involves adjusting the query scope of the target data table, and therefore must be generated based on the target data table fields and user attribute values. Permission filtering conditions are essentially statements that conform to the data query request format requirements (such as Structured Query Language statements). After reconstructing the data query request based on each permission filtering condition, executing the reconstructed query request can return query results accessible to the target user and provide feedback to the target user.

[0085] Optionally, the query condition segment is located in the target user's data query request, and each of the permission filtering conditions is added to the query condition segment according to the standardized query condition combination logic to obtain the reconstructed query request.

[0086] Among them, the query condition combination logic is a language logic that conforms to the relevant format and combination requirements of the query conditions in the data query request. For example, "or" and "and" are used to connect the various permission filtering conditions to represent the query range formed by the combination of different permission filtering conditions.

[0087] Specifically, the data query request contains a query condition section. Therefore, according to the code format requirements of the data query request, the combined permission filtering conditions can be added to the query condition section to obtain a reconstructed query request.

[0088] For example, a user's data query statement is:

[0089] SELECT region, product_line, SUM(amount) as total_sales

[0090] FROM sales_data

[0091] WHERE sale_date >= '2024-01-01'

[0092] GROUP BY region, product_line;

[0093] In other words, the user's initial query was to calculate the total sales for each region and product line as of January 1, 2024, and beyond. In actual business operations, users can only view data within their authorized regions (e.g., personnel with "Beijing" privileges can only view data for Beijing, and personnel in the "East China" region can only view data for Shanghai / Jiangsu / Zhejiang, etc.). The system automatically adds a `region IN (...)` condition to the `WHERE` clause when the user executes the query, achieving "data access control." The system detected that the user could only access the "Beijing" region, therefore automatically adding `region IN ('Beijing')` to the original query.

[0094] Refactor the query statement:

[0095] SELECT region, product_line, SUM(amount) as total_sales

[0096] FROM sales_data

[0097] WHERE sale_date >= '2024-01-01'

[0098] AND region IN ('Beijing')

[0099] GROUP BY region, product_line.

[0100] Specifically, the system automatically identifies the user's permission scope and dynamically adds the regionIN (...) condition to the WHERE clause of the query, which not only meets the business requirement of "statistical sales by date + region + product line", but also achieves the security control that "users can only see data within their own permissions".

[0101] To facilitate understanding, the following provides a practical example of a data access method:

[0102] User Zhang San enters his username and password on the login page. After successful verification, the system obtains his user ID as "001". The system then queries the user information table based on the user ID, retrieving Zhang San's user attribute records as "region=Beijing" and "department=Sales Department". Based on the user attribute mapping table and user attributes, the system generates a user tag set {DIM_REGION: ["Beijing"], DIM_DEPT: ["Sales Department"]}. When Zhang San initiates a request to query sales data:

[0103] Original SQL: SELECT * FROM sales_data WHERE sale_date > '2024-01-01');

[0104] System analysis revealed the involvement of the `sales_data` table. Further querying of the data field mapping table confirmed that the `region` field in this table is associated with `DIM_REGION`, and the `product_line` field is associated with `DIM_DEPT`, determining that the controlled permission dimension is `DIM_REGION`. The permission decision engine, combining the user tag `{DIM_REGION: ["Beijing"]}` and the data mapping (`region→DIM_REGION`), generates the filter condition `"region IN ('Beijing')``, rewriting the original SQL as follows:

[0105] The query "SELECT * FROM sales_data WHERE sale_date > '2024-01-01' AND regionIN ('Beijing')" returns only sales data with the region "Beijing", ensuring that Zhang San only has access to data within his access permissions.

[0106] This invention provides a data access method that, by extracting the target user identifier and the target data table to be queried, matching user tags, associating controlled permission dimensions, and corresponding target data table fields, can generate permission filtering conditions with user attribute values. The query request is then reconstructed based on the permission filtering conditions, and the query results are returned. This ensures that users only have access to data within their permissions without interfering with the query logic, achieving a balance between data security and business efficiency.

[0107] Example 3

[0108] Figure 3 This is a schematic diagram of a data access device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes:

[0109] The acquisition module 310 is used to acquire the data query request of the target user and extract the target user identifier and the target data table to be queried from the data query request.

[0110] The matching module 320 is used to query a pre-established user attribute mapping table based on the target user identifier and obtain at least one user tag that matches the target user identifier. The user tag includes user attribute values ​​under the standard permission dimension.

[0111] The query module 330 is used to query a pre-built data field mapping table, obtain at least one controlled permission dimension corresponding to the target data table, and the target data table fields corresponding to each controlled permission dimension.

[0112] The filtering module 340 is used to generate permission filtering conditions constructed from target data table fields and user attribute values ​​based on various permission policies, user tags, controlled permission dimensions and target data table fields.

[0113] The reconstruction module 350 is used to reconstruct the data query request of the target user according to the permission filtering conditions, obtain the reconstructed query request, and feed back the query results that match the reconstructed query request to the target user.

[0114] This invention provides a data access device that: acquires a data query request from a target user, and extracts a target user identifier and a target data table to be queried from the data query request; queries a pre-established user attribute mapping table based on the target user identifier to obtain at least one user tag matching the target user identifier, wherein the user tag includes user attribute values ​​under standard permission dimensions; queries a pre-constructed data field mapping table to obtain at least one controlled permission dimension corresponding to the target data table, and target data table fields corresponding to each controlled permission dimension; generates permission filtering conditions constructed from the target data table fields and user attribute values ​​based on each permission policy, user tag, controlled permission dimension, and target data table fields; reconstructs the target user's data query request based on each permission filtering condition to obtain a reconstructed query request, and feeds back the query results matching the reconstructed query request to the target user. Specifically, permission filtering conditions constructed from the target data table fields and user attribute values ​​can be generated based on each permission policy, user tag, controlled permission dimension, and target data table fields; the data query request of the target user can be reconstructed based on each permission filtering condition to obtain a reconstructed query request, and the query results matching the reconstructed query request can be fed back to the target user. Therefore, the method of this invention can adaptively generate permission filtering conditions that represent user permissions, and then generate a reconstructed query request based on the permission filtering conditions. This can achieve the goal of automatically modifying the user's data query request and returning only the data within the user's permissions, thereby improving data access efficiency and ensuring data security.

[0115] Based on the above embodiments, the matching module 320 may include:

[0116] The acquisition unit is used to acquire a pre-built user attribute mapping table, wherein the user attribute mapping table records the first mapping relationship between each user attribute in the user information table and the matching standard permission dimension;

[0117] The query unit is used to query the user information table based on the target user identifier and obtain the target user attribute values ​​under each target user attribute that matches the target user identifier;

[0118] The matching unit is used to obtain the standard permission dimensions corresponding to each target user attribute according to the first mapping relationship, and combine each standard permission dimension with the matched target user attribute value to obtain at least one user tag that matches the target user identifier.

[0119] Optionally, the matching unit may include:

[0120] The sub-unit is used to sequentially retrieve the current standard permission dimension from each standard permission dimension, and to retrieve the number of target attribute values ​​that match the current standard permission dimension.

[0121] The first judgment subunit is used to combine the current standard permission dimension with the unique target user attribute value if the target attribute value quantity information is a single value, to obtain a user tag that matches the current target user identifier.

[0122] The second judgment subunit is used to, if the number of target attribute values ​​is multiple, combine the multiple target user attribute values ​​corresponding to the current standard permission dimension into an attribute value set, and then combine the current standard permission dimension and the attribute value set a second time to obtain a user tag that matches the current target user identifier.

[0123] Optionally, the query module 330 may include:

[0124] The acquisition unit is used to acquire a pre-built data field mapping table, wherein the data field mapping table records the mapping relationship between data table name, database field and controlled permission dimension;

[0125] The query unit is used to filter the data field mapping table according to the data table name of the target data table to obtain at least one controlled permission dimension corresponding to the target data table, and the target data table field corresponding to each controlled permission dimension.

[0126] Optionally, the filter module 340 may include:

[0127] The acquisition unit is used to acquire the target permission dimension corresponding to each permission policy, and to filter out the target user tags that match the standard permission dimension and the target permission dimension from each user tag;

[0128] The matching unit is used to match the standard permission dimensions in each target user tag with each controlled permission dimension, and to obtain the target data table fields corresponding to each target user tag based on the matching results.

[0129] The generation unit is used to construct at least one permission filtering condition based on the user attribute values ​​in each target user tag and the target data table fields corresponding to each target user tag.

[0130] Optionally, the reconstruction module 350 can be specifically used to: locate the query condition segment in the target user's data query request, and add each of the permission filtering conditions to the query condition segment according to the standardized query condition combination logic, so as to obtain the reconstructed query request.

[0131] Optionally, the device may further include a configuration module, configured to activate at least one permission policy of the target data table according to preset security requirements before accessing the target data table, and configure it in the controlled data of the target data table.

[0132] The data access device provided in the embodiments of the present invention can execute the data access method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0133] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0134] The system retrieves corresponding user tags (including user attribute values ​​under standard permission dimensions) based on the user identifier, and obtains the corresponding controlled permission dimensions and target data table fields based on the target data table. Based on this, and combined with preset permission policies, it adaptively generates permission filtering conditions constructed from target data table fields and user attribute values. These permission filtering conditions are used to reconstruct the original data query request, forming a reconstructed query request. Finally, the system executes the reconstructed query request and returns the matching query results to the target user. The beneficial effects of this are: because the permission filtering conditions are generated in real-time based on user tags, controlled permission dimensions, etc., they can accurately match the user's actual permissions, thus ensuring that the data returned to the target user is limited to their authorized scope. This not only improves the efficiency of data access (avoiding the processing and transmission of invalid data), but more importantly, by embedding permission constraints at the query source, it effectively ensures data security and prevents unauthorized access. The entire process is completed adaptively, reducing the complexity of manual configuration.

[0135] Example 4

[0136] Figure 4A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0137] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0138] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0139] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as data access methods.

[0140] In some embodiments, the data access method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the data access method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the data access method by any other suitable means (e.g., by means of firmware).

[0141] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0142] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0143] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0144] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0145] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0146] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0147] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0148] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data access method, characterized in that, include: Obtain the target user's data query request, and extract the target user's target user identifier and the target data table to be queried from the data query request; Based on the target user identifier, query the pre-established user attribute mapping table to obtain at least one user tag that matches the target user identifier. The user tag includes user attribute values ​​under the standard permission dimension. Query the pre-built data field mapping table to obtain at least one controlled permission dimension corresponding to the target data table, and the target data table fields corresponding to each controlled permission dimension; Based on each permission policy, user tag, controlled permission dimension, and target data table field, generate permission filtering conditions constructed from target data table fields and user attribute values; Based on the aforementioned permission filtering conditions, the data query request of the target user is reconstructed to obtain a reconstructed query request, and the query results matching the reconstructed query request are fed back to the target user.

2. The method according to claim 1, characterized in that, Based on the target user identifier, query a pre-built user attribute mapping table to obtain at least one user tag that matches the target user identifier, including: Obtain a pre-built user attribute mapping table, wherein the user attribute mapping table records the first mapping relationship between each user attribute in the user information table and the matching standard permission dimension; Based on the target user identifier, query the user information table to obtain the target user attribute values ​​under each target user attribute that matches the target user identifier; Based on the first mapping relationship, the standard permission dimensions corresponding to each target user attribute are obtained, and each standard permission dimension is combined with the matched target user attribute value to obtain at least one user tag that matches the target user identifier.

3. The method according to claim 2, characterized in that, The user attribute mapping table also records the number of attribute values ​​corresponding to each user attribute; Accordingly, each standard permission dimension is combined with the target user attribute value to obtain at least one user tag that matches the target user identifier, including: In each standard permission dimension, the current standard permission dimension is retrieved sequentially, and the number of target attribute values ​​matching the current standard permission dimension is obtained. If the target attribute value quantity information is a single value, then the current standard permission dimension is combined with the unique target user attribute value to obtain a user tag that matches the current target user identifier; If there are multiple target attribute values, then the multiple target user attribute values ​​corresponding to the current standard permission dimension are combined into an attribute value set, and then the current standard permission dimension and the attribute value set are combined a second time to obtain a user tag that matches the current target user identifier.

4. The method according to claim 1, characterized in that, Query the pre-built data field mapping table to obtain at least one controlled permission dimension corresponding to the target data table, and the target data table fields corresponding to each controlled permission dimension, including: Obtain a pre-built data field mapping table, wherein the data field mapping table records the mapping relationship between data table name, database field and controlled permission dimension; Based on the data table name of the target data table, filter the data field mapping table to obtain at least one controlled permission dimension corresponding to the target data table, and the target data table field corresponding to each controlled permission dimension.

5. The method according to any one of claims 1-4, characterized in that, Based on each permission policy, user tags, controlled permission dimensions, and target data table fields, generate permission filtering conditions constructed from target data table fields and user attribute values, including: Obtain the target permission dimension corresponding to each permission policy, and filter out the target user tags that match the standard permission dimension and the target permission dimension from each user tag; Match the standard permission dimensions in each target user tag with each controlled permission dimension, and obtain the target data table fields corresponding to each target user tag based on the matching results; Based on the user attribute values ​​in each target user tag and the target data table fields corresponding to each target user tag, at least one permission filtering condition is constructed.

6. The solution according to any one of claims 1-4, characterized in that, Based on the aforementioned permission filtering conditions, the target user's data query request is reconstructed to obtain a reconstructed query request, including: Locate the query condition segment in the target user's data query request, and add each of the aforementioned permission filtering conditions to the query condition segment according to the standardized query condition combination logic to obtain the reconstructed query request.

7. The method according to claim 1, characterized in that, Before accessing the target data table, the process also includes: activating at least one permission policy for the target data table according to preset security requirements, and configuring controlled data in the target data table.

8. A data access device, characterized in that, include: The acquisition module is used to acquire the data query request of the target user and extract the target user identifier and the target data table to be queried from the data query request. The matching module is used to query a pre-established user attribute mapping table based on the target user identifier and obtain at least one user tag that matches the target user identifier. The user tag includes user attribute values ​​under the standard permission dimension. The query module is used to query a pre-built data field mapping table, obtain at least one controlled permission dimension corresponding to the target data table, and the target data table fields corresponding to each controlled permission dimension. The filtering module is used to generate permission filtering conditions based on various permission policies, user tags, controlled permission dimensions, and target data table fields, which are constructed from target data table fields and user attribute values. The reconstruction module is used to reconstruct the data query request of the target user according to the aforementioned permission filtering conditions, obtain the reconstructed query request, and return the query results that match the reconstructed query request to the target user.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data access method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the data access method according to any one of claims 1-7.

Images