A data authority control method, device and equipment based on hierarchical management and control

Abstract

The application discloses a data authority control method and device based on hierarchical management and control. The method comprises the following steps: determining a target data calling interface and current identity authority data of a data calling party according to a data calling request of the data calling party; performing point cut matching on interface metadata of the target data calling interface according to a point cut matching rule, and performing white list verification on the interface metadata when the point cut matching is successful; if the interface metadata belongs to an authority white list, determining a current running state of a system according to current system running data of the system where the target data calling interface is located; determining to-be-verified parameters from the data calling request according to the current running state, an interface type and an interface authority annotation of the target data calling interface, and the current identity authority data; performing an unauthorized access verification on the to-be-verified parameters, and controlling the data calling request according to an unauthorized access verification result. The above scheme improves the efficiency and reliability of data authority control.

Description

Technical Field

[0001] This application relates to the field of security management technology, and more particularly to the field of data access control technology, specifically to a data access control method, apparatus, and device based on hierarchical control. Background Technology

[0002] Currently, interface-level data access control solutions are mainly divided into three categories: First, functional interface authentication solutions: used in personnel organization and access control systems to verify users' interface call permissions. These solutions only implement coarse-grained judgments on whether calls are allowed and cannot restrict the data range accessed by the interface. Hierarchical administrators can access all data as long as they have interface permissions, rendering control constraints completely ineffective and highlighting the risk of unauthorized access. Second, business code hard-coding verification solutions: data range filtering logic is directly written in the service implementation code of each business interface. Some improved solutions extract common verification methods to reduce duplicate code. Third, row-level data filtering solutions using database SQL interception: by setting a global interceptor in the data persistence layer, the SQL statement is dynamically rewritten before execution. The interceptor parses the current SQL statement, identifies the data tables involved, and automatically adds data filtering conditions to the conditional clauses of the SQL statement based on the current administrator's jurisdiction.

[0003] It is evident that while hard-coding achieves scope control over data permissions, it also brings problems such as high coupling, low efficiency, and uncontrollable quality. While database SQL achieves physical separation of permission logic and business code, its capabilities are limited to database query scenarios. Summary of the Invention

[0004] This application provides a data access control method, apparatus, and device based on hierarchical management to improve the efficiency and reliability of data access control.

[0005] According to one aspect of this application, a data access control method based on hierarchical management is provided, the method comprising: Based on the received data call request initiated by the data caller carrying an identity authentication token, determine the target data call interface and the current identity and permission data of the data caller; According to the preset point-cutting matching rules, point-cutting matching is performed on the interface metadata of the target data call interface, and if the point-cutting matching is successful, the interface metadata is verified by the interface whitelist. If the interface metadata is not in the interface permission whitelist, the current system operation data of the target system where the interface is located is called according to the target data to determine the current operating status of the target system; Based on the current running status, the interface type and interface permission comments of the target data call interface, and the current identity and permission data, determine the verification parameters of the data caller from the data call request; Unauthorized access is checked on the parameter to be verified to obtain the unauthorized access verification result, and the data call request is controlled based on the unauthorized access verification result.

[0006] According to another aspect of this application, a data access control device based on hierarchical management is provided, the device comprising: The data determination module is used to determine the target data call interface and the current identity and permission data of the data caller based on the data call request initiated by the data caller carrying an identity authentication token. The cut-point matching module is used to perform cut-point matching on the interface metadata of the target data call interface according to the preset cut-point matching rules, and to perform interface whitelist verification on the interface metadata if the cut-point matching is successful. The status determination module is used to determine the current operating status of the target system by calling the current system operation data of the target system where the interface is located, based on the target data, if the interface metadata does not belong to the interface permission whitelist. The parameter determination module is used to determine the parameters to be verified of the data caller from the data call request based on the current running status, the interface type and interface permission annotation of the target data call interface, and the current identity and permission data. The request control module is used to perform unauthorized access verification on the parameter to be verified, obtain the unauthorized access verification result, and control the data call request based on the unauthorized access verification result.

[0007] According to another aspect of this application, an electronic device is provided, the electronic device comprising: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement any of the hierarchical data access control methods provided in the embodiments of this application.

[0008] According to another aspect of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements any of the hierarchical data access control methods provided in the embodiments of this application.

[0009] According to another aspect of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements any of the hierarchical data access control methods provided in the embodiments of this application.

[0010] This application determines the target data call interface and the current identity and permission data of the data caller based on the data call request initiated by the data caller carrying an authentication token. According to preset point-matching rules, it performs point-matching on the interface metadata of the target data call interface, and if the point-matching is successful, it performs interface whitelist verification on the interface metadata. If the interface metadata is not on the interface permission whitelist, it determines the current operating status of the target system based on the current system operating data of the target system where the target data call interface is located. Based on the current operating status, the interface type and interface permission comments of the target data call interface, and the current identity and permission data, it determines the parameters to be verified of the data caller from the data call request. It then performs unauthorized access verification on the parameters to be verified, obtains the unauthorized access verification result, and controls the data call request based on the unauthorized access verification result. The above technical solution intercepts at the interface layer in advance, completing permission judgment before the business logic is executed. It provides a unified and non-intrusive access method for all business interfaces. Without writing any verification code, it can obtain complete data scope security protection. When adding control dimensions or adjusting rules, only the preset logic or configuration needs to be modified, without changing any business code. It completely eliminates the high coupling, low efficiency and uncontrollable quality problems caused by hard coding, and effectively improves the efficiency and reliability of data permission control. Attached Figure Description

[0011] Figure 1 This is a flowchart of a data access control method based on hierarchical management, according to Embodiment 1 of this application; Figure 2 This is a flowchart of a data access control method based on hierarchical management, according to Embodiment 2 of this application; Figure 3 This is a schematic diagram of a data access control device based on hierarchical management, provided in Embodiment 3 of this application; Figure 4 This is a schematic diagram of the structure of an electronic device that implements the hierarchical data access control method of Embodiment 4 of this application. Detailed Implementation

[0012] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0013] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0014] Furthermore, it should be noted that the collection, storage, use, processing, transmission, provision, and disclosure of data access requests and current identity and permission data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0015] Example 1 Figure 1 This is a flowchart of a data access control method based on hierarchical management, according to Embodiment 1 of this application. This embodiment is applicable to situations where access control is performed on data request requests from data callers. It can be executed by a data access control device based on hierarchical management, which can be implemented in hardware and / or software and can be configured in a computer device, such as a server. Figure 1 As shown, the method includes: S110. Based on the received data call request initiated by the data caller carrying an authentication token, determine the target data call interface and the current identity and permission data of the data caller.

[0016] In this context, "data caller" refers to the entity that initiates the data call request, which may include end users, other services, automated processes, etc., and is the triggering entity for data access behavior. "Identity authentication token" refers to a digital credential issued by a trusted identity provider to prove the holder's legitimacy. It typically contains identity information, validity period, and other information, possesses tamper-proof characteristics (such as cryptographic signatures), and serves as an access credential for accessing protected resources. "Data call request" refers to... "Target data call interface" refers to a pre-defined, standardized access endpoint in the system used to handle specific data type requests. It has a fixed access identifier, input / output data contract, and corresponding business logic, and is the final destination for data call request routing and matching. "Current identity and permission data" refers to data representing the caller's current identity and permission information, obtained through real-time parsing based on their identity.

[0017] For example, the data caller initiates a data call request carrying an identity authentication token. The system's unified identity authentication filter verifies the token's validity, parses the data interface that the caller needs to call for this data call, and the caller's identity information, and stores it in the local thread variable of the request thread.

[0018] S120. According to the preset point-cutting matching rules, perform point-cutting matching on the interface metadata of the target data call interface, and if the point-cutting matching is successful, perform interface whitelist verification on the interface metadata.

[0019] Among them, the cut-off point matching rule refers to the pre-configured feature comparison criteria used to determine whether an interface meets the access requirements. It typically includes the interface attribute dimensions to be matched, the expected values ​​of the corresponding attributes, or the verification logic. Interface metadata refers to a structured collection of information describing the attributes of the data call interface itself. It typically includes interface characteristic information such as the interface path, request method, parameter specifications, business domain, and version number. Interface whitelist verification refers to the verification process of comparing the identifier or attributes of the interface to be verified with a pre-configured list of allowed access interfaces to confirm whether the interface has access privileges.

[0020] For example, based on the preset point-matching rule algorithm, the interface metadata of the target data call interface is matched for point-matching. If the match is successful, it is determined whether the interface metadata belongs to the whitelist. If the match is successful and it is not in the whitelist, the interception is triggered and further permission verification is performed. If the match fails or it belongs to the whitelist, the data call request is directly allowed.

[0021] S130. If the interface metadata is not in the interface permission whitelist, then the current system running data of the target system where the interface is located is called according to the target data to determine the current running status of the target system.

[0022] The interface permission whitelist refers to a pre-configured list (or set) of allowed interface identifiers or attributes, used to determine whether an interface has access privileges. The target system refers to the overall hardware and software environment or service platform that hosts the target data call interface and provides data services. Current system operation data refers to the real-time operational status information of the target system at the moment of request processing, including but not limited to quantifiable or descriptive operational monitoring data such as load indicators, resource utilization, service health check results, version number, and configuration status. Current operational status refers to a discrete or categorical description reflecting the overall operational health or availability of the target system, derived from the current system operation data.

[0023] For example, if it is detected that the target call interface does not belong to the interface permission whitelist, the current system running data of the target system where the target data call interface is located is detected, such as cache availability, engine computing load, etc., and the current running status of the target system is determined, such as circuit breaker status.

[0024] S140. Based on the current running status, the interface type and interface permission comments of the target data call interface, and the current identity and permission data, determine the parameters to be verified of the data caller from the data call request.

[0025] Here, "interface type" refers to a classification attribute identifier used to distinguish the scope or purpose of data call interface services, and can include core interfaces and non-core interfaces. "Interface permission annotation" refers to permission requirement annotation information attached to the interface metadata, used to explain the access permission rules for that interface. "Parameters to be verified" refers to the set of parameters extracted from the data call request based on information such as the current running status, interface attributes, and caller permissions, used to determine whether the current request meets the access requirements.

[0026] Optionally, if the current running status is non-circuit-breaker state, or if the current running status is circuit-breaker state and the interface type of the target data call interface is a core interface type, then management permission identification is performed on the current identity and permission data; if the current identity and permission data belongs to hierarchical management permissions, then the parameters to be verified of the data caller are determined from the data call request based on the interface permission annotation of the target data call interface.

[0027] In this context, "non-circuit breaker state" refers to the target system's service status, where the circuit breaker protection mechanism has not been triggered and all compliant data call requests can be processed normally. "Circuit breaker state" refers to the target system's protection status, where the circuit breaker protection mechanism is triggered due to overload, failure, or other reasons, temporarily suspending the provision of non-core data call services. "Core interface type" refers to data call interfaces that carry the system's core business functions; interruptions or anomalies would directly affect the continuity of core business operations. These interfaces may retain call permissions even under circuit breaker conditions. "Hierarchical management permissions" refers to management permissions divided according to their scope and level, typically including multiple levels such as super administrator, first-level administrator, and second-level administrator, with different levels corresponding to different operation authorization scopes.

[0028] For example, the current system running status is detected. If a circuit breaker is triggered, a differentiated degradation strategy is executed according to the interface type. Core interface types are allowed, and the current user is further verified to have hierarchical administrator status. Non-core interfaces are directly denied access. If the current identity and permission data is not administrator-level, it is directly determined as an unauthorized access exception, the request is intercepted and audited. If the current identity and permission data is that of a legitimate administrator, the interface permission annotation of the target data call interface is used to determine the data caller's verification parameters from the data call request.

[0029] Furthermore, the interface permission annotation of the target data call interface is parsed to obtain the target permission verification strategy class and target data range verification parameters of the target data call interface; based on the target permission verification strategy class and target data range verification parameters, the parameters to be verified of the data caller are determined from the data call request.

[0030] The target permission verification strategy class refers to the configuration class / rule template obtained from the parsing of interface permission annotations, which encapsulates the target interface permission verification logic rules. It clearly defines the triggering conditions, comparison dimensions, verification algorithms, and exception handling rules for permission verification. For example, rules such as "it is necessary to verify whether the caller is an administrator of the department to which the data belongs" and "it is necessary to verify whether the caller's permission level is greater than or equal to level three" are encapsulated in this class. The target data range verification parameters refer to the specific set of parameters obtained from the parsing of interface permission annotations, which clearly define the data boundaries that the target interface is allowed to access. They are used to limit the scope of operable and queryable data calls and typically include the allowed data time interval, the allowed business domain, the upper limit of the allowed data sensitivity level, and the scope of the data ownership subject that is allowed to be operated on.

[0031] S150. Perform unauthorized access verification on the parameter to be verified, obtain the unauthorized access verification result, and control data call requests based on the unauthorized access verification result.

[0032] Unauthorized access verification refers to a compliance verification process based on predefined permission rules. It compares the parameters to be verified with the target permission verification policy class (defining the verification logic) and the target data range verification parameters (defining the allowed boundaries) to determine whether the data operation involved in the current request by the data caller exceeds its authorized permission scope. The unauthorized access verification result refers to the output conclusion of the unauthorized access verification process, typically including a binary status of verification passed / failed.

[0033] In one optional implementation, during the aforementioned steps, if the current running status is a circuit breaker state or the current identity and permission data does not belong to the hierarchical management permissions, the current request process is terminated, and the business logic no longer continues to execute; standardized audit information is automatically collected, such as hierarchical administrator identifier, request interface URL, request timestamp, client IP, control dimension, target data ID, judgment result, etc.; the audit data is delivered to the asynchronous thread queue and written in batches to the audit log storage system; if the storage system is temporarily unavailable, it is temporarily stored in a local disk file and re-uploaded after recovery; standardized error responses (unified error codes, user-friendly prompts) are encapsulated according to the platform's unified specifications and returned to the caller.

[0034] This application embodiment determines the target data call interface and the current identity and permission data of the data caller based on the received data call request initiated by the data caller carrying an identity authentication token; performs point-matching on the interface metadata of the target data call interface according to preset point-matching rules, and performs interface whitelist verification on the interface metadata if the point-matching is successful; if the interface metadata does not belong to the interface permission whitelist, determines the current running status of the target system based on the current system running data of the target system where the target data call interface is located; determines the data caller's parameters to be verified from the data call request based on the current running status, the interface type and interface permission comments of the target data call interface, and the current identity and permission data; performs unauthorized access verification on the parameters to be verified, obtains the unauthorized access verification result, and controls the data call request based on the unauthorized access verification result. The above technical solution intercepts at the interface layer in advance, completing permission judgment before the business logic is executed. It provides a unified and non-intrusive access method for all business interfaces. Without writing any verification code, it can obtain complete data scope security protection. When adding control dimensions or adjusting rules, only the preset logic or configuration needs to be modified, without changing any business code. It completely eliminates the high coupling, low efficiency and uncontrollable quality problems caused by hard coding, and effectively improves the efficiency and reliability of data permission control.

[0035] Example 2 Figure 2This is a flowchart of a data access control method based on hierarchical management, according to Embodiment 2 of this application. Based on the technical solutions of the above embodiments, this embodiment refines "performing unauthorized access verification on the parameter to be verified and obtaining the unauthorized access verification result" into "based on the current Euler circuit tree cache data of the target system, performing tree-shaped data range judgment on the parameter to be verified and obtaining the tree-shaped data range judgment result; and / or, based on the current Bloom filter of the target system, performing discrete list data range judgment on the parameter to be verified and obtaining the discrete list data range judgment result; wherein, the current Bloom filter is based on a preset authorization list and is constructed using multiple bit arrays and multiple independent hash functions; the unauthorized access verification result is determined based on the tree data range judgment result and / or the discrete list data range judgment result." It should be noted that for parts not detailed in this embodiment, please refer to the relevant descriptions in other embodiments. Figure 2 As shown, the method includes: S210. Based on the received data call request initiated by the data caller carrying an identity authentication token, determine the target data call interface and the current identity and permission data of the data caller.

[0036] S220. According to the preset point-cutting matching rules, perform point-cutting matching on the interface metadata of the target data call interface, and if the point-cutting matching is successful, perform interface whitelist verification on the interface metadata.

[0037] S230. If the interface metadata is not in the interface permission whitelist, then the current system running data of the target system where the interface is located is called according to the target data to determine the current running status of the target system.

[0038] S240. Based on the current running status, the interface type and interface permission comments of the target data call interface, and the current identity and permission data, determine the parameters to be verified of the data caller from the data call request.

[0039] S250. Based on the current Euler circuit tree cache data of the target system, perform tree data range judgment on the parameter to be verified, and obtain the tree data range judgment result.

[0040] The current Euler circuit tree cache data refers to the cached data in the target system, constructed using the "Eulerian circuit" rule, forming a tree structure. This cached data is used to quickly provide the tree-based range reference required for verification. Tree-based data range determination refers to determining, based on the structure of the Euler circuit tree cache data, whether the parameter to be verified falls within the node range, path range, or level range covered by the tree structure, thus confirming the parameter's validity and compliance. The tree-based data range determination result refers to the conclusion obtained through the tree-based data range determination.

[0041] Optionally, determine the permission start identifier and permission end identifier of each preconfigured target reference node in the current Euler circuit tree according to the current Euler circuit tree cache data of the target system; determine the target parameter interval of the target reference node according to the permission start identifier and the permission end identifier; determine whether the parameter to be verified is located in any target parameter interval, and obtain a tree data range judgment result.

[0042] Wherein, the target reference node refers to a selected node in the Euler circuit tree (usually corresponding to a certain vertex in the original graph or a representative point of the Euler interval corresponding thereto), and this node is preselected by a superior administrator for a hierarchical administrator through a visual interface. The permission start identifier refers to a value or mark associated with the target reference node, indicating the lower bound (minimum allowable value) of the permission range owned by this node. The permission end identifier refers to another value or mark associated with the target reference node, indicating the upper bound (maximum allowable value) of the permission range owned by this node. The target parameter interval refers to a closed interval jointly determined by the permission start identifier and the permission end identifier, and this interval represents the "allowable parameter value range" corresponding to the reference node.

[0043] Further, perform numerical comparison between the parameter value corresponding to the parameter to be verified and each target parameter interval respectively, and if there exists a target parameter interval that contains the parameter value corresponding to the parameter to be verified, determine that the request is authorized, otherwise determine that the request is unauthorized; or, take the permission start identifier of the target parameter interval as a reference, sort each target parameter interval in ascending order, deduplicate and splice each interval to obtain a complete interval, and use a binary search method to determine whether this interval contains the parameter value corresponding to the parameter to be verified, and if it is contained, determine that the request is authorized, otherwise determine that the request is unauthorized.

[0044] It can be understood that, in addition to performing judgment for each interval respectively, each interval can also be integrated, so that the judgment can be completed with only one comparison, which improves the judgment efficiency.

[0045] Exemplarily, the Euler circuit tree records two event serial numbers for each node by performing a depth-first search (DFS) on the tree structure: an Enter(u) event and an Exit(u) event. According to the property of DFS, for any two nodes A and B, the necessary and sufficient condition for A to be an ancestor node of B (that is, B is located in the range of the subtree of A) is: Enter(A)<=Enter(B)<Exit(A), that is, the Enter event of B is after the Enter event of A and before the Exit event of A, and the entire life cycle of B is completely contained in the life cycle interval of A; in the permission management and control scenario of this solution, all tree-shaped data nodes are converted into a set of interval sets R={[Enter(n1),Exit(n1)],[Enter(n2),Exit(n2)],...,[Enter(n k), Exit(n k )]}, where k is the number of reference nodes checked by the administrator. When performing permission judgment on the target node x, it is only necessary to judge whether there exists at least one interval [L, R] ∈ R such that L <= Enter(x) < R. If such an interval exists, it is determined that the user has permission; otherwise, it is determined that the user is unauthorized. Meanwhile, to improve the efficiency of interval query, all jurisdiction intervals are sorted in ascending order by the left endpoint, and overlapping intervals are deduplicated and merged. Binary search is used to locate the interval where the target timestamp may fall, and the judgment can be completed with only one comparison.

[0046] It should be noted that the time complexity of binary search is O(logk), where k is the number of reference nodes under the jurisdiction of the administrator. Since the number of reference nodes checked by the administrator in actual services is far less than the total number of nodes, this complexity is close to the constant level O(1), independent of the total depth of the tree, which completely solves the performance bottleneck of deep-level organization trees.

[0047] S260, and / or, based on the current Bloom filter of the target system, perform discrete list data range judgment on the parameter to be verified, to obtain a discrete list data range judgment result; wherein the current Bloom filter is constructed based on a preset authorization list through a plurality of bit arrays and a plurality of independent hash functions.

[0048] The current Bloom filter refers to the core verification component deployed in the target system and in operation. It uses a pre-defined authorization list as its data source and is constructed using multiple arrays and independent hash functions to quickly determine whether a parameter to be verified belongs to a discrete authorization set. The discrete list data range judgment refers to the verification logic based on the Bloom filter. Here, the data range is not a continuous numerical interval, but a pre-configured set of non-continuous, discrete authorization parameters. This judgment process determines whether the parameter to be verified belongs to this discrete authorization set. The discrete list data range judgment result refers to the output conclusion of the above judgment logic, typically including two categories: absolutely not in the authorization list (Bloom filters have no false negatives, this conclusion is 100% accurate); possibly in the authorization list (there is a possibility of false positives due to hash collisions, requiring further verification). The pre-defined authorization list refers to the original data source for constructing the Bloom filter. It is a pre-configured set of all allowed discrete parameters (such as a whitelist of users, a list of allowed resource codes, a set of legitimate request identifiers, etc.). Parameters not in this list are not allowed by default. The bit array is the core storage structure of a Bloom filter, consisting of several binary bits initially all set to 0, arranged sequentially. Each bit corresponds to a hash mapping slot, used to indicate whether the corresponding position of the parameter is set to 1 after the hash function calculation. Independent hash functions are the core computational components of a Bloom filter, referring to multiple hash algorithms with non-overlapping mapping rules and output ranges. The same parameter to be verified will yield different hash values ​​after being calculated by different independent hash functions, used to map the parameter to different positions in the bit array, reducing the probability of hash collisions.

[0049] It should be noted that the current Eulerian circuit tree cache data and the current Bloom filter in this application are determined by the superior administrator after configuring the jurisdiction of the hierarchical administrators through the visual interface in the management backend. After receiving the configuration data from the superior administrator, the system performs legality verification and deduplication, writes the structured data permission rules into the database for persistent storage, and triggers message change notification to update the cache. During the cache update process, the organization / menu tree data recalculates the Eulerian circuit tree event sequence number to obtain the current Eulerian circuit tree cache data, and the discrete list data reconstructs the Bloom filter bit array to obtain the current Bloom filter.

[0050] Optionally, the parameter to be verified is mapped to the bit array of the current Bloom filter using the independent hash function of the current Bloom filter of the target system. The parameter value of each parameter in the bit array is obtained, and the parameter value of the parameter to be verified is determined to be within the preset authorization list. If so, the parameter misclassification rate of the parameter to be verified is determined based on the number of bit arrays and independent hash functions of the current Bloom filter, as well as the number of parameters of the parameter to be verified. The number of bit arrays and independent hash functions are determined by the misclassification rate threshold and the preset number of parameters. If the parameter misclassification rate is greater than the misclassification rate threshold, the ordered list metadata corresponding to the preset authorization list is obtained, and the parameter to be verified is queried to determine whether it is within the ordered list metadata, thus obtaining the discrete list data range judgment result.

[0051] Here, the parameter value refers to the integer hash value obtained after the parameter to be verified is calculated by an independent hash function, and then the value of the corresponding position in the bit array to be checked is obtained by taking the modulo of the bit array length (or other mapping method). It is generally 0 or 1. The number of bit arrays refers to the total number of binary bits in the bit array. The number of independent hash functions refers to the number of hash functions used for mapping. The parameter false positive rate refers to the probability of false positives that the Bloom filter may produce. The false positive rate threshold refers to the maximum false positive probability that the system can tolerate, which is preset according to the actual situation or experience. The preset number of parameters refers to... The ordered list metadata refers to the metadata (including minimum value, maximum value, segment index, hash bucket, etc.) stored using the ordered structure of the preset authorization list itself, so as to perform accurate binary search or range search on the ordered structure. This ordered list metadata is configured accordingly when setting the authorization list.

[0052] For example, a Bloom filter consists of a bit array of length m and k independent hash functions. For any element x in set A, during insertion, it is mapped to k positions in the bit array using the k hash functions, and all these positions are set to 1. During querying, the k hash positions of element y are calculated. If any position is 0, then y is definitely not in A; if all are 1, then y may be in A (false positives are possible). The formula for calculating the false positive rate p is: , where n is the number of elements in set A. Given the expected false positive rate p and the number of elements n, the optimal bit array length m and the optimal number of hash functions k are respectively: and The above formula guarantees optimal filtering performance under given memory constraints. In the discrete permission verification scenario of this scheme, a Bloom filter is independently generated for each administrator's discrete authorization list, and a precise ordered ID set is stored as a secondary verification benchmark. The verification process is as follows: Pre-screening stage: The target ID is input into the Bloom filter. If it returns "not found", it is directly determined as unauthorized access, and the verification is terminated. Precise verification stage: If the Bloom filter returns "may exist", a binary search is performed in the ordered ID set to perform a precise match. If the match is successful, it is determined that the user has permission; otherwise, it is determined as unauthorized access.

[0053] It should be noted that, based on the actual situation, this application selects two sets of judgment logics for execution. For example, for users, positions and roles attached to the organization tree and the menu tree, two sets of judgment logics are executed in parallel: on the one hand, the tree node to which the data is attached is determined by the Eulerian circuit tree interval check to determine whether it is within the administrator's jurisdiction; on the other hand, the data ID is determined by Bloom pre-screening + exact set check to determine whether it is in the discrete authorization list. Access is allowed as soon as either condition is met.

[0054] S270. Based on the results of the tree-structured data range judgment and / or the discrete list data range judgment, determine the unauthorized access verification result, and control data call requests based on the unauthorized access verification result.

[0055] This application embodiment determines the target data call interface and the current identity and permission data of the data caller based on the received data call request initiated by the data caller carrying an identity authentication token; according to the preset point-matching rules, the interface metadata of the target data call interface is matched for point-matching, and if the point-matching is successful, the interface metadata is verified for interface whitelist; if the interface metadata does not belong to the interface permission whitelist, the current running status of the target system is determined based on the current system running data of the target system where the target data call interface is located; based on the current running status, the interface type and interface permission comments of the target data call interface, and the current identity and permission data... The system determines the parameters to be verified from the data call request; based on the target system's current Euler circuit tree cache data, it performs a tree-based data range judgment on the parameters to be verified, obtaining the tree-based data range judgment result; and / or, based on the target system's current Bloom filter, it performs a discrete list data range judgment on the parameters to be verified, obtaining the discrete list data range judgment result; wherein, the current Bloom filter is based on a preset authorization list and is constructed using multiple bit arrays and multiple independent hash functions; based on the tree-based data range judgment result and / or the discrete list data range judgment result, it determines the unauthorized access verification result, and controls the data call request based on the unauthorized access verification result. This technical solution intercepts requests at the interface layer before business logic execution, providing a unified, non-intrusive access method for all business interfaces. It achieves complete data range security protection without requiring any verification code, and when adding control dimensions or adjusting rules, only the preset logic or configuration needs to be modified, without altering any business code. This completely eliminates the high coupling, low efficiency, and uncontrollable quality problems caused by hard-coding methods, effectively improving the efficiency and reliability of data permission control.

[0056] Example 3 Figure 3 This is a schematic diagram of a data access control device based on hierarchical management, provided in Embodiment 3 of this application. It is applicable to situations where access control is performed on data request requests from data callers. This hierarchical data access control device can be implemented in hardware and / or software and can be configured in computer equipment, such as a server. Figure 3 As shown, the device includes: The data determination module 310 is used to determine the target data call interface and the current identity and permission data of the data caller based on the data call request initiated by the data caller carrying an identity authentication token. The cut-point matching module 320 is used to perform cut-point matching on the interface metadata of the target data calling interface according to the preset cut-point matching rules, and to perform interface whitelist verification on the interface metadata if the cut-point matching is successful. The status determination module 330 is used to determine the current running status of the target system by calling the current system running data of the target system where the interface is located, if the interface metadata does not belong to the interface permission whitelist. The parameter determination module 340 is used to determine the parameters to be verified by the data caller from the data call request based on the current running status, the interface type and interface permission comments of the target data call interface, and the current identity and permission data. The request control module 350 is used to perform unauthorized access verification on the parameters to be verified, obtain the unauthorized access verification result, and control data call requests based on the unauthorized access verification result.

[0057] This application embodiment determines the target data call interface and the current identity and permission data of the data caller based on the received data call request initiated by the data caller carrying an identity authentication token; performs point-matching on the interface metadata of the target data call interface according to preset point-matching rules, and performs interface whitelist verification on the interface metadata if the point-matching is successful; if the interface metadata does not belong to the interface permission whitelist, determines the current running status of the target system based on the current system running data of the target system where the target data call interface is located; determines the data caller's parameters to be verified from the data call request based on the current running status, the interface type and interface permission comments of the target data call interface, and the current identity and permission data; performs unauthorized access verification on the parameters to be verified, obtains the unauthorized access verification result, and controls the data call request based on the unauthorized access verification result. The above technical solution intercepts at the interface layer in advance, completing permission judgment before the business logic is executed. It provides a unified and non-intrusive access method for all business interfaces. Without writing any verification code, it can obtain complete data scope security protection. When adding control dimensions or adjusting rules, only the preset logic or configuration needs to be modified, without changing any business code. It completely eliminates the high coupling, low efficiency and uncontrollable quality problems caused by hard coding, and effectively improves the efficiency and reliability of data permission control.

[0058] Optionally, the request control module 350 includes: The tree-based judgment unit is used to determine the range of tree data for the parameter to be verified based on the current Euler circuit tree cache data of the target system, and obtain the result of the tree-based data range judgment. The discrete list judgment unit is used to judge the discrete list data range of the parameters to be verified based on the current Bloom filter of the target system, and obtain the discrete list data range judgment result; wherein, the current Bloom filter is based on a preset authorization list and is composed of multiple bit arrays and multiple independent hash functions; The verification result integration unit is used to determine the unauthorized access verification result based on the tree data range judgment result and / or the discrete list data range judgment result.

[0059] Optional, tree-structured decision unit, specifically used for: Based on the current Eulerian circuit tree cache data of the target system, determine the permission start and permission end identifiers of each pre-configured target baseline node in the current Eulerian circuit tree; The target parameter range of the target baseline node is determined based on the permission start identifier and permission end identifier; Determine whether the parameter to be verified is within any target parameter range to obtain the tree-structured data range judgment result.

[0060] Optional, discrete list judgment unit, specifically used for: By using the independent hash function of the current Bloom filter of the target system, the parameter to be verified is mapped to the bit array of the current Bloom filter to obtain the parameter value of each parameter in the bit array, and based on the parameter value of the parameter to be verified, it is determined whether the parameter to be verified is within the preset authorization list. If so, the false positive rate of the parameter to be verified is determined based on the number of bit arrays and independent hash functions in the current Bloom filter, as well as the number of parameters to be verified; where the number of bit arrays and independent hash functions are determined by the false positive rate threshold and the preset number of parameters. If the parameter misjudgment rate is greater than the misjudgment rate threshold, the ordered list metadata corresponding to the preset authorization list is obtained, and the parameter to be verified is queried to determine whether it is within the ordered list metadata, thus obtaining the discrete list data range judgment result.

[0061] Optionally, the parameter determination module 340 includes: The permission identification unit is used to identify the management permissions of the current identity and permission data if the current running state is non-circuit-breaker state, or if the current running state is circuit-breaker state and the interface type of the target data call interface is a core interface type. The parameter determination unit is used to determine the parameters to be verified from the data caller's request based on the interface permission annotation of the target data call interface if the current identity and permission data belongs to hierarchical management permissions.

[0062] Optional, parameter determination unit, specifically used for: Parse the interface permission annotations of the target data call interface to obtain the target permission verification strategy class and target data range verification parameters of the target data call interface; Based on the target permission verification strategy class and the target data range verification parameters, determine the parameters to be verified from the data caller in the data call request.

[0063] The data access control device based on hierarchical management provided in this application can execute the data access control method based on hierarchical management provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects for executing each data access control method based on hierarchical management.

[0064] According to embodiments of this application, this application also provides an electronic device, a readable storage medium, and a computer program product.

[0065] Example 4 Figure 4 This is a schematic diagram of the structure of an electronic device 410 implementing the hierarchical data access control method according to embodiments of this application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0066] like Figure 4 As shown, the electronic device 410 includes at least one processor 411 and a memory, such as a read-only memory (ROM) 412 or a random access memory (RAM) 413, communicatively connected to the at least one processor 411. The memory stores computer programs executable by the at least one processor. The processor 411 can perform various appropriate actions and processes based on the computer program stored in the ROM 412 or loaded from storage unit 418 into the RAM 413. The RAM 413 may also store various programs and data required for the operation of the electronic device 410. The processor 411, ROM 412, and RAM 413 are interconnected via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0067] Multiple components in electronic device 410 are connected to I / O interface 415, including: input unit 416, such as keyboard, mouse, etc.; output unit 417, such as various types of displays, speakers, etc.; storage unit 418, such as disk, optical disk, etc.; and communication unit 419, such as network card, modem, wireless transceiver, etc. Communication unit 419 allows electronic device 410 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0068] Processor 411 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 411 performs the various methods and processes described above, such as hierarchical data access control methods.

[0069] In some embodiments, the hierarchical data access control method can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 418. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 410 via ROM 412 and / or communication unit 419. When the computer program is loaded into RAM 413 and executed by processor 411, one or more steps of the hierarchical data access control method described above can be performed. Alternatively, in other embodiments, processor 411 can be configured for the hierarchical data access control method by any other suitable means (e.g., by means of firmware).

[0070] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0071] Computer programs used to implement the methods of this application may be written in any combination of one or more programming languages. These computer programs may be provided to the processor of a general-purpose computer, a special-purpose computer, or other programmable data access control device based on hierarchical management, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0072] In the context of this application, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0073] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0074] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0075] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0076] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this application can be achieved, and this is not limited herein.

[0077] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A data access control method based on hierarchical management, characterized in that, include: Based on the received data call request initiated by the data caller carrying an identity authentication token, determine the target data call interface and the current identity and permission data of the data caller; According to the preset point-cutting matching rules, point-cutting matching is performed on the interface metadata of the target data call interface, and if the point-cutting matching is successful, the interface metadata is verified by the interface whitelist. If the interface metadata is not in the interface permission whitelist, the current system operation data of the target system where the interface is located is called according to the target data to determine the current operating status of the target system; Based on the current running status, the interface type and interface permission comments of the target data call interface, and the current identity and permission data, determine the verification parameters of the data caller from the data call request; Unauthorized access is checked on the parameter to be verified to obtain the unauthorized access verification result, and the data call request is controlled based on the unauthorized access verification result.

2. The method according to claim 1, characterized in that, Perform unauthorized access verification on the parameter to be verified, and obtain the unauthorized access verification result, including: Based on the current Euler circuit tree cache data of the target system, the tree data range of the parameter to be verified is determined, and the tree data range determination result is obtained. And / or, based on the current Bloom filter of the target system, perform discrete list data range judgment on the parameter to be verified to obtain discrete list data range judgment result; wherein, the current Bloom filter is based on a preset authorization list and is composed of multiple bit arrays and multiple independent hash functions; The unauthorized access verification result is determined based on the results of the tree-shaped data range judgment and / or the results of the discrete list data range judgment.

3. The method according to claim 2, characterized in that, The step of determining the tree data range of the parameter to be verified based on the current Euler circuit tree cache data of the target system, and obtaining the tree data range determination result, includes: Based on the current Eulerian circuit tree cache data of the target system, determine the permission start identifier and permission end identifier of each pre-configured target reference node in the current Eulerian circuit tree; The target parameter range of the target baseline node is determined based on the permission start identifier and the permission end identifier; Determine whether the parameter to be verified is located within any of the target parameter intervals to obtain the tree data range determination result.

4. The method according to claim 2, characterized in that, The current Bloom filter based on the target system performs a discrete list data range determination on the parameter to be verified, and obtains the discrete list data range determination result, including: The parameter to be verified is mapped to the bit array of the current Bloom filter using the independent hash function of the target system, so as to obtain the parameter value of each parameter in the bit array. Based on the parameter value of the parameter to be verified, it is determined whether the parameter to be verified is in the preset authorization list. If so, the false positive rate of the parameter to be verified is determined based on the number of bit arrays and the number of independent hash functions in the current Bloom filter, as well as the number of parameters of the parameter to be verified; wherein, the number of bit arrays and the number of independent hash functions are determined by the false positive rate threshold and the preset number of parameters; If the misjudgment rate of the parameter is greater than the misjudgment rate threshold, then the ordered list metadata corresponding to the preset authorization list is obtained, and the parameter to be verified is queried as being within the ordered list metadata to obtain the discrete list data range judgment result.

5. The method according to claim 1, characterized in that, The step of determining the verification parameters of the data caller from the data call request based on the current running status, the interface type and interface permission comments of the target data call interface, and the current identity and permission data includes: If the current running state is a non-circuit-breaker state, or if the current running state is a circuit-breaker state and the interface type of the target data call interface is a core interface type, then the management permission identification is performed on the current identity and permission data. If the current identity and permission data belongs to hierarchical management permissions, then the parameters to be verified of the data caller are determined from the data call request based on the interface permission annotation of the target data call interface.

6. The method according to claim 5, characterized in that, Based on the interface permission annotation of the target data call interface, determine the verification parameters of the data caller from the data call request, including: The interface permission annotation of the target data call interface is parsed to obtain the target permission verification strategy class and target data range verification parameters of the target data call interface; Based on the target permission verification strategy class and the target data range verification parameters, the parameters to be verified for the data caller are determined from the data call request.

7. A data access control device based on hierarchical management, characterized in that, include: The data determination module is used to determine the target data call interface and the current identity and permission data of the data caller based on the data call request initiated by the data caller carrying an identity authentication token. The cut-point matching module is used to perform cut-point matching on the interface metadata of the target data call interface according to the preset cut-point matching rules, and to perform interface whitelist verification on the interface metadata if the cut-point matching is successful. The status determination module is used to determine the current operating status of the target system by calling the current system operation data of the target system where the interface is located, based on the target data, if the interface metadata does not belong to the interface permission whitelist. The parameter determination module is used to determine the parameters to be verified of the data caller from the data call request based on the current running status, the interface type and interface permission annotation of the target data call interface, and the current identity and permission data. The request control module is used to perform unauthorized access verification on the parameter to be verified, obtain the unauthorized access verification result, and control the data call request based on the unauthorized access verification result.

8. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the data access control method based on hierarchical management as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the data access control method based on hierarchical management as described in any one of claims 1-6.

10. A computer program product comprising a computer program that, when executed by a processor, implements the data access control method based on hierarchical management according to any one of claims 1-6.

Images