A data processing method and device, computer equipment and storage medium

Abstract

The present disclosure provides a data processing method and device, computer equipment and storage medium, and relates to the technical field of data security. The method uniformly describes the registered data processing tool through the tool description object, generates a task execution plan containing a tool node based on a data processing request, and performs pre-validation using desensitized mirror data before actual execution, which can identify problems such as tool capability mismatch, access range overreach or missing governance rules in advance. Meanwhile, the present disclosure establishes a controlled execution domain according to the tool form, limits the access ability of the data processing tool to the target data resource within the controlled execution domain, and links the governance processing, risk monitoring and risk control processing in the execution process, thereby improving the access controllability, security and traceability in the execution process of the heterogeneous data processing tool.

Description

Technical Field

[0001] This disclosure relates to the field of data security technology, and more specifically, to a data processing method, apparatus, computer equipment, and storage medium. Background Technology

[0002] With the development of data analytics, artificial intelligence, and automated process technologies, data users typically need to utilize various data processing tools, such as database query tools, API call tools, web-based tools, scripting tools, workflow processing components, or graphical interface tools, to query, statistically analyze, transform, or visualize target data resources. In existing methods, to enable data processing tools to complete their tasks, it is usually necessary to provide the tool's runtime environment with a copy of the data, database account, API key, or target system access address. This makes it difficult for data providers to continuously control the actual access scope, data retention behavior, and subsequent usage behavior of the tools.

[0003] In related technologies, methods such as interface gateways, remote desktops, sandbox execution, or data anonymization can improve the security of data access to a certain extent. However, in practical applications, the form and execution method of data processing tools are quite complex. Different tools may participate in the data processing process through web pages, interfaces, scripts, process components, or graphical interfaces. Due to the differences in access paths, running states, and interaction methods involved in different tools, when a data processing task involves multiple tools working together, the data provider may still find it difficult to accurately grasp the actual access scope, execution process, and subsequent access situation after changes in authorization status of each tool, thus affecting the security control and traceability of the data processing process. Summary of the Invention

[0004] This disclosure provides at least one data processing method, apparatus, computer device, and storage medium.

[0005] In a first aspect, embodiments of this disclosure provide a data processing method, including:

[0006] In response to receiving a data processing request, a task execution plan is generated based on the task information carried in the data processing request and at least one tool description object; wherein, the tool description object is used to describe the registered data processing tool and includes tool identifier, capability constraint information, protocol adaptation information and risk control information; the task execution plan includes at least one tool node, and the tool node is associated with a corresponding data processing tool, input parameters, required authorization information and governance rule reference information; For any tool node, in an isolated pre-verification environment, the tool node is simulated and executed based on the de-identified mirror data. The tool capabilities, access scope, and governance rule coverage status of the tool node are verified according to the tool description object corresponding to the tool node, the required authorization information, and the governance rule reference information. If the task execution plan passes verification, a controlled execution domain is established based on the protocol adaptation information, matching the tool form of the data processing tool. The controlled execution domain is used to carry or proxy the data processing tool's access to the target data resource, and to restrict the data processing tool's access to the target data resource to the controlled execution domain. Each tool node is executed according to the node dependencies determined by the task execution plan. During the execution of the tool nodes, data access requests or return results are governed based on the governance rule reference information, and the access requests, execution behavior or return results of the data processing tools are monitored for risks. Upon detecting risky behavior, based on the risk type corresponding to the risky behavior and the risk control information, at least one of the following risk control actions is performed on the data processing tool, the controlled execution domain, or the temporary resources associated with the tool node: access restriction, session interruption, access capability reclamation, temporary resource cleanup, or audit log.

[0007] In one optional implementation, the capability constraint information includes a capability fingerprint and an operation set. The capability fingerprint is used to characterize the system call, network request, or file access characteristics of the data processing tool when it is running in a secure environment. The operation set is used to limit the types of operations that the data processing tool is allowed to perform. The protocol adaptation information is used to indicate the controlled execution mode applicable to the data processing tool, and the controlled execution mode includes at least one of the following: database query protocol, interface call protocol, file access protocol, process processing protocol, or remote graphical session protocol.

[0008] In one optional implementation, the step of simulating execution of the tool node based on anonymized mirror data in an isolated pre-verification environment, and verifying the tool node's tool capabilities, access scope, and governance rule coverage status according to the tool description object corresponding to the tool node, the required authorization information, and the governance rule reference information, includes: Mirror data is generated based on the data structure of the target data resource, and the mirror data is then de-identified. In the isolated pre-verification environment, the corresponding data processing tool is invoked using the de-identified mirror data and the input parameters associated with the tool node; The actual invocation behavior of the tool node is compared with the capability constraint information in the tool description object. Based on the required authorization information, it is determined whether the data access scope of the tool node exceeds the authority. Based on the governance rule reference information, it is determined whether the data access path corresponding to the tool node is configured with governance rules.

[0009] In one optional implementation, the controlled execution domain includes a proxy execution domain; the execution of each tool node according to the node dependencies determined by the task execution plan includes: When the data processing tool corresponding to the tool node is a web-based tool or an interface-based tool, a proxy access task corresponding to the data processing tool is generated based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. Based on the proxy access task, a mapping relationship between the user session and the target data resource side session is established in the proxy execution domain, and a controlled access address is assigned to the data processing tool; The proxy execution domain receives page requests, interface requests, or form submission requests initiated by the data processing tool based on the controlled access address. The page request, interface request, or form submission request is rewritten, encapsulated, or forwarded, and during the forwarding process, the tool-side identity token is replaced or converted into the target data resource-side access credentials to access the target data resource; The system receives the response data returned by the target data resource, processes the response data based on the governance rule reference information, and then returns the processed response data to the data processing tool or the next tool node in the task execution plan.

[0010] In one optional implementation, the controlled execution domain includes a remote graphics execution domain; the execution of each tool node according to the node dependencies determined by the task execution plan includes: When the data processing tool corresponding to the tool node is a graphical tool, a remote graphical execution task corresponding to the data processing tool is generated based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. Based on the remote graphics execution task, an isolated remote graphics session is created in the remote graphics execution domain, and the remote graphics session is bound to at least one of the following: an authorized object, a target data resource, a session state, or a validity period. Assign temporary access credentials or temporary access tokens to the remote graphics session, enabling the graphics tools to access the target data resource within the remote graphics execution domain; The graphical interaction stream of the remote graphical session is provided to the user terminal so that the user terminal can operate the graphical tools through the graphical interaction stream; During the execution of the graphical tool, at least one of the following is collected from the remote graphical session: keyboard and mouse operations, page jumps, export operations, download requests, or session activity time. The collected results are then compared with the behavioral baseline corresponding to the graphical tool. Based on the comparison results, it is determined whether there is any risky behavior, and the execution results generated by the graphical tool are returned to the next tool node in the task execution plan or output as data processing results.

[0011] In one optional implementation, the governance processing of data access requests or return results based on the governance rule reference information, and the risk monitoring of access requests, execution behaviors, or return results of the data processing tool, include: Based on the governance rules corresponding to the governance rule reference information, at least one of the following is performed on the data access request or return result: authorization condition injection, row-level filtering, field desensitization, aggregation granularity restriction, query frequency restriction, or result perturbation processing; The data access requests initiated by the data processing tool are subjected to syntax parsing, request frequency statistics, access path identification, or sensitivity detection of return results to determine whether there is at least one risky behavior among unauthorized access, abnormal export, abnormal download, abnormal redirection, or over-frequency access.

[0012] In one optional implementation, the risk management information includes a recovery strategy; risk management processing is performed based on the risk type corresponding to the risky behavior and the risk management information, including: In the event of authorization failure, authorization revocation, unauthorized access, or execution anomaly, at least one of the following actions shall be performed according to the reclaiming policy: session closure, token expiration, credential expiration, channel release, temporary file cleanup, or temporary task cancellation. Record at least one of the following: tool identifier of the data processing tool, authorized object, target data resource, task execution plan summary, governance rule version, request summary, response summary, risk behavior information or risk control result, and generate an audit record associated with the task execution plan.

[0013] Secondly, embodiments of this disclosure also provide a data processing apparatus, comprising: A generation module is used to respond to a received data processing request and generate a task execution plan based on the task information carried in the data processing request and at least one tool description object; wherein, the tool description object is used to describe the registered data processing tool and includes tool identifier, capability constraint information, protocol adaptation information, and risk control information; the task execution plan includes at least one tool node, and the tool node is associated with a corresponding data processing tool, input parameters, required authorization information, and governance rule reference information; The simulation module is used to simulate the execution of any tool node in an isolated pre-verification environment based on anonymized mirror data, and to verify the tool capabilities, access scope, and governance rule coverage status of the tool node according to the tool description object corresponding to the tool node, the required authorization information, and the governance rule reference information. A module is established to create a controlled execution domain that matches the tool form of the data processing tool, based on the protocol adaptation information, when the task execution plan passes verification. The controlled execution domain is used to carry or proxy the data processing tool's access to the target data resource and restrict the data processing tool's access to the target data resource to the controlled execution domain. The execution module is used to execute each tool node according to the node dependency relationship determined by the task execution plan, and to perform governance processing on data access requests or return results based on the governance rule reference information during the execution of the tool nodes, as well as to perform risk monitoring on the access requests, execution behavior or return results of the data processing tools; The control module is used to, upon detecting a risky behavior, perform at least one of the following risk control actions on the data processing tool, the controlled execution domain, or temporary resources associated with the tool node: access restriction, session interruption, access capability reclamation, temporary resource cleanup, or audit logs, based on the risk type corresponding to the risky behavior and the risk control information.

[0014] In one optional implementation, the capability constraint information includes a capability fingerprint and an operation set. The capability fingerprint is used to characterize the system call, network request, or file access characteristics of the data processing tool when it is running in a secure environment. The operation set is used to limit the types of operations that the data processing tool is allowed to perform. The protocol adaptation information is used to indicate the controlled execution mode applicable to the data processing tool, and the controlled execution mode includes at least one of the following: database query protocol, interface call protocol, file access protocol, process processing protocol, or remote graphical session protocol.

[0015] In one optional implementation, the simulation module is used for: Mirror data is generated based on the data structure of the target data resource, and the mirror data is then de-identified. In the isolated pre-verification environment, the corresponding data processing tool is invoked using the de-identified mirror data and the input parameters associated with the tool node; The actual invocation behavior of the tool node is compared with the capability constraint information in the tool description object. Based on the required authorization information, it is determined whether the data access scope of the tool node exceeds the authority. Based on the governance rule reference information, it is determined whether the data access path corresponding to the tool node is configured with governance rules.

[0016] In one optional implementation, the controlled execution domain includes a proxy execution domain; the execution module is used for: When the data processing tool corresponding to the tool node is a web-based tool or an interface-based tool, a proxy access task corresponding to the data processing tool is generated based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. Based on the proxy access task, a mapping relationship between the user session and the target data resource side session is established in the proxy execution domain, and a controlled access address is assigned to the data processing tool; The proxy execution domain receives page requests, interface requests, or form submission requests initiated by the data processing tool based on the controlled access address. The page request, interface request, or form submission request is rewritten, encapsulated, or forwarded, and during the forwarding process, the tool-side identity token is replaced or converted into the target data resource-side access credentials to access the target data resource; The system receives the response data returned by the target data resource, processes the response data based on the governance rule reference information, and then returns the processed response data to the data processing tool or the next tool node in the task execution plan.

[0017] In one optional implementation, the controlled execution domain includes a remote graphics execution domain; the execution module is used for: When the data processing tool corresponding to the tool node is a graphical tool, a remote graphical execution task corresponding to the data processing tool is generated based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. Based on the remote graphics execution task, an isolated remote graphics session is created in the remote graphics execution domain, and the remote graphics session is bound to at least one of the following: an authorized object, a target data resource, a session state, or a validity period. Assign temporary access credentials or temporary access tokens to the remote graphics session, enabling the graphics tools to access the target data resource within the remote graphics execution domain; The graphical interaction stream of the remote graphical session is provided to the user terminal so that the user terminal can operate the graphical tools through the graphical interaction stream; During the execution of the graphical tool, at least one of the following is collected from the remote graphical session: keyboard and mouse operations, page jumps, export operations, download requests, or session activity time. The collected results are then compared with the behavioral baseline corresponding to the graphical tool. Based on the comparison results, it is determined whether there is any risky behavior, and the execution results generated by the graphical tool are returned to the next tool node in the task execution plan or output as data processing results.

[0018] In one optional implementation, the execution module is used to: Based on the governance rules corresponding to the governance rule reference information, at least one of the following is performed on the data access request or return result: authorization condition injection, row-level filtering, field desensitization, aggregation granularity restriction, query frequency restriction, or result perturbation processing; The data access requests initiated by the data processing tool are subjected to syntax parsing, request frequency statistics, access path identification, or sensitivity detection of return results to determine whether there is at least one risky behavior among unauthorized access, abnormal export, abnormal download, abnormal redirection, or over-frequency access.

[0019] In one optional implementation, the risk management information includes a recovery strategy; the management module is used for: In the event of authorization failure, authorization revocation, unauthorized access, or execution anomaly, at least one of the following actions shall be performed according to the reclaiming policy: session closure, token expiration, credential expiration, channel release, temporary file cleanup, or temporary task cancellation. Record at least one of the following: tool identifier of the data processing tool, authorized object, target data resource, task execution plan summary, governance rule version, request summary, response summary, risk behavior information or risk control result, and generate an audit record associated with the task execution plan.

[0020] Thirdly, an optional implementation of this disclosure also provides a computer device, a processor, and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the processor is configured to execute the machine-readable instructions stored in the memory, wherein when the machine-readable instructions are executed by the processor, they perform the steps of the first aspect above, or any possible implementation of the first aspect.

[0021] Fourthly, an optional implementation of this disclosure also provides a computer-readable storage medium storing a computer program that, when run, performs the steps of the first aspect or any possible implementation of the first aspect.

[0022] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this disclosure.

[0023] The data processing method, apparatus, computer equipment, and storage medium provided in this disclosure provide a unified description of registered data processing tools through a tool description object. Based on data processing requests, a task execution plan containing tool nodes is generated. Before actual execution, de-identified mirror data is used for pre-verification, enabling early identification of issues such as tool capability mismatch, unauthorized access, or missing governance rules. Simultaneously, this disclosure establishes a controlled execution domain based on the tool's form, restricting the data processing tool's access to target data resources within the controlled execution domain. During execution, governance processing, risk monitoring, and risk control are integrated, thereby improving the controllability, security, and traceability of access during the execution of heterogeneous data processing tools.

[0024] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly described below. These drawings are incorporated in and constitute a part of this specification. They illustrate embodiments conforming to this disclosure and, together with the specification, serve to explain the technical solutions of this disclosure. It should be understood that the following drawings only show some embodiments of this disclosure and should not be considered as limiting the scope. Those skilled in the art can obtain other related drawings based on these drawings without creative effort.

[0026] Figure 1 A flowchart of a data processing method provided by some embodiments of this disclosure is shown; Figure 2 A schematic diagram of a data processing apparatus provided in some embodiments of this disclosure is shown; Figure 3 A schematic diagram of a computer device provided in some embodiments of the present disclosure is shown. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. The components of the embodiments of this disclosure described and shown herein can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure is not intended to limit the scope of the claimed disclosure, but merely represents selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0028] Research has found that technologies such as interface gateways, remote desktops, sandbox execution, and data anonymization can improve the security of data access to some extent. However, in practical applications, data processing tools are complex in form and execution methods. Different tools may participate in the data processing through web pages, interfaces, scripts, workflow components, or graphical interfaces. Due to the differences in access paths, operating states, and interaction methods involved in different tools, when a data processing task involves multiple tools working together, the data provider may still find it difficult to accurately grasp the actual access scope, execution process, and subsequent access status after changes in authorization status of each tool, thus affecting the security control and traceability of the data processing process.

[0029] Based on the above research, this disclosure provides a data processing method, apparatus, computer equipment, and storage medium. It provides a unified description of registered data processing tools through a tool description object and generates a task execution plan containing tool nodes based on data processing requests. Before actual execution, it uses anonymized mirrored data for pre-verification, enabling early identification of issues such as tool capability mismatch, unauthorized access, or missing governance rules. Simultaneously, this disclosure establishes a controlled execution domain based on the tool's form, restricting the data processing tool's access to target data resources within the controlled execution domain. During execution, it integrates governance processing, risk monitoring, and risk control, thereby improving the controllability, security, and traceability of access during the execution of heterogeneous data processing tools.

[0030] The shortcomings of the above solutions are the result of the inventor's practical experience and careful research. Therefore, the discovery process of the above problems and the solutions proposed in this disclosure below should be considered as the inventor's contribution to this disclosure.

[0031] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0032] To facilitate understanding of this embodiment, a data processing method disclosed in this disclosure will first be described in detail. The execution subject of the data processing method provided in this disclosure is generally a computer device with certain computing capabilities, such as a terminal device, a server, or other processing devices. In some possible implementations, the data processing method can be implemented by a processor calling computer-readable instructions stored in memory.

[0033] The data processing method provided in this disclosure can be applied to the data provider side, the data user side, the neutral scheduling side, or a data processing system formed by the collaboration of the above multiple sides. The data processing system may include a task entry component, a tool management component, a planning and orchestration component, a pre-verification component, a controlled execution domain management component, a governance rule component, a risk monitoring component, and an audit component. These components can be deployed on the same server, the same cloud platform, multiple server clusters, or edge nodes, or they can be implemented as software services, container services, virtualization services, or plug-in services.

[0034] Data processing tools can include database query tools, API call tools, web-based tools, script tools, workflow processing components, visualization and analysis tools, or graphical interface tools. Target data resources can include databases, data warehouses, data lakes, API services, file systems, reporting systems, business systems, or other data resources accessible to data processing tools. Data processing tasks can include querying, statistics, aggregation, transformation, cleaning, analysis, visualization, report generation, or workflow processing.

[0035] In this embodiment, the data processing tool does not directly access the target data resource according to its original operating mode. Instead, it is first described as a tool object that can be identified and controlled by the system, and then programmed into the task execution plan. The task execution plan undergoes isolation and pre-verification before actual execution. During actual execution, it accesses the target data resource through a controlled execution domain matching the tool's form, and governance processing and risk monitoring are superimposed during execution. When risky behavior is detected, the system can process the tool, controlled execution domain, or temporary resources based on preset risk control information.

[0036] The data processing method provided in this disclosure embodiment will be described below using a server as the execution subject as an example.

[0037] See Figure 1 The diagram shows a flowchart of a data processing method provided in an embodiment of this disclosure. The method includes steps S101 to S105, wherein: S101. In response to receiving a data processing request, a task execution plan is generated based on the task information carried in the data processing request and at least one tool description object.

[0038] In this step, data processing requests can be entered by the user through the user interface, or generated by upstream business systems, process engines, scheduling systems, or natural language processing components. The task information carried in the data processing request may include task objectives, target data resources, time range, filtering conditions, grouping dimensions, aggregation methods, output formats, data user information, authorized object information, or result delivery methods, etc.

[0039] After receiving a data processing request, the system can parse the task information and select one or more data processing tools that match the task information from the registered data processing tools. For example, when the task information indicates that sales data within a certain time range needs to be statistically analyzed and charts generated, the system can choose a database query tool to perform data aggregation, a visualization tool to generate charts, or a workflow processing component to complete data transformation and result output.

[0040] When generating a task execution plan, the system can determine whether each data processing tool is suitable for participating in the current task based on the tool description object. The tool description object describes the registered data processing tools and may include a tool identifier, capability constraint information, protocol compatibility information, and risk management information. Specifically, the tool identifier uniquely or relatively uniquely identifies the data processing tool; capability constraint information describes the scope of capabilities the data processing tool is allowed or suitable to perform; protocol compatibility information describes the controlled execution method suitable for the tool; and risk management information describes the handling methods corresponding to changes in authorization, execution anomalies, or access anomalies.

[0041] A task execution plan may include at least one tool node. Each tool node can be associated with a corresponding data processing tool, input parameters, required authorization information, and governance rule reference information. Input parameters may include query conditions, interface parameters, file paths, field names, statistical dimensions, output formats, or process node parameters. Required authorization information may include the authorized object, authorization scope, authorization period, target data resources, allowed operation types, or maximum access frequency. Governance rule reference information can be used to point to the data processing rules corresponding to the tool node, such as field anonymization rules, row-level filtering rules, aggregation granularity rules, query frequency rules, or result perturbation rules.

[0042] In some embodiments, capability constraint information may include capability fingerprints and operation sets. Capability fingerprints can be used to characterize system calls, network requests, file access paths, runtime dependencies, port accesses, script entry points, or process characteristics of a data processing tool running in a secure environment. Capability fingerprints can be obtained by collecting and calculating a digest of the tool's runtime behavior during the registration phase, or by combining toolkit hashes, mirror hashes, configuration file digests, interface declarations, or runtime traces. Operation sets can be used to limit the types of operations that the data processing tool is allowed to perform, such as listing data sources, executing queries, calling interfaces, reading files, generating reports, exporting digests, creating process nodes, or calling visualization components.

[0043] In some embodiments, the tool description object may further include a parameter structure, a behavioral baseline, and a retrieval strategy. The parameter structure describes the constraint information of the input parameters required to invoke the data processing tool. This constraint information may include at least one of the following: parameter name, data type, whether it is required, value range, default value, parameter source, or parameter validation rules. The behavioral baseline describes the operational sequence characteristics of the data processing tool in a reference operating state, such as request frequency, common access paths, file reading range, page click order, export count range, session duration, or resource consumption range. The retrieval strategy describes the handling methods corresponding to changes in authorization status or abnormal execution status of the data processing tool, such as session closure, access credential expiration, channel release, temporary resource cleanup, or audit logging. By recording the above information in the tool description object, subsequent task orchestration, pre-validation, controlled execution, and risk management can all reference the same tool description object.

[0044] In some embodiments, data processing requests can be derived from natural language input. Specifically, the system can parse the natural language content input by the user, extracting the time range, geographical scope, target data resources, filtering conditions, grouping dimensions, aggregation methods, output formats, or display formats, and converting the extracted results into structured task information. For example, the natural language content might express "statistically analyze sales data for a certain region over the past thirty days and generate a chart," which the system can parse into task information containing the time range, geographical filtering conditions, sales data resources, aggregation fields, and chart output requirements. The system can also match registered data processing tools based on the structured task information and generate a task execution plan containing one or more tool nodes.

[0045] In some embodiments, protocol adaptation information can be used to indicate the controlled execution mode applicable to the data processing tool. The controlled execution mode may include at least one of a database query protocol, an interface call protocol, a file access protocol, a workflow processing protocol, or a remote graphical session protocol. For example, a database query tool may be adapted to a database query protocol, an interface-based tool may be adapted to an interface call protocol, a file processing tool may be adapted to a file access protocol, a workflow processing component may be adapted to a workflow processing protocol, and a graphical interface tool may be adapted to a remote graphical session protocol. Through protocol adaptation information, the system can establish matching controlled execution domains for different types of data processing tools in subsequent steps.

[0046] In one alternative implementation, the system can generate a tool description object during the tool registration phase. The tool registration process may include receiving the tool installation package, tool image, tool script, tool access address, tool interface description, or tool process template; starting or parsing the tool in a secure environment; collecting the tool's operational characteristics, allowed operations, parameter structure, and access methods; and generating a tool description object. The tool description object can be stored in a tool directory, configuration center, database, registry, or tool management service so that it can be invoked when generating a task execution plan.

[0047] In another alternative implementation, the task execution plan may include multiple tool nodes and dependency information between them. Dependency information may indicate that the output of one tool node serves as the input of another, or that a tool node needs to wait for prior authorization verification, data governance processing, or manual confirmation before execution. The task execution plan may be a linear flow, a branching flow, a conditional flow, a graph structure flow, or other data structures capable of representing the execution relationships between tool nodes.

[0048] S102. For any tool node, in an isolated pre-verification environment, simulate execution of the tool node based on the de-identified mirror data, and verify the tool capabilities, access scope, and governance rule coverage status of the tool node according to the tool description object corresponding to the tool node, the required authorization information, and the governance rule reference information.

[0049] In this step, the pre-verification environment can be a container, virtual machine, sandbox process, test namespace, temporary database instance, simulated interface service, or other controlled computing environment isolated from the actual execution environment. The pre-verification environment is used to simulate the execution behavior of tool nodes before actually accessing the target data resources, so as to discover in advance situations such as mismatch between tool capabilities and task requirements, access scope exceeding authorization, or governance rules not being covered.

[0050] Mirrored data can be generated based on the data structure of the target data resource. Mirrored data can retain at least a portion of the target data resource's table structure, field types, field names, interface structure, file directory structure, or statistical distribution, but it does not directly use sensitive original content from the target data resource. De-identification processing can include field replacement, field generalization, randomization, masking, sampling, bucketing, aggregation, or other data processing methods that can reduce the risk of sensitive content exposure.

[0051] In some embodiments, for any tool node, in an isolated pre-verification environment, the tool node is simulated and executed based on anonymized image data, and the tool node's tool capabilities, access scope, and governance rule coverage status are verified. This process may include the following steps: First, mirror data is generated based on the data structure of the target data resource, and then the mirror data undergoes anonymization processing. For example, when the target data resource is a relational database, a mirror table can be generated based on the field structure, field types, and constraints of the target table, and sensitive fields such as name, mobile phone number, ID number, address, or others can be replaced or generalized. When the target data resource is an API service, simulated response data can be generated based on the API return structure. When the target data resource is a file system, a simulated file set can be generated based on the file directory hierarchy and file metadata.

[0052] Secondly, in the isolated pre-verification environment, the anonymized mirrored data and the input parameters associated with the tool nodes are used to invoke the corresponding data processing tools. This invocation can be performed according to the tool node configuration in the task execution plan, such as generating query statements, interface requests, script execution parameters, process node parameters, or graphical tool operation parameters based on the input parameters. The system can record the actual invocation behavior of the tool nodes during the simulated execution process, including system calls, network requests, file access, interface paths, query fields, execution duration, resource consumption, or output structure.

[0053] Next, the actual invocation behavior of the tool node is compared with the capability constraint information in the tool description object. Based on the required authorization information, it is determined whether the tool node's data access scope exceeds the authorized limits. Furthermore, based on the governance rule reference information, it is determined whether the data access path corresponding to the tool node is configured with governance rules. For example, if the field actually accessed by the tool node is not within the range allowed by the required authorization information, it can be determined that the tool node has an abnormal access scope; if the data path accessed by the tool node does not have corresponding de-identification or filtering rules configured, it can be determined that the governance rule coverage status does not meet the execution conditions; if the interface type actually invoked by the tool node exceeds the range limited by the operation set, it can be determined that the tool's capabilities do not match the task execution requirements.

[0054] In some embodiments, if pre-validation fails, the system may not proceed to the actual execution steps but instead generate a pre-validation result. The pre-validation result may include a plan summary, tool node identifier, reason for failure, risk type, suggested adjustments, or a summary of rule coverage. For example, the system may prompt adjustments to the data processing request, replacement of the data processing tool, supplementation of governance rules, narrowing of the access scope, or regeneration of the task execution plan. If pre-validation passes, the system can mark the task execution plan as executable and proceed to subsequent controlled execution steps.

[0055] In some embodiments, the system can perform conflict detection and plan adjustment during pre-verification. The conflict may include at least one of the following: the tool's actual invocation behavior exceeds capability constraints; the tool node's access range exceeds the required authorization information; the data access path corresponding to the tool node is not configured with governance rules; the tool's execution time exceeds a preset threshold; the tool's output structure does not match the input structure of subsequent nodes; or the tool's resource consumption exceeds a preset range. Upon detecting a conflict, the system can stop issuing the current task execution plan and generate a pre-verification result. The pre-verification result may include the tool node identifier, conflict type, conflict location, associated authorization information, associated governance rule information, and suggested handling methods.

[0056] In some embodiments, the system can adjust the task execution plan based on the pre-validation results. The adjustments may include at least one of the following: narrowing the data access scope, supplementing authorization conditions, supplementing governance rules, replacing data processing tools, adjusting tool node input parameters, adjusting node dependencies, or regenerating the task execution plan. For example, when the pre-validation result indicates that the query field exceeds the authorized scope, the system can delete the unauthorized field or add corresponding authorization filtering conditions; when the pre-validation result indicates that governance rules are missing, the system can supplement field processing rules or row-level filtering rules for the corresponding data access path; when the pre-validation result indicates that the tool capabilities are mismatched, the system can select other registered data processing tools to regenerate the tool node.

[0057] S103. If the task execution plan passes verification, a controlled execution domain is established based on the protocol adaptation information to match the tool form of the data processing tool.

[0058] In this step, a controlled execution domain is the logical execution scope used to host or proxy data processing tools' access to target data resources. A controlled execution domain can manifest as a proxy service, access gateway, sandbox container, process runtime environment, remote graphical session, virtual file system, temporary task environment, or a combination of the above. A controlled execution domain is not limited to a single physical device or a single software module; it can be formed collaboratively by multiple service components.

[0059] The system can establish controlled execution domains based on protocol adaptation information and tool type. For example, for web-based or interface-based tools, the system can establish a proxy execution domain; for graphical tools, it can establish a remote graphical execution domain; for workflow processing components, it can establish a workflow execution domain; and for file processing tools, it can establish a virtual file access domain. In this way, data processing tools of different types can be incorporated into a unified controlled execution framework.

[0060] A controlled execution domain is used to restrict the access capabilities of data processing tools to target data resources within that domain. These access capabilities can include access credentials, access tokens, target resource sessions, controlled access addresses, remote graphical session permissions, virtual file path permissions, API call capabilities, or database connection capabilities. The implementation of these access capabilities can vary depending on the tool type. For example, web-based or API-based tools can have a proxy execution domain holding access credentials for the target data resource, and the data processing tool can only initiate requests through the controlled access address; graphical tools can obtain temporary access credentials or tokens bound to the authorized object, target data resource, or validity period in a remote graphical execution domain; and workflow processing components can obtain restricted node execution permissions through a workflow execution domain.

[0061] In some embodiments, a controlled execution domain can maintain associations between users, data processing tools, target data resources, authorization scope, and access capabilities. For example, a controlled execution domain can associate a user's session with a target data resource's session, or it can associate a remote graphical session with an authorized object, target data resource, and validity period. Through these associations, when authorization expires, is revoked, or risky behavior is detected, the system can locate the corresponding controlled execution domain and perform risk management.

[0062] In some embodiments, the controlled execution domain may further include a process execution domain. For process processing component tools, the system can create, update, connect, enable, disable, or delete process nodes through a unified process control interface, and add authorization verification and governance processing to the input path, output path, or node connection path of the process nodes. The process execution domain can control the execution order of each process node according to the node dependencies in the task execution plan, and record the input summary, output summary, execution status, and abnormal status of the process nodes. In this way, the process processing component can complete data processing within the controlled execution domain, instead of bypassing the task execution plan to directly access the target data resource.

[0063] In some embodiments, the controlled execution domain may further include a file access domain. For file processing tools, the file access domain can provide a virtual file system view to the data processing tool. This virtual file system view can determine visible file paths, readable file ranges, writable directory ranges, or temporary file storage locations based on the authorized object, target data resource, and governance rules. When the data processing tool accesses files through the virtual file system view, the system can log and manage file read requests, file write requests, or file export requests.

[0064] S104. Execute each tool node according to the node dependency relationship determined by the task execution plan, and during the execution of the tool node, perform governance processing on data access requests or return results based on the governance rule reference information, and perform risk monitoring on the access requests, execution behavior or return results of the data processing tool.

[0065] In this step, the system executes each tool node according to the node dependencies defined in the task execution plan. If the task execution plan includes multiple tool nodes, the system can first execute tool nodes without prerequisite dependencies, and then execute subsequent nodes based on the output of the preceding nodes. The output of a tool node can be data results, result summaries, file addresses, chart objects, task status, process parameters, or other information that can be used by subsequent nodes.

[0066] When executing tool nodes, the system can perform governance processing on data access requests or returned results based on governance rule reference information. Governance processing can occur in the request generation phase, request forwarding phase, process node input / output phase, result return phase, or result output phase. By performing governance processing along the data access path, even if data processing tools have the ability to execute tasks, the actual data results they obtain or output are still constrained by the authorized scope and governance rules.

[0067] In some embodiments, governance processing is performed on data access requests or returned results based on the governance rules corresponding to the governance rule reference information. This may include at least one of the following: authorization condition injection, row-level filtering, field desensitization, aggregation granularity restriction, query frequency restriction, or result perturbation processing. For example, for database query requests, the query statement can be parsed and authorization conditions can be added; for returned results involving sensitive fields, the field content can be masked, replaced, or generalized; for statistical results, the minimum sample size, aggregation granularity, or query frequency can be restricted; for interface returned results, fields that exceed the authorization scope can be removed or replaced.

[0068] In some embodiments, governance rules can be determined based on the target data resource type, tool type, authorized object, query frequency, or output purpose. For database access requests, the system can parse the query statement and add authorization conditions, field selection restrictions, or aggregation restrictions based on the authorization scope; for interface access requests, the system can add control information indicating the access scope in the request header, request parameters, or request body, and filter or replace the fields returned by the interface; for file access requests, the system can restrict the file paths visible and accessible to data processing tools through a virtual file system view.

[0069] In some embodiments, for statistical data processing tasks, the system can perform at least one of the following processing on the returned results according to governance rules: result perturbation, minimum sample threshold control, query frequency limitation, aggregation granularity limitation, field generalization, or delayed return of results. Result perturbation may include adding a perturbation value within a preset range to the statistical results; minimum sample threshold control may include not returning detailed results or not returning statistical results when the number of data records participating in the statistics is less than a preset threshold; field generalization may include converting precise field values ​​into range, category, or lower precision field values. The above processing can be determined according to the governance rule reference information corresponding to the tool node and can be associated with the execution status of the task execution plan.

[0070] During the execution of tool nodes, the system can also perform risk monitoring on the access requests, execution behaviors, or returned results of data processing tools. Risk monitoring can include parsing data access requests, counting request frequencies, identifying access paths, or detecting the sensitivity of returned results to determine whether there are risky behaviors such as unauthorized access, abnormal exports, abnormal downloads, abnormal redirects, or excessive access. For example, when a tool node initiates a large number of export requests in a short period of time, or requests access to data paths not appearing in the task execution plan, the system can mark this behavior as a risky behavior to be managed. As another example, when the returned results contain data fields that exceed the scope allowed by governance rules, the system can trigger governance or risk management actions.

[0071] In one possible implementation, when the controlled execution domain includes a proxy execution domain, the system can execute the tool nodes corresponding to web page tools or interface tools in the following manner.

[0072] When the data processing tool corresponding to the tool node is a web-based tool or an API-based tool, the system can generate a proxy access task for the data processing tool based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. The proxy access task may include the controlled access address, the target data resource identifier, the API path, the page path, the request method, the request parameters, the authorized object, the governance rule identifier, or the return result processing method, etc.

[0073] Based on the proxy access task, the system can establish a mapping relationship between the user session and the target data resource side session in the proxy execution domain, and assign controlled access addresses to the data processing tools. Controlled access addresses can be proxy domain names, proxy paths, temporary links, addresses with session identifiers, or other access points that can be accessed by the data processing tools but do not directly expose the real address of the target data resource. A user session can represent the session between the user terminal and the proxy execution domain, while a target data resource side session can represent the session between the proxy execution domain and the target data resource.

[0074] During the execution of data processing tools, the proxy execution domain receives page requests, API requests, or form submission requests initiated by the data processing tools based on controlled access addresses. The proxy execution domain can rewrite, encapsulate, or forward these requests. For example, it can rewrite links, script requests, asynchronous requests, or form submission addresses on a page into proxy addresses, and it can also add controlled session identifiers or task node identifiers to API requests.

[0075] During the forwarding process, the proxy execution domain can replace or convert the tool-side identity token into target data resource-side access credentials to access the target data resource. The tool-side identity token can be used to identify the user or data processing tool within the system, while the target data resource-side access credentials can include database credentials, interface access tokens, session cookies, authentication headers, or other credentials used to access the target data resource. In this way, the data processing tool can access the target data resource via a controlled access address, while the target data resource-side access credentials are processed by the proxy execution domain.

[0076] In some embodiments, the proxy execution domain can also perform context isolation processing for page routing, asynchronous requests, form submissions, local storage, or session storage. Specifically, the proxy execution domain can assign mutually isolated session contexts to different users, different target data resources, or different tool nodes, ensuring that page state, access credentials, cached content, or session identifiers are not mixed when the same user accesses different target data resources or when different users access the same target data resource. The proxy execution domain can also replace link addresses, script request addresses, API call addresses, or form submission addresses in web pages, directing them to controlled access addresses.

[0077] In some embodiments, the proxy execution domain can also adjust the access rhythm of some access requests. For example, for batch or continuous requests, the proxy execution domain can split the corresponding access request into multiple sub-requests, or adjust the sending interval between multiple sub-requests, based on governance rules, tool type, authorization scope, or access frequency thresholds. The proxy execution domain can also process the request order, request batches, or return rhythm without affecting the task execution result, in order to reduce the impact of a single concentrated access on the target data resources. The above processing can be configured as optional and can be linked to request frequency limits, aggregation granularity limits, or audit logs.

[0078] After receiving the response data from the target data resource, the proxy execution domain can process the response data based on governance rule reference information, and then return the processed response data to the next tool node in the data processing tool or task execution plan. For example, the proxy execution domain can anonymize sensitive fields in the response data, filter unauthorized lines, summarize the returned results, or convert the results into the data format required by subsequent tool nodes.

[0079] In another possible implementation, when the controlled execution domain includes a remote graphics execution domain, the system can execute the tool node corresponding to the graphics tool in the following manner.

[0080] When the data processing tool corresponding to the tool node is a graphical tool, the system can generate a remote graphical execution task corresponding to the data processing tool based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. The remote graphical execution task may include a graphical tool identifier, a target data resource identifier, an authorized object, a session validity period, initial interface parameters, a permitted operation scope, a governance rule identifier, or a result output path, etc.

[0081] Based on the remote graphics execution task, the system can create isolated remote graphics sessions within the remote graphics execution domain and bind these sessions to at least one of the following: an authorized object, a target data resource, a session state, or a validity period. A remote graphics session can be a remote browser session, a remote desktop session, a virtual application session, a container graphics session, or any other session capable of providing a graphical interactive stream. Isolated remote graphics sessions can be distinguished from other user sessions, other target data resource sessions, or other tool node sessions.

[0082] In some embodiments, the remote graphics execution domain can maintain a graphics session channel pool. The graphics session channel pool includes multiple allocable graphics session channels, each corresponding to a channel number, target data resource, authorized object, session status, validity period, or resource occupancy status. After generating a remote graphics execution task, the system can select an idle channel from the graphics session channel pool to create a remote graphics session and provide a temporary access entry associated with that remote graphics session to the user terminal. The temporary access entry can be bound to at least one of the authorized object, target data resource, channel number, and validity period.

[0083] In some embodiments, when a temporary access entry expires, the authorization status changes, the target data resource status changes, or the session status is abnormal, the remote graphics execution domain can stop providing the corresponding graphical interaction stream to the user terminal and release the corresponding graphical session channel. The released graphical session channel can be reinitialized for use by subsequent tasks. Through the graphical session channel pool, remote interactive resources for graphical tools can be uniformly allocated, reused, and recycled.

[0084] The system can assign temporary access credentials or tokens to remote graphics sessions, enabling graphics tools to access target data resources within the remote graphics execution domain. These temporary access credentials or tokens can be bound to an authorized object, the target data resource, the session state, the validity period, or a channel number. Thus, graphics tools can access data within the remote graphics execution domain, but their access capabilities are tied to the authorization status of the remote graphics session.

[0085] The system can provide the graphical interaction stream of a remote graphical session to the user terminal, enabling the user terminal to operate graphical tools through the graphical interaction stream. The graphical interaction stream can include page screens, graphical interface screens, operation feedback screens, or rendering result screens. The user terminal can operate the graphical tools in the remote graphical session through a keyboard, mouse, touch, or other input methods, while the actual operation of the graphical tools and the access to target data resources still reside within the remote graphical execution domain.

[0086] During the execution of graphical tools, the system can collect at least one of the following during a remote graphical session: keyboard and mouse operations, page navigation, export operations, download requests, or session activity time. The collected results are then compared with the corresponding behavioral baseline for the graphical tool. The behavioral baseline can be generated during the tool registration phase, historical normal execution phase, or manual configuration phase, and is used to characterize the operational features of the graphical tool in normal tasks. For example, the behavioral baseline may include commonly used page paths, frequency of regular operations, range of export counts, download request types, or session duration ranges. If the deviation between the collected results and the behavioral baseline meets preset conditions, the system can determine that risky behavior exists.

[0087] After determining whether any risky behavior exists, the system can return the execution results generated by graphical tools to the next tool node in the task execution plan, or output them as data processing results. Execution results may include chart files, report data, statistical results, processed files, result summaries, or other output content corresponding to the data processing task.

[0088] S105. Upon detecting a risky behavior, risk control processing is performed on the data processing tool, the controlled execution domain, or the temporary resources associated with the tool node based on the risk type corresponding to the risky behavior and the risk control information.

[0089] In this step, risky behaviors may include authorization invalidation, authorization revocation, unauthorized access, execution anomalies, abnormal export, abnormal download, abnormal page redirection, excessive access, abnormal results, or other risk states related to the execution process of tool nodes. Risk types can be determined based on the source of the risky behavior, the affected object, the processing priority, or the corresponding tool form. Risk control information may include retrieval policies, alarm policies, access restriction policies, session handling policies, resource cleanup policies, or audit logging policies, etc.

[0090] In some embodiments, risk management information includes a revoke policy. Upon detecting authorization failure, authorization revocation, unauthorized access, or execution anomaly, the system may, according to the revoke policy, perform at least one of the following actions: session closure, token expiration, credential expiration, channel release, temporary file cleanup, or temporary task cancellation.

[0091] For example, in the proxy execution domain, the system can delete the mapping between the user session and the target data resource side session, invalidate the controlled access address, stop converting the tool-side identity token into the target data resource side access credentials, and release the proxy channel. In the remote graphics execution domain, the system can close the remote graphics session, invalidate temporary access credentials or tokens, and release the corresponding graphics session resource or channel number. In the process execution domain, the system can stop or suspend the corresponding process node, cancel temporary tasks, and clean up temporary data associated with that tool node. For file access tools, the system can revoke virtual file path access permissions and clean up temporary files or cache directories.

[0092] In some embodiments, access capability revocation may further include invalidating the data cache access key associated with the tool node. Specifically, if a data processing tool generates temporary cached data within a controlled execution domain, the system can configure a corresponding data access key or decryption key for the temporary cached data and associate the key with the authorized object, tool node, controlled execution domain, or validity period. When authorization failure, authorization revocation, or execution anomaly is detected, the system can invalidate the key or delete the key reference stored in the controlled execution domain, preventing the corresponding temporary cached data from being read by the current data processing tool.

[0093] In some embodiments, the system can also set traceable identification data in the target data resource or returned result. The traceable identification data can be identifiable data records, field tags, result summaries, access identifiers, or other identification information that can be associated with an authorized object, tool node, or task execution plan. The system can detect the location of the traceable identification data. When the corresponding identification information is detected outside the expected access path, an abnormal flow prompt can be generated, and actions such as access restrictions, authorization review, session interruption, task suspension, or audit logging can be performed based on risk control information.

[0094] In some embodiments, audit logs can be stored using a chained summary approach. Specifically, the system can generate summary information for tool registration records, task execution plans, pre-validation results, controlled execution domain establishment records, data access request summaries, return result summaries, governance rule versions, risk behavior information, and risk control results, and associate the summary information of the current audit log with the summary information of the previous audit log. Audit logs may include at least one of the following: tool identifier, authorized object, target data resource, tool node identifier, session identifier, request summary, response summary, governance rule version, execution result, risk control result, and time information. For requests or responses involving sensitive content, the system may only record summary information, anonymized summaries, or statistical information.

[0095] In some embodiments, the system may also record at least one of the following: tool identifier of the data processing tool, authorized object, target data resource, task execution plan summary, governance rule version, request summary, response summary, risk behavior information, or risk control results, generating an audit log associated with the task execution plan. The audit log may be stored in a log database, audit system, object storage, hash chained log, or other traceable storage media. For requests or responses involving sensitive content, the system may record a summary, identifier, anonymized content, or statistical information, rather than the complete original content.

[0096] Through the above methods, this embodiment of the present disclosure can incorporate heterogeneous data processing tools into a unified task execution plan after a data processing request enters the system; perform pre-verification using de-identified mirrored data before actual execution; during actual execution, use a controlled execution domain matching the tool's form to carry or proxy access to target data resources; overlay governance processing and risk monitoring during execution; and implement access restrictions, session interruption, access capability reclamation, temporary resource cleanup, or audit logging when risky behavior is detected. This improves the access controllability and execution traceability of data processing tasks in scenarios with multiple tools, protocols, and execution forms.

[0097] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0098] Based on the same inventive concept, this disclosure also provides a data processing device corresponding to the data processing method. Since the principle of the device in this disclosure for solving the problem is similar to the data processing method described above in this disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0099] Reference Figure 2 The diagram shown is a schematic representation of a data processing apparatus provided in an embodiment of this disclosure. The apparatus includes: The generation module 210 is configured to, in response to receiving a data processing request, generate a task execution plan based on the task information carried in the data processing request and at least one tool description object; wherein, the tool description object is used to describe the registered data processing tool and includes tool identifier, capability constraint information, protocol adaptation information, and risk control information; the task execution plan includes at least one tool node, and the tool node is associated with a corresponding data processing tool, input parameters, required authorization information, and governance rule reference information; The simulation module 220 is used to simulate the execution of any tool node in an isolated pre-verification environment based on the de-identified mirror data, and to verify the tool capabilities, access scope and governance rule coverage status of the tool node according to the tool description object corresponding to the tool node, the required authorization information and the governance rule reference information. The module 230 is configured to, upon successful verification of the task execution plan, establish a controlled execution domain that matches the tool form of the data processing tool based on the protocol adaptation information; the controlled execution domain is used to carry or proxy the data processing tool's access to the target data resource, and to restrict the data processing tool's access to the target data resource to the controlled execution domain. The execution module 240 is used to execute each tool node according to the node dependency relationship determined by the task execution plan, and to perform governance processing on data access requests or return results based on the governance rule reference information during the execution of the tool node, and to perform risk monitoring on the access requests, execution behavior or return results of the data processing tool. The control module 250 is used to, upon detecting a risky behavior, perform at least one of the following risk control actions on the data processing tool, the controlled execution domain, or temporary resources associated with the tool node: access restriction, session interruption, access capability reclamation, temporary resource cleanup, or audit logs, based on the risk type corresponding to the risky behavior and the risk control information.

[0100] In one optional implementation, the capability constraint information includes a capability fingerprint and an operation set. The capability fingerprint is used to characterize the system call, network request, or file access characteristics of the data processing tool when it is running in a secure environment. The operation set is used to limit the types of operations that the data processing tool is allowed to perform. The protocol adaptation information is used to indicate the controlled execution mode applicable to the data processing tool, and the controlled execution mode includes at least one of the following: database query protocol, interface call protocol, file access protocol, process processing protocol, or remote graphical session protocol.

[0101] In one optional implementation, the simulation module 220 is used for: Mirror data is generated based on the data structure of the target data resource, and the mirror data is then de-identified. In the isolated pre-verification environment, the corresponding data processing tool is invoked using the de-identified mirror data and the input parameters associated with the tool node; The actual invocation behavior of the tool node is compared with the capability constraint information in the tool description object. Based on the required authorization information, it is determined whether the data access scope of the tool node exceeds the authority. Based on the governance rule reference information, it is determined whether the data access path corresponding to the tool node is configured with governance rules.

[0102] In one optional implementation, the controlled execution domain includes a proxy execution domain; the execution module 240 is used for: When the data processing tool corresponding to the tool node is a web-based tool or an interface-based tool, a proxy access task corresponding to the data processing tool is generated based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. Based on the proxy access task, a mapping relationship between the user session and the target data resource side session is established in the proxy execution domain, and a controlled access address is assigned to the data processing tool; The proxy execution domain receives page requests, interface requests, or form submission requests initiated by the data processing tool based on the controlled access address. The page request, interface request, or form submission request is rewritten, encapsulated, or forwarded, and during the forwarding process, the tool-side identity token is replaced or converted into the target data resource-side access credentials to access the target data resource; The system receives the response data returned by the target data resource, processes the response data based on the governance rule reference information, and then returns the processed response data to the data processing tool or the next tool node in the task execution plan.

[0103] In one optional implementation, the controlled execution domain includes a remote graphics execution domain; the execution module 240 is used for: When the data processing tool corresponding to the tool node is a graphical tool, a remote graphical execution task corresponding to the data processing tool is generated based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. Based on the remote graphics execution task, an isolated remote graphics session is created in the remote graphics execution domain, and the remote graphics session is bound to at least one of the following: an authorized object, a target data resource, a session state, or a validity period. Assign temporary access credentials or temporary access tokens to the remote graphics session, enabling the graphics tools to access the target data resource within the remote graphics execution domain; The graphical interaction stream of the remote graphical session is provided to the user terminal so that the user terminal can operate the graphical tools through the graphical interaction stream; During the execution of the graphical tool, at least one of the following is collected from the remote graphical session: keyboard and mouse operations, page jumps, export operations, download requests, or session activity time. The collected results are then compared with the behavioral baseline corresponding to the graphical tool. Based on the comparison results, it is determined whether there is any risky behavior, and the execution results generated by the graphical tool are returned to the next tool node in the task execution plan or output as data processing results.

[0104] In one optional implementation, the execution module 240 is used to: Based on the governance rules corresponding to the governance rule reference information, at least one of the following is performed on the data access request or return result: authorization condition injection, row-level filtering, field desensitization, aggregation granularity restriction, query frequency restriction, or result perturbation processing; The data access requests initiated by the data processing tool are subjected to syntax parsing, request frequency statistics, access path identification, or sensitivity detection of return results to determine whether there is at least one risky behavior among unauthorized access, abnormal export, abnormal download, abnormal redirection, or over-frequency access.

[0105] In one optional implementation, the risk management information includes a recovery strategy; the management module 250 is used for: In the event of authorization failure, authorization revocation, unauthorized access, or execution anomaly, at least one of the following actions shall be performed according to the reclaiming policy: session closure, token expiration, credential expiration, channel release, temporary file cleanup, or temporary task cancellation. Record at least one of the following: tool identifier of the data processing tool, authorized object, target data resource, task execution plan summary, governance rule version, request summary, response summary, risk behavior information or risk control result, and generate an audit record associated with the task execution plan.

[0106] The data processing apparatus provided in this disclosure provides a unified description of registered data processing tools through a tool description object, and generates a task execution plan containing tool nodes based on the data processing request. Before actual execution, it performs pre-verification using de-identified mirror data, which can identify problems such as tool capability mismatch, unauthorized access scope, or missing governance rules in advance. At the same time, this disclosure establishes a controlled execution domain according to the tool form, restricting the data processing tool's access to target data resources to the controlled execution domain, and linking governance processing, risk monitoring, and risk control processing during execution, thereby improving the access controllability, security, and traceability of heterogeneous data processing tools during execution.

[0107] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0108] This disclosure also provides a computer device, such as... Figure 3 The diagram shown is a schematic representation of a computer device structure provided in an embodiment of this disclosure, including: Processor 31 and memory 32; the memory 32 stores machine-readable instructions executable by the processor 31, and the processor 31 executes the machine-readable instructions stored in the memory 32. When the machine-readable instructions are executed by the processor 31, the processor 31 performs the following steps: In response to receiving a data processing request, a task execution plan is generated based on the task information carried in the data processing request and at least one tool description object; wherein, the tool description object is used to describe the registered data processing tool and includes tool identifier, capability constraint information, protocol adaptation information and risk control information; the task execution plan includes at least one tool node, and the tool node is associated with a corresponding data processing tool, input parameters, required authorization information and governance rule reference information; For any tool node, in an isolated pre-verification environment, the tool node is simulated and executed based on the de-identified mirror data. The tool capabilities, access scope, and governance rule coverage status of the tool node are verified according to the tool description object corresponding to the tool node, the required authorization information, and the governance rule reference information. If the task execution plan passes verification, a controlled execution domain is established based on the protocol adaptation information, matching the tool form of the data processing tool. The controlled execution domain is used to carry or proxy the data processing tool's access to the target data resource, and to restrict the data processing tool's access to the target data resource to the controlled execution domain. Each tool node is executed according to the node dependencies determined by the task execution plan. During the execution of the tool nodes, data access requests or return results are governed based on the governance rule reference information, and the access requests, execution behavior or return results of the data processing tools are monitored for risks. Upon detecting risky behavior, based on the risk type corresponding to the risky behavior and the risk control information, at least one of the following risk control actions is performed on the data processing tool, the controlled execution domain, or the temporary resources associated with the tool node: access restriction, session interruption, access capability reclamation, temporary resource cleanup, or audit log.

[0109] In one optional implementation, the capability constraint information includes a capability fingerprint and an operation set. The capability fingerprint is used to characterize the system call, network request, or file access characteristics of the data processing tool when it is running in a secure environment. The operation set is used to limit the types of operations that the data processing tool is allowed to perform. The protocol adaptation information is used to indicate the controlled execution mode applicable to the data processing tool, and the controlled execution mode includes at least one of the following: database query protocol, interface call protocol, file access protocol, process processing protocol, or remote graphical session protocol.

[0110] In one optional implementation, the step of simulating execution of the tool node based on anonymized mirror data in an isolated pre-verification environment, and verifying the tool node's tool capabilities, access scope, and governance rule coverage status according to the tool description object corresponding to the tool node, the required authorization information, and the governance rule reference information, includes: Mirror data is generated based on the data structure of the target data resource, and the mirror data is then de-identified. In the isolated pre-verification environment, the corresponding data processing tool is invoked using the de-identified mirror data and the input parameters associated with the tool node; The actual invocation behavior of the tool node is compared with the capability constraint information in the tool description object. Based on the required authorization information, it is determined whether the data access scope of the tool node exceeds the authority. Based on the governance rule reference information, it is determined whether the data access path corresponding to the tool node is configured with governance rules.

[0111] In one optional implementation, the controlled execution domain includes a proxy execution domain; the execution of each tool node according to the node dependencies determined by the task execution plan includes: When the data processing tool corresponding to the tool node is a web-based tool or an interface-based tool, a proxy access task corresponding to the data processing tool is generated based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. Based on the proxy access task, a mapping relationship between the user session and the target data resource side session is established in the proxy execution domain, and a controlled access address is assigned to the data processing tool; The proxy execution domain receives page requests, interface requests, or form submission requests initiated by the data processing tool based on the controlled access address. The page request, interface request, or form submission request is rewritten, encapsulated, or forwarded, and during the forwarding process, the tool-side identity token is replaced or converted into the target data resource-side access credentials to access the target data resource; The system receives the response data returned by the target data resource, processes the response data based on the governance rule reference information, and then returns the processed response data to the data processing tool or the next tool node in the task execution plan.

[0112] In one optional implementation, the controlled execution domain includes a remote graphics execution domain; the execution of each tool node according to the node dependencies determined by the task execution plan includes: When the data processing tool corresponding to the tool node is a graphical tool, a remote graphical execution task corresponding to the data processing tool is generated based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. Based on the remote graphics execution task, an isolated remote graphics session is created in the remote graphics execution domain, and the remote graphics session is bound to at least one of the following: an authorized object, a target data resource, a session state, or a validity period. Assign temporary access credentials or temporary access tokens to the remote graphics session, enabling the graphics tools to access the target data resource within the remote graphics execution domain; The graphical interaction stream of the remote graphical session is provided to the user terminal so that the user terminal can operate the graphical tools through the graphical interaction stream; During the execution of the graphical tool, at least one of the following is collected from the remote graphical session: keyboard and mouse operations, page jumps, export operations, download requests, or session activity time. The collected results are then compared with the behavioral baseline corresponding to the graphical tool. Based on the comparison results, it is determined whether there is any risky behavior, and the execution results generated by the graphical tool are returned to the next tool node in the task execution plan or output as data processing results.

[0113] In one optional implementation, the governance processing of data access requests or return results based on the governance rule reference information, and the risk monitoring of access requests, execution behaviors, or return results of the data processing tool, include: Based on the governance rules corresponding to the governance rule reference information, at least one of the following is performed on the data access request or return result: authorization condition injection, row-level filtering, field desensitization, aggregation granularity restriction, query frequency restriction, or result perturbation processing; The data access requests initiated by the data processing tool are subjected to syntax parsing, request frequency statistics, access path identification, or sensitivity detection of return results to determine whether there is at least one risky behavior among unauthorized access, abnormal export, abnormal download, abnormal redirection, or over-frequency access.

[0114] In one optional implementation, the risk management information includes a recovery strategy; risk management processing is performed based on the risk type corresponding to the risky behavior and the risk management information, including: In the event of authorization failure, authorization revocation, unauthorized access, or execution anomaly, at least one of the following actions shall be performed according to the reclaiming policy: session closure, token expiration, credential expiration, channel release, temporary file cleanup, or temporary task cancellation. Record at least one of the following: tool identifier of the data processing tool, authorized object, target data resource, task execution plan summary, governance rule version, request summary, response summary, risk behavior information or risk control result, and generate an audit record associated with the task execution plan.

[0115] The aforementioned memory 32 includes a main memory 321 and an external memory 322; the main memory 321, also known as internal memory, is used to temporarily store the computational data in the processor 31, as well as the data exchanged with external memory 322 such as a hard disk. The processor 31 exchanges data with the external memory 322 through the main memory 321.

[0116] The specific execution process of the above instructions can be referred to the steps of the data processing method described in the embodiments of this disclosure, and will not be repeated here.

[0117] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the data processing method described in the above-described method embodiments. The storage medium may be a volatile or non-volatile computer-readable storage medium.

[0118] This disclosure also provides a computer program product carrying program code. The program code includes instructions that can be used to execute the steps of the data processing method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0119] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0120] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0121] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this disclosure, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0122] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0123] In addition, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0124] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0125] Finally, it should be noted that the above-described embodiments are merely specific implementations of this disclosure, used to illustrate the technical solutions of this disclosure, and not to limit it. The protection scope of this disclosure is not limited thereto. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this disclosure; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be covered within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the protection scope of the claims.

Claims

1. A data processing method, characterized in that, include: In response to receiving a data processing request, a task execution plan is generated based on the task information carried in the data processing request and at least one tool description object; wherein, the tool description object is used to describe the registered data processing tool and includes tool identifier, capability constraint information, protocol adaptation information and risk control information; the task execution plan includes at least one tool node, and the tool node is associated with a corresponding data processing tool, input parameters, required authorization information and governance rule reference information; For any tool node, in an isolated pre-verification environment, the tool node is simulated and executed based on the de-identified mirror data. The tool capabilities, access scope, and governance rule coverage status of the tool node are verified according to the tool description object corresponding to the tool node, the required authorization information, and the governance rule reference information. If the task execution plan passes verification, a controlled execution domain is established based on the protocol adaptation information, matching the tool form of the data processing tool. The controlled execution domain is used to carry or proxy the data processing tool's access to the target data resource, and to restrict the data processing tool's access to the target data resource to the controlled execution domain. Each tool node is executed according to the node dependencies determined by the task execution plan. During the execution of the tool nodes, data access requests or return results are governed based on the governance rule reference information, and the access requests, execution behavior or return results of the data processing tools are monitored for risks. Upon detecting risky behavior, based on the risk type corresponding to the risky behavior and the risk control information, at least one of the following risk control actions is performed on the data processing tool, the controlled execution domain, or the temporary resources associated with the tool node: access restriction, session interruption, access capability reclamation, temporary resource cleanup, or audit log.

2. The method according to claim 1, characterized in that, The capability constraint information includes a capability fingerprint and an operation set. The capability fingerprint is used to characterize the system call, network request, or file access characteristics of the data processing tool when it is running in a secure environment. The operation set is used to limit the types of operations that the data processing tool is allowed to perform. The protocol adaptation information is used to indicate the controlled execution mode applicable to the data processing tool, and the controlled execution mode includes at least one of the following: database query protocol, interface call protocol, file access protocol, process processing protocol, or remote graphical session protocol.

3. The data processing method according to claim 1, characterized in that, In the isolated pre-verification environment, the tool node is simulated and executed based on the anonymized mirror data. The tool node's capabilities, access scope, and governance rule coverage status are verified according to the tool description object corresponding to the tool node, the required authorization information, and the governance rule reference information. This includes: Mirror data is generated based on the data structure of the target data resource, and the mirror data is then de-identified. In the isolated pre-verification environment, the corresponding data processing tool is invoked using the de-identified mirror data and the input parameters associated with the tool node; The actual invocation behavior of the tool node is compared with the capability constraint information in the tool description object. Based on the required authorization information, it is determined whether the data access scope of the tool node exceeds the authority. Based on the governance rule reference information, it is determined whether the data access path corresponding to the tool node is configured with governance rules.

4. The data processing method according to claim 1, characterized in that, The controlled execution domain includes a proxy execution domain; the execution of each tool node according to the node dependencies determined by the task execution plan includes: When the data processing tool corresponding to the tool node is a web-based tool or an interface-based tool, a proxy access task corresponding to the data processing tool is generated based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. Based on the proxy access task, a mapping relationship between the user session and the target data resource side session is established in the proxy execution domain, and a controlled access address is assigned to the data processing tool; The proxy execution domain receives page requests, interface requests, or form submission requests initiated by the data processing tool based on the controlled access address. The page request, interface request, or form submission request is rewritten, encapsulated, or forwarded, and during the forwarding process, the tool-side identity token is replaced or converted into the target data resource-side access credentials to access the target data resource; The system receives the response data returned by the target data resource, processes the response data based on the governance rule reference information, and then returns the processed response data to the data processing tool or the next tool node in the task execution plan.

5. The data processing method according to claim 1, characterized in that, The controlled execution domain includes a remote graphics execution domain; the execution of each tool node according to the node dependencies determined by the task execution plan includes: When the data processing tool corresponding to the tool node is a graphical tool, a remote graphical execution task corresponding to the data processing tool is generated based on the input parameters associated with the tool node, the required authorization information, and the governance rule reference information. Based on the remote graphics execution task, an isolated remote graphics session is created in the remote graphics execution domain, and the remote graphics session is bound to at least one of the following: an authorized object, a target data resource, a session state, or a validity period. Assign temporary access credentials or temporary access tokens to the remote graphics session, enabling the graphics tools to access the target data resource within the remote graphics execution domain; The graphical interaction stream of the remote graphical session is provided to the user terminal so that the user terminal can operate the graphical tools through the graphical interaction stream; During the execution of the graphical tool, at least one of the following is collected from the remote graphical session: keyboard and mouse operations, page jumps, export operations, download requests, or session activity time. The collected results are then compared with the behavioral baseline corresponding to the graphical tool. Based on the comparison results, it is determined whether there is any risky behavior, and the execution results generated by the graphical tool are returned to the next tool node in the task execution plan or output as data processing results.

6. The data processing method according to claim 1, characterized in that, The governance processing of data access requests or returned results based on the governance rule reference information, and the risk monitoring of access requests, execution behaviors, or returned results of the data processing tools, include: Based on the governance rules corresponding to the governance rule reference information, at least one of the following is performed on the data access request or return result: authorization condition injection, row-level filtering, field desensitization, aggregation granularity restriction, query frequency restriction, or result perturbation processing; The data access requests initiated by the data processing tool are subjected to syntax parsing, request frequency statistics, access path identification, or sensitivity detection of return results to determine whether there is at least one risky behavior among unauthorized access, abnormal export, abnormal download, abnormal redirection, or over-frequency access.

7. The data processing method according to claim 1, characterized in that, The risk management information includes recovery strategies; Risk management and control are carried out based on the risk type corresponding to the risky behavior and the risk management information, including: In the event of authorization failure, authorization revocation, unauthorized access, or execution anomaly, at least one of the following actions shall be performed according to the reclaiming policy: session closure, token expiration, credential expiration, channel release, temporary file cleanup, or temporary task cancellation. Record at least one of the following: tool identifier of the data processing tool, authorized object, target data resource, task execution plan summary, governance rule version, request summary, response summary, risk behavior information or risk control result, and generate an audit record associated with the task execution plan.

8. A data processing apparatus, characterized in that, include: A generation module is used to respond to a received data processing request and generate a task execution plan based on the task information carried in the data processing request and at least one tool description object; wherein, the tool description object is used to describe the registered data processing tool and includes tool identifier, capability constraint information, protocol adaptation information, and risk control information; the task execution plan includes at least one tool node, and the tool node is associated with a corresponding data processing tool, input parameters, required authorization information, and governance rule reference information; The simulation module is used to simulate the execution of any tool node in an isolated pre-verification environment based on anonymized mirror data, and to verify the tool capabilities, access scope, and governance rule coverage status of the tool node according to the tool description object corresponding to the tool node, the required authorization information, and the governance rule reference information. A module is established to create a controlled execution domain that matches the tool form of the data processing tool, based on the protocol adaptation information, when the task execution plan passes verification. The controlled execution domain is used to carry or proxy the data processing tool's access to the target data resource and restrict the data processing tool's access to the target data resource to the controlled execution domain. The execution module is used to execute each tool node according to the node dependency relationship determined by the task execution plan, and to perform governance processing on data access requests or return results based on the governance rule reference information during the execution of the tool nodes, as well as to perform risk monitoring on the access requests, execution behavior or return results of the data processing tools; The control module is used to, upon detecting a risky behavior, perform at least one of the following risk control actions on the data processing tool, the controlled execution domain, or temporary resources associated with the tool node: access restriction, session interruption, access capability reclamation, temporary resource cleanup, or audit logs, based on the risk type corresponding to the risky behavior and the risk control information.

9. A computer device, characterized in that, include: A processor and a memory, the memory storing machine-readable instructions executable by the processor, the processor executing the machine-readable instructions stored in the memory, wherein when the machine-readable instructions are executed by the processor, the processor performs the steps of the data processing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer device, performs the steps of the data processing method as described in any one of claims 1 to 7.

Images