Data processing method and apparatus, computer, storage medium, and program product

Abstract

Embodiments of the present application relate to the field of computers. Disclosed are a data processing method and apparatus, a computer, a storage medium, and a program product. The method is applied to a trusted third-party object, and comprises: acquiring a first service processing request sent by a first service object, and determining a first access database on the basis of the first service processing request; acquiring first permission information associated with the first access database, creating a second access database on the basis of the first permission information and the first access database, and updating the first service processing request to a second service processing request on the basis of the second access database; and executing the second service processing request for the second access database to obtain service request data, and sending a request result for the first service processing request to the first service object on the basis of the service request data. The use of the present application can reduce the resource overhead and improve the computing efficiency while data security computing of all parties is ensured.

Description

Data processing method and device, computer, storage medium and program product

[0001] The present application claims priority to the Chinese patent application No. 202411105867.3, filed on August 13, 2024, and entitled "Data processing method, device, computer, storage medium and program product", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the technical field of computers, and in particular to a data processing method, device, computer, storage medium and program product. BACKGROUND

[0003] In advertising, finance and other scenarios, multiple parties (usually two parties) need to combine their respective data for analysis, but due to legal regulations, commercial competition and other factors, data forms a data island in different entities, organizations and companies. When one party needs the data of another party for calculation and analysis, the other party cannot directly display the data. In order to promote the circulation and cooperation of data elements of various parties, various data security calculation technologies have been developed, for example, through federated learning, joint analysis, creation of data closed domain or data clean room. However, the privacy calculation scheme through federated learning and joint analysis mostly relies on homomorphic encryption with large calculation overhead or multi-party secure computation with large communication overhead, and the overall efficiency is not high when the data size is large. Through the creation of a data closed domain, each calculation needs to move the data of each party to a closed and isolated space, which has a large moving overhead. SUMMARY

[0004] The embodiments of the present application provide a data processing method, device, computer, storage medium and program product, which can reduce resource overhead and improve calculation efficiency under the premise of ensuring data security calculation of each party.

[0005] In an aspect, the embodiments of the present application provide a data processing method applied to a trusted third party object, which comprises:

[0006] Obtaining a first business processing request sent by a first business object, determining a first access database based on the first business processing request;

[0007] Obtaining first permission information associated with the first access database, creating a second access database based on the first permission information and the first access database, and updating the first business processing request to a second business processing request based on the second access database;

[0008] The second business processing request is executed on the second access database to obtain business request data, and a request result of the first business processing request is sent to the first business object based on the business request data.

[0009] The embodiment of the application provides a data processing device, which comprises:

[0010] The request obtaining module is configured to obtain the first business processing request sent by the first business object, and determine the first access database based on the first business processing request.

[0011] The data updating module is configured to obtain the first permission information associated with the first access database, create the second access database based on the first permission information and the first access database, and update the first business processing request into the second business processing request based on the second access database.

[0012] The data executing module is configured to execute the second business processing request on the second access database to obtain business request data, and send a request result of the first business processing request to the first business object based on the business request data.

[0013] The embodiment of the application provides a computer device, which comprises a processor, a memory and an input / output interface.

[0014] The processor is connected with the memory and the input / output interface, wherein the input / output interface is configured to receive and output data, the memory is configured to store a computer program, and the processor is configured to call the computer program so that the computer device comprising the processor executes the method in the embodiment of the application.

[0015] The embodiment of the application provides a computer readable storage medium, which stores a computer program, and the computer program is suitable for being loaded and executed by a processor so that a computer device comprising the processor executes the method in the embodiment of the application.

[0016] The embodiment of the application provides a computer program product or a computer program, which comprises computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions so that the computer device executes the method provided in various optional manners in the embodiment of the application. In other words, the computer instructions are executed by the processor to realize the method provided in various optional manners in the embodiment of the application.

[0017] The embodiment of the application is implemented to have the following beneficial effects:

[0018] In the embodiment of the present application, a first service processing request sent by a first service object is acquired, a first access database is determined based on the first service processing request, first permission information associated with the first access database is acquired, a second access database is created based on the first permission information and the first access database, the first service processing request is updated into a second service processing request based on the second access database, the second service processing request is executed for the second access database, service request data is obtained, and a request result for the first service processing request is sent to the first service object based on the service request data. Through the above process, the computing resources provided by the trusted third party object are fully utilized, the first service object processes the first service processing request involving data of each party, the first permission information is used to limit the use range of the data to prevent data leakage, the security calculation is performed, the first service object does not need to prepare, configure and maintain the computing resources by itself, the resource overhead of the first service object is reduced, and the cryptography with large use overhead or the multi-party secure calculation with large communication overhead is not needed, so that the calculation efficiency can be ensured even when the data scale is large. BRIEF DESCRIPTION OF DRAWINGS

[0019] FIG. 1 is a network interaction architecture diagram provided by an embodiment of the present application;

[0020] FIG. 2 is a scene diagram of a data processing method provided by an embodiment of the present application;

[0021] FIG. 3 is a flowchart of a data processing method provided by an embodiment of the present application;

[0022] FIG. 4 is a scene diagram of creating a cooperation space provided by an embodiment of the present application;

[0023] FIG. 5 is a flowchart of a data processing method provided by an embodiment of the present application;

[0024] FIG. 6 is a service processing flowchart provided by an embodiment of the present application;

[0025] FIG. 7 is a schematic diagram of a data processing apparatus provided by an embodiment of the present application;

[0026] FIG. 8 is a structural schematic diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0028] If object data (such as user data) needs to be collected in the present application, a prompt interface or pop-up window is displayed before and during collection, prompting the user that certain data is currently being collected. Only after obtaining the user's confirmation operation on the prompt interface or pop-up window, the relevant steps of data acquisition are started, otherwise it is ended. Moreover, the obtained user data will be used in reasonable and legal scenarios or purposes. Optionally, in some scenarios where user data is needed but not authorized by the user, the user can be requested for authorization, and the user data can be used again when the authorization is passed.

[0029] It can be understood that in the specific embodiments of the present application, when the following embodiments of the present application are applied to specific products or technologies, the user data involved needs to obtain the user's permission or consent, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards in the relevant region.

[0030] Structured Query Language (SQL): a specific purpose programming language for managing a relational database management system, or for stream processing in a relational stream data management system.

[0031] In the embodiments of the present application, please refer to FIG. 1, which is a network interaction architecture diagram provided by the embodiments of the present application, as shown in FIG. 1, the network interaction architecture diagram can include a computer device 101 and a service device cluster, the service device cluster can include a service device 102a, a service device 102b, a service device 102c, …, a service device 102n, wherein the service device cluster can exist communication connection between them, for example, the service device 102a and the service device 102b exist communication connection, the service device 102a and the service device 102c exist communication connection. At the same time, any service device in the service device cluster can exist communication connection with the computer device 101, for example, the service device 102a and the computer device 101 exist communication connection, wherein the above communication connection is not limited to the connection mode, can be connected directly or indirectly through wired communication mode, can also be connected directly or indirectly through wireless communication mode, can also be connected through other ways, the present application does not limit here.

[0032] It should be understood that each of the business devices in the business device cluster shown in FIG. 1 can belong to different business objects, or multiple business devices can belong to the same business object, for example, business device 102a and business device 102b belong to business object A, business device 102c belongs to business object B, and business device 102n belongs to business object C. The computer device 101 can belong to a trusted third-party object, and each business device can install an application client provided by the trusted third-party object. When the application client runs in each business device, each business device can interact with the computer device 101 shown in FIG. 1 through the application client, so that the computer device 101 can receive business data from each business device. The application client can be a standalone client or an embedded sub-client integrated in a certain client (such as an instant messaging client, a social client, a browser client, etc.), which is not limited here.

[0033] The computer device shown in FIG. 1 can be a computing resource (that is, a computer machine) provided by a trusted third-party object for each business object corresponding to each business device, for computing business processing requests. Each business object can store its own business data to a cloud server provided by the trusted third-party object, and upload data usage permissions (that is, permission information) for its own business data. The computer device can create a cooperation space for business objects that have cooperation needs, and by accessing the cooperation space, the stored data of different business objects can be called to perform joint computing. The cooperation space is a logical concept and does not require a real physically isolated computer machine to implement. The permission information of the business object is used to represent the restriction condition when the business object provides its own business data to other business objects.

[0034] Specifically, taking the business device 102b corresponding to the first business object (which can be any business object) as an example, the first business object can be the initiator of the computing task. The computer device 101 can obtain the first business processing request sent by the business device 102b, determine the first access database indicated by the first business processing request, obtain the first permission information associated with the first access database, create a second access database (i.e., the data content that the computer device 101 has access to) based on the first permission information and the first access database, update the first business processing request, execute the second business processing request based on the second access database, and obtain the business request data. Further, the computer device 101 can send the request result for the first business processing request to the first business object (the business device 102b) based on the business request data. The first business processing request can include a data query instruction such as an SQL instruction, for example, “(SELECT COUNT(*) FROM orders WHERE status = 'completed') AS completed_orders”. A SELECT-FROM-WHERE statement can be referred to as a query block. This SQL instruction is used to query the orders with the status of “completed” in the table named “orders” and calculate the number of orders that meet the condition through the COUNT aggregation function. The result of the query is named “completed_orders”. The first access database in this SQL instruction example is the table “orders”. It can be understood that the number of first access databases determined from the first business processing request can be one or more, and the business objects involved can also be multiple. The actual situation is determined by the requirements of the first business object.

[0035] For example, the first business object can request to calculate the relevant business data of itself and the partners, or request to calculate the relevant business data of the partners. The partners can include one or more business objects, and the first access database associated with a business object can also be one or more. The process of creating a second access database by the computer device 101 based on the first permission information and the first access database can be considered as the process of determining by the computer device 101 from the first permission information that part of the data content in the first access database can be accessed, and creating a second access database for the part of the data content. The first permission information can refer to the permission range configured by the data subordinate party associated with the first access database. If the first access database includes the first access database of the first business object (the initiator) and the first access database of the second business object (the partner), the computer device 101 needs to obtain the first permission information associated with the two first access databases respectively.

[0036] Through the above process, the trusted third-party object establishes a cooperation space for the business objects that exist in cooperation, provides a computing resource to perform joint computation or analysis of data, processes a first business processing request of the first business object that involves data of each party, limits the use range of data through the first permission information, can prevent data leakage, and improves the security of computation. At the same time, the first business object does not need to prepare, configure, and maintain the computing resource by itself, reduces the resource overhead of the first business object, and does not need to use a large-calculation cryptography for data encryption, nor a large-communication multi-party secure computation, so that the computation efficiency can be ensured even when the data scale is large.

[0037] Please refer to FIG. 2, which is a scene schematic diagram of a data processing method provided by an embodiment of the present application. Taking the application of the data processing method in the advertising revenue analysis scene as an example, the advertiser and the participating party of advertising can store business data on the same cloud server (provided by the trusted third-party object), and when the advertiser and the participating party of advertising want to cooperate to analyze the advertising delivery effect data, the trusted third-party object can use the data stored by the two parties to perform computation. For example, the trusted third-party object can establish a cooperation space for the two parties, which can be considered as a centralized data clean room. The data clean room is generally a trusted computing space created through access control and other isolation means, and can be used to perform fusion computation on the data of multiple parties. The cooperation space is a logically isolated space. Logical isolation means that different resources, services, or users are separated at the logical level, but they can run in the same physical environment.

[0038] Taking the advertiser as the first business object (the initiator of the computing task) as an example, as shown in FIG. 2, the computer device corresponding to the trusted third-party object can receive a first business processing request sent by the first business object. At this time, the first business processing request can include a SQL instruction for requesting computation of advertising delivery effect data and a request for analyzing the advertising delivery effect. The cooperation space created by the computer device can include a computing cluster and a structured language computing engine (SQL computing engine). The computing cluster is a processing resource pool including at least two computing nodes. The computing node is a node with data processing capability, which can be used to remotely access and process business data. The SQL computing engine is an engine that allows data to be queried and analyzed using SQL statements. The computer device can process the first business processing request through the computing cluster and the SQL computing engine. The first access database is determined from the first business processing request, which is the storage location of the business data indicated in the first business processing request and needs to be accessed, for example, it can be one or more data tables.

[0039] The computer device can obtain first permission information associated with the first access database, the first permission information being data use permission uploaded by a business object indicated by the first access database. If the first business processing request indicates that part of the business data of the first business object and part of the business data of the second business object need to be used, that is, the first access database includes the first access database of the first business object and the first access database of the second business object, it indicates that the first permission information includes the data use permission uploaded by the first business object and the last data use permission of the second business object. The second business object is a participant indicated by the first business processing request (i.e., a computing task), which indicates that the first business processing request needs to use the business data of the second business object, wherein the second business object can include one or more business objects. It can be understood that the database content (actual business data) of the first access database can be stored in the data warehouse of the cloud server provided by the trusted third party object. The data warehouse includes business data 1, business data 2, …, business data n, n is a positive integer, and the n business data can belong to n business objects respectively, or multiple business data belong to the same business object. The business data of different business objects are isolated from each other and cannot be connected with each other. Except that the business object corresponding to the business data can access, only the trusted third party object can access through certain access permission.

[0040] The computer device can remotely access the data warehouse (i.e., the data storage space of the business object) through the SQL computing engine, determine the database content of the first access database from the business database, determine the accessible business data in the first access database through the first permission information, determine the second database name based on the first database name of the first access database, and form the second access database by combining the second database name and the accessible data. For example, the first database name of the first access database is "table.a", which can be seen from Table 1, which is an example of part of the database content of the first access database. The first permission information uploaded by the business object corresponding to "table.a" can be used to limit the column permission of "table.a" table to id, Click_rate and date, and the row permission to date! = 20210716, that is, only the data columns with names "id", "Click_rate" and "date" can be accessed, and the data in the "date" data column is not equal to "20210716". That is, the id and Click_rate indicated by the data row with date = 20210716 in the "table.a" table cannot be accessed.

[0041] Table 1 (table.a)

[0042] The computer device can create a second access database through a SQL instruction, for example, "CREATE OR REPLACE TEMPORARY VIEW table.a_authorized AS SELECT id, Click_rate, date FROM table.a WHERE date!= 20210716". At this time, the second database name can be represented as "table.a_authorized". For example, refer to Table 2, which is an example of part of the database content of the second access database. The data content in Table 2 is the accessible business data content:

[0043] Table 2 (table.a_authorized)

[0044] The computer device can update the first business processing request to a second business processing request, for example, change "table.a" in the first business processing request to "table.a_authorized" to obtain the second business processing request. The computer device can execute the second business processing request on the second access database to obtain business request data. If the first business processing request indicates that business analysis needs to be performed on the business request data, for example, advertisement placement effect analysis, the computer device performs business analysis based on the business request data to obtain business analysis results. The business analysis results can include placement suggestions for the advertisements of the advertisers, for example, increasing advertisement placement in a certain time period in the future. The computer device can send the business request data and the business analysis results as the request results for the first business processing request to the first business object.

[0045] Through the above process, the trusted third-party object is introduced to establish a cooperation space for the business objects that exist in cooperation, and provides computing resources for joint calculation or analysis of data. The first business object processes the first business processing request involving data of each party. Through the access authority in the first authority information, the use range of rows and columns in the first access database is limited, which can prevent data leakage and improve computing security. At the same time, the first business object and the participants do not need to prepare, configure and maintain computing resources by themselves, which reduces the resource overhead of the first business object and the participants. Moreover, it does not need to use the computationally expensive cryptography for data encryption, nor does it need the computationally expensive multi-party secure computation. Even when the data size is large, the computing efficiency can be guaranteed. When performing data calculation, the required business data can be mounted on the same computing unit for remote access, without the need to physically move the required business data to the cooperation space, thereby reducing the storage overhead.

[0046] It can be understood that the business device mentioned in the embodiments of the present application can also be a computer device, and the computer device in the embodiments of the present application includes but is not limited to a terminal device or a server. In other words, the computer device can be a server or a terminal device, or a system composed of a server and a terminal device. Among them, the terminal device mentioned above can be an electronic device, including but not limited to a mobile phone, a tablet computer, a desktop computer, a notebook computer, a palm computer, a vehicle-mounted device, an augmented reality / virtual reality (AR / VR) device, a head-mounted display, a smart television, a wearable device, a smart speaker, a digital camera, a camera, and other mobile internet devices (MID) with network access capability, or terminal devices in scenarios such as trains, ships, and aircraft. As shown in FIG. 1, the terminal device can be a desktop computer (as shown by business device 102b), a mobile phone (as shown by business device 102a), a tablet computer (as shown by business device 102c), or a notebook computer (as shown by business device 102n), etc. FIG. 1 only illustrates some devices. Among them, the server mentioned above can be a standalone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, vehicle-road cooperation, content delivery networks (CDN), and big data and artificial intelligence platforms, etc. basic cloud computing services.

[0047] Optionally, the data involved in the embodiments of the present application can be stored in a computer device, or can be stored based on cloud storage technology or a blockchain network, which is not limited herein.

[0048] Please refer to FIG. 3, which is a method flow chart of data processing provided by the embodiments of the present application. It can be understood that the data processing process can be performed by a computer device corresponding to a trusted third party object, which can be a terminal device or a server, and the present application does not limit it. As shown in FIG. 3, the data processing process includes the following steps:

[0049] Step S301, obtaining a first business processing request sent by a first business object, and determining a first access database based on the first business processing request.

[0050] In the embodiments of the present application, the computer device can receive a first service processing request sent by a first service object, and complete a processing process of the first service processing request in a cooperation space. The first service object is a computing task initiator of data cooperation analysis, and the first service processing request can include a data query instruction. Optionally, the first service processing request can also include a result data analysis request. The data query instruction is used to indicate a specific computing request of the first service processing request, such as an SQL instruction. The result data analysis request is used to indicate a purpose of analyzing data obtained through the data query instruction. For example, the SQL instruction can be represented as "SELECT id, data FROM table_a WHERE data!= 20210716". The id and data are used to indicate data columns to be queried, which are data columns corresponding to the data column names id and data. The table_a is used to indicate a table name of a table to be queried, which is table_a. The data!= 20210716 is used to indicate a query condition, that is, data with a value not equal to 20210716 in the data column date. The first access database determined based on the SQL instruction is table_a. It can be understood that the first service processing request can request to calculate the business data of itself and the cooperation party, or only request to calculate the business data of the cooperation party, that is, the table_a in the above SQL instruction example can belong to the cooperation party, that is, the second service object.

[0051] It can be understood that there can be multiple second service objects, that is, the first service object can perform data cooperation analysis with multiple participants. The specific second service object can be determined by the ownership of the first access database indicated in the first service processing request. For example, if there are three first access databases, and one of the first access databases belongs to the first service object, and the other two first access databases can belong to two different second service objects.

[0052] In step S302, the first permission information associated with the first access database is obtained, the second access database is created based on the first permission information and the first access database, and the first service processing request is updated to the second service processing request based on the second access database.

[0053] In the embodiment of the present application, the computer device obtains first permission information associated with the first access database through the cooperation space, the first permission information refers to the data usage range uploaded by the request business object when the computer device creates the cooperation space for the request business object, and the first permission information can be used to indicate the access range of the request business object to the business data of other business objects. For example, if the first access database belongs to a second business object A, the first permission information is the data usage range uploaded by the second business object A. The request business object refers to the business object to which the first access database belongs. The computer device can determine the access range of the data based on the first permission information, determine the accessible data from the first access database based on the access range, and create a second access database for the accessible data. The database name of the second access database is determined by the database name of the first access database, and the two databases can have an association. For example, the database name of the first access database can be "table.b", and the database name of the second access database can be "table.b_authorized". The database content of the second access database can be the accessible data determined from the first access database. The second access database can be used to indicate the data content that the computer device can access based on the first business processing request. Further, the computer device can update the first business processing request to a second business processing request based on the second access database. For example, the computer device can update the database name "table.b" of the first access database in the SQL instruction in the first business processing request to the database name "table.b_authorized" of the second access database, and obtain the second business processing request.

[0054] In step S303, the second business processing request is executed for the second access database to obtain business request data, and the request result of the first business processing request is sent to the first business object based on the business request data.

[0055] In the embodiment of the present application, the computer device can execute the second business processing request for the second access database to obtain business request data. The business request data can include the execution result of the SQL instruction in the second business processing request, or when the SQL instruction in the second business processing request includes function calculation (for example, count function, sum function, and average function), the business request data can include the query result of the SQL instruction and the calculation result of the function calculation on the query result.

[0056] The computer device can send a request result of the first business processing request to the first business object based on the business request data. If the first business processing request only includes the SQL instruction, the computer device can determine the business request data as the request result of the first business processing request, and send the request result to the first business object. If the first business processing request includes the SQL instruction and a request for data analysis on the result of the SQL instruction, the computer device can determine the business request data and the analysis result of the business request data as the request result of the first business processing request, and send the request result to the first business object. For example, when the first business object is an advertiser, and the advertiser wants to cooperate with a participating party to analyze the advertising effect data of the advertisement, the computer device can analyze the advertising effect based on the business request data (i.e., the advertising data related to the advertisement), for example, by using the business request data to analyze the number of times the advertisement is displayed, the click rate (the ratio of the number of times the advertisement is clicked to the number of times the advertisement is displayed), the conversion rate (the proportion of users who actually purchase products or services after clicking the advertisement), the cost (the amount of money invested in the advertisement), the cost per click (the average cost of each click on the advertisement), the cost per conversion (the average cost of each conversion), and the like, so that the first business object (the advertiser) can understand the advertising effect based on the advertising effect, and thus optimize the future advertising strategy.

[0057] It can be understood that, before the computer device obtains the first business processing request sent by the first business object, the computer device also needs to create a cooperation space for the first business object and its cooperating parties. For example, referring to FIG. 4, FIG. 4 is a schematic diagram of a scenario of creating a cooperation space according to an embodiment of the present application. As shown in FIG. 4, the computer device corresponding to the trusted third party object can obtain the permission information (permission information 1, permission information 2, …, permission information n) uploaded by the business objects (including business object C1, business object C2, …, business object Cn). The business objects can include the first business object.

[0058] For example, taking the business object C1 as the first business object, and the business object C2, …, the business object Cn as each participating party or cooperating party for data cooperation analysis with the first business object. The computer device can create a cooperation space for the business objects, store the permission information of each business object in the cooperation space respectively, and associate the cooperation space with the data storage space of each business object. The permission information 1 of the first business object includes the first permission information of the first business object. Optionally, the computer device can provide a permission configuration template before each business object uploads the permission information, so that each business object can use the permission configuration template for simple configuration, and thus obtain the permission information of each business object.

[0059] For example, the first permission information can include access permissions, which can include data row and column permissions and operator access permissions. The business object can configure, in the data row and column permissions, table and database permissions of data that can be used by other business objects except itself, and row and column permissions in each table that can be used, i.e., data rows and data columns that can be accessed in each table.

[0060] Optionally, the business object can configure, in the operator access permissions, execution permissions of each operator (i.e., business keywords such as SELECT, JOIN, UDAF, etc.) in the SQL query statement. For example, the execution permissions can include, but are not limited to, data columns on which the business object allows execution of SELECT, WHERE, UNION, HAVING, etc.; whether JOIN must be performed before calculation, data columns on which JOIN is allowed to be performed; whether the primary key is allowed to be grouped by, data columns on which grouping by is allowed; allowed UDFs, UDAs, and data columns on which calculation by these functions is allowed; whether subqueries are allowed to be used, etc.

[0061] Optionally, the first permission information can further include output conditions, in which the business object can configure whether the result data of the SQL query statement needs to be limited. The output conditions are used to represent the limitation conditions of the data provided for other business objects, for example, whether the output result data must be the result after using UDAF; whether the amount of data with different result values needs to exceed a specified threshold; whether the output needs to satisfy K-anonymity, T-closeness, L-diversity, and corresponding K, T, L values; whether the output result data needs to satisfy differential privacy (DP), and a privacy budget threshold allowed to be used by DP, etc. Generally, public attributes in a data table can be divided into three categories: identifiers, quasi-identifiers, and sensitive data. Identifiers are generally unique identifiers of a single piece of data, such as names, addresses, and phone numbers. Quasi-identifiers refer to data that is not unique, such as zip codes, ages, and birthdays, but can help identify related data. Sensitive data refers to data that is most valuable for research or analysis in a data table, such as advertising data, purchase preferences, and salaries. K-anonymity requires that each equivalence class of specified identifiers (identifiers or quasi-identifiers) in the output data contains at least K records. T-closeness is to ensure that the distribution of sensitive information in the same quasi-identifier type group is close to the distribution of sensitive information in the entire data, not exceeding the threshold T. L-diversity ensures that there are at least L different types of sensitive attributes in the same type of data. Differential privacy refers to adding a small amount of noise to the data to protect user data privacy while ensuring the accuracy of function calculation.

[0062] Through the above process, the trusted third-party object is introduced to establish a cooperation space for the business objects that exist cooperation, to separate the calculation (i.e., the cooperation space) from the storage (i.e., the data storage space), and to associate the data storage space of the business object with the cooperation space, without moving the business data of the business object to the cooperation space, reducing the data moving overhead and the data storage overhead; and the cooperation space is a virtual logical concept, and is not a physical closed space like the closed domain, so that the computing resources can be provided for the joint calculation or analysis of the data of multiple different business objects, to realize the reuse and sharing of the resources, and to improve the resource utilization rate; at the same time, the first business object processes the first business processing request involving the data of each party, and the use range of the data is limited by the first permission information, so that the data leakage can be prevented, and the calculation security is improved. At the same time, the first business object does not need to prepare, configure, and maintain the computing resources by itself, reducing the resource overhead of the first business object, and without using the cryptography with large use overhead to encrypt the data, and without using the multi-party secure calculation with large communication overhead, so that the calculation efficiency can be guaranteed even when the data scale is large.

[0063] Please refer to FIG. 5, which is a flowchart of a data processing method provided by an embodiment of the present application. It can be understood that the data processing process can be performed by a computer device corresponding to the trusted third-party object, which can be a terminal device or a server, and the present application does not limit this. As shown in FIG. 5, the data processing process includes the following steps:

[0064] Step S501: obtaining a first business processing request sent by a first business object, and determining a first access database based on the first business processing request.

[0065] In the embodiment of the present application, the specific implementation process of step S501 can refer to the specific description in step S301 as shown in FIG. 3, which will not be repeated here.

[0066] Step S502: obtaining first permission information associated with the first access database, creating a second access database based on the first permission information and the first access database, and updating the first business processing request to a second business processing request based on the second access database.

[0067] In the embodiments of the present application, the computer device can obtain the first permission information associated with the first access database, determine the access range in the first permission information, and obtain the accessible business data from the first access database based on the access range, that is, the computer device can determine the business object associated with the first access database, obtain the data usage permission uploaded by the business object, and take the data usage permission as the first permission information to determine the access range in the first access database. For example, there are data column 1, data column 2, data column 3 and data column 4 in the first access database. If the access range determined based on the first permission information indicates that the computer device corresponding to the trusted third-party object can only access data column 1 and data column 4, that is, has access permission to data column 1 and data column 4 in the first access database, the computer device can determine all data contents corresponding to data column 1 and data column 4 as the accessible business data.

[0068] Optionally, when a business object uploads permission information to a trusted third-party object, the business object can upload permission information for other business objects. At this time, the computer device can obtain the request business object associated with the first access database and obtain the first permission information uploaded by the request business object. Alternatively, when a business object uploads permission information to a trusted third-party object, the business object can upload different permission information for different other business objects, that is, provide different data for different business objects. At this time, the computer device can obtain the request business object associated with the first access database and obtain the first permission information uploaded by the request business object for the first business object. For example, business object 1 uploads permission information 1 for business object 2, uploads permission information 2 for business object 3 and business object 4. Assuming that the first business object is business object 1 and the request business objects include business object 3 and business object 4, the computer device can obtain the permission information 2 uploaded by business object 1 for business object 3 and business object 4, and determine the permission information 2 as the first permission information.

[0069] The computer device determines the second database name based on the first database name of the first access database. In general, for ease of understanding, the second database name generated by the computer device has relevance or indicative to the first database name. For example, the first database name is “table.c”, and the second database name can be represented as “table.c_authorized”. The “table.c_authorized” can represent a database that has obtained authorization of the database “table.c”. The computer device can take the above-determined accessible business data as the database content, combine the second database name with the database content, and generate the second access database.

[0070] Optionally, the number of the first access databases is N, N is a positive integer; the specific implementation process that the computer device creates the second access database based on the first permission information and the first access database can also be: the computer device obtains N first access databases respectively corresponding to the request business object, and can create the second access database of the request business object based on the first permission information of each request business object and the first access database of the request business object.

[0071] Alternatively, the computer device obtains N first access databases respectively corresponding to the request business object, and if the first business object is included in the N request business objects, it indicates that when the first business object initiates the first business processing request, the first business processing request includes a request for processing the business data of itself; at this time, the computer device can directly determine the first access database of the first business object as the second access database of the first business object.

[0072] Since the first business object has complete access permission to the first access database of the first business object, and the access permission of the computer device corresponding to the trusted third party object to the first access database of the first business object is determined by the first permission information uploaded by the first business object. When the first permission information uploaded by the first business object does not include complete access permission to the first access database of the first business object, the computer device can send a permission incomplete prompt information to the first business object after determining the second access database, and the permission incomplete prompt information can be used to remind the first business object to supplement the corresponding access permission, or directly supplement the part of data in the second access database that has no access permission. For the second access database of the second business object, the computer device can create the second access database of the second business object based on the first permission information of the second business object, i.e. the first access database of the second business object. Wherein the second business object is a business object in N request business objects, except the first business object. If the first business object is not included in the N request business objects, the second access database of each request business object can be directly created based on the first permission information of the request business object and the first access database of the request business object.

[0073] It should be noted that the computer device can also obtain the permission information of the business object before receiving the first business processing request of the first business object; wherein the business object includes the first business object. The computer device can create a cooperation space for the business object, store the permission information of the business object in the cooperation space, and associate the cooperation space with the data storage space of the business object. Optionally, the computer device obtains the first permission information associated with the first access database, and the specific implementation process of creating the second access database based on the first permission information and the first access database can also be: the computer device obtains a request business object corresponding to the first access database, and obtains the first permission information of the request business object from the request cooperation space corresponding to the request business object; the business object includes the request business object; the permission information of the request business object includes the first permission information of the request business object. Further, the computer device requests the database content in the first access database from the data storage space associated with the request cooperation space through the request cooperation space corresponding to the request business object, and creates the second access database based on the database content in the first access database.

[0074] The first business processing request can be updated to the second business processing request based on the second access database. Specifically, the first database name included in the first business processing request can be updated to the second database name corresponding to the first database name to obtain the second business processing request. At this time, the data query statement in the first business processing request is updated to the update query statement in the second business processing request. For example, the data query statement is "select*from table.a union all select*from table.b", the first database name includes "table.a" and "table.b", wherein it is assumed that the second database name corresponding to the first database name "table.a" is "table.a_authorized", and the second database name corresponding to the first database name "table.b" is "table.b_authorized", then the update query statement "select*from table.a_authorized union all select*from table.b_authorized" can be obtained.

[0075] Step S503, performing permission verification on the second business processing request.

[0076] In the embodiment of the present application, the first permission information includes access permission, and the implementation process of the computer device for permission verification on the second service processing request can be: the computer device performs request analysis on the second service processing request to obtain request information corresponding to the second service processing request. The request information can include a service keyword, a to-be-accessed data column corresponding to the service keyword, and a request query format, wherein the service keyword refers to an execution operator in an update query statement included in the second service processing request, such as select, avg, count, etc.; the to-be-accessed data column corresponding to the service keyword is used to indicate the specific data position of the service keyword in the second access database; and the request query format is used to indicate the statement format of the update query statement, and can include a single-layer query format and a nested query format (i.e., SQL subquery, which refers to another query statement nested in a SQL query statement). The computer device can perform permission verification on the request information based on the access permission associated with the second access database.

[0077] Further, the computer device obtains the accessible data column corresponding to the service keyword from the access permission. Specifically, the computer device can determine the configuration form of the access permission based on the access permission. If the access permission is configured in the form of a white list, when the service keyword exists in the access permission, the computer device can directly obtain the accessible data column associated with the service keyword from the access permission. When the service keyword does not exist in the access permission, the computer device determines that the accessible data column corresponding to the service keyword is empty. If the access permission is configured in the form of a restricted list, the computer device can match the service keyword with the access permission. If the service keyword does not exist in the access permission, it can be determined that the service keyword can access any one of the data columns associated with the access permission. The computer device can determine all the data columns in the second access database as the accessible data column corresponding to the service keyword. If the service keyword exists in the access permission, the computer device obtains the accessible data column configured for the service keyword in the access permission. If the access permission is configured in the form of a black list, when the service keyword does not exist in the access permission, it can be determined that the service keyword can access any one of the data columns associated with the access permission. The computer device can determine all the data columns in the second access database as the accessible data column corresponding to the service keyword. When the service keyword exists in the access permission, the computer device determines that the accessible data column corresponding to the service keyword is empty.

[0078] If the accessible data column includes the to-be-accessed data column, and the request query format belongs to the permitted query format in the access permission, it is determined that the permission verification of the request information is passed. The permitted query format is used to represent the number of query nesting layers allowed to be used for the second access database. If the accessible data column does not include the to-be-accessed data column, or the request query format does not belong to the permitted query format in the access permission, it is determined that the permission verification of the request information is not passed. In the verification process of the operator (i.e., the business keyword) permission in the request query format, the inheritance relationship of each data column in the SQL instruction can be constructed in a privacy bloodline manner, whether the use of the business keyword is violated and whether the request query format conforms to the number of query nesting layers allowed to be used for the second access database are determined according to the operator permission (i.e., the configuration related to the business keyword in the first permission information) configured for each data column against the business object, so as to determine whether the operator permission of the request query format is supported.

[0079] For example, there is a SQL query statement "SELECT Department FROM (SELECT Department, AVG(Salary) AS AvgSalary FROM Employees GROUP BY Department) AS SubQuery WHERE AvgSalary>50000", in which a query statement "SELECT Department, AVG(Salary) AS AvgSalary FROM Employees GROUP BY Department" is nested in the query statement "SELECT Department FROM AvgSalary AS SubQuery WHERE AvgSalary>50000". Assuming that Employees is a second access database, and the data table AvgSalary is generated by the Department column and the Salary column in the second access database Employees, if the accessible data columns corresponding to the business keyword SELECT include the Department column and the Salary column, the business keyword SELECT has access to the data table AvgSalary, i.e., the computer device can execute the entire query, including the AVG(Salary) part of the inner subquery, to obtain the final execution result, i.e., the permission verification passes. If the accessible data columns corresponding to the business keyword SELECT include the Department column but do not include the Salary column, the computer device can execute the outer query "SELECT Department FROM AvgSalary" in the permission detection process, but cannot execute the AVG(Salary) part of the inner subquery, because it violates the operator permission (i.e., the business keyword does not have permission for the Salary column). Therefore, the database management system will refuse to execute this nested subquery, so that the computer device cannot obtain the final execution result, i.e., the permission verification fails.

[0080] If the permission verification of the computer device on the request information fails, a request failure message is sent to the first business object. If the permission verification of the computer device on the request information passes, a process of executing a second business processing request for the second access database to obtain business request data is performed.

[0081] In step S504, the second business processing request is executed for the second access database to obtain business request data.

[0082] In the embodiments of the present application, the first permission information includes an output condition, which is used to indicate a data condition allowed to be acquired (allowed to be accessed) by the first access database. Since the second access database is determined by the first access database, the output condition is also used to indicate a data condition allowed to be acquired by the second access database. The computer device performs the second service processing request on the second access database, and the specific implementation process of obtaining the service request data can be that the computer device performs the second service processing request on the second access database to obtain execution result data. Specifically, the computer device parses the second service processing request to obtain M query instructions included in the second service processing request and an instruction execution order corresponding to the M query instructions, where M is a positive integer. For example, one SQL query instruction in the second service processing request is "SELECT2 AVG(data1) FROM tablea WHERE data2 IN (SELECT1 data3 FROM tableb)", where the SQL query instruction includes two SELECT instructions and one AVG instruction, and the execution order is SELECT1, SELECT2, and AVG in sequence. It can be understood that the business keywords SELECT1 and SELECT2 do not have numerical subscripts in the actual SQL query statement, and the numerical subscripts are used here only to distinguish the two identical business keywords to clearly indicate the execution order of the two identical business keywords.

[0083] The computer device splits the second service processing request into M query statements based on the instruction execution order corresponding to the M query instructions, for example, splits the SQL statement in the above example, and the obtained 3 query statements can be respectively represented as "SELECT data3 FROM table b", that is, querying data3 from table b, the query result is recorded as A here, so as to express the subsequent query statement; "SELECT data1 FROM table a WHERE data2 IN A", the query result is recorded as B here; "avg(B)". Further, the computer device sequentially executes the M query statements on the second access database to obtain the execution result data corresponding to the M query statements respectively. The SQL statement in the above example can include table a and table b. Optionally, the execution result data corresponding to the M query statements can be determined based on the output condition in the first permission information, wherein there can be a case that one query statement in the M query statements is executed based on another query statement, therefore, there is an instruction execution order, specifically, the execution result data i of the ith query statement can be obtained, i is a positive integer less than or equal to M; if the i+1th query statement is executed based on the ith query statement, the i+1th query statement is executed based on the execution result data i of the ith query statement, the initial result data i+1 of the i+1th query statement is obtained, the first permission information i+1 of the second access database associated with the i+1th query statement is obtained, the initial result data i+1 is filtered based on the output condition in the first permission information i+1, and the execution result data i+1 of the i+1th query statement is obtained; if the i+1th query statement is executed alone, the initial result data i+1 of the i+1th query statement is obtained by executing the i+1th query statement, the first permission information i+1 of the second access database associated with the i+1th query statement is obtained, the initial result data i+1 is filtered based on the output condition in the first permission information i+1, and the execution result data i+1 of the i+1th query statement is obtained. Until the execution result data corresponding to the M query statements is obtained.

[0084] That is, the output result of the second service processing request can be result filtered, and since the intermediate data is invisible to the initiator (that is, the first service object), the security of the data can also be ensured. Alternatively, in order to further improve the security of the data, the result of each query statement associated with the second access database can also be filtered based on the first permission information of the second access database.

[0085] If the execution result data does not meet the output condition, the computer device determines the empty data as the business request data. Alternatively, if the business object associated with the second access database is configured with the data quantity of different result values exceeding a specified quantity threshold (e.g., 2) in the output condition, and the output result data needs to meet the L-diversity and the corresponding L value, the computer device can perform data filtering on the execution result data based on the output condition to obtain the business request data. Specifically, the computer device obtains P data items included in the execution result data, and obtains a filtering data column from the output condition; P is a positive integer. The computer device groups the P data items based on the filtering data column to obtain Q data groups; Q is a positive integer less than or equal to P, and each data group includes one or more data items. The computer device can perform data filtering on the execution result data based on the number of data items included in each data group and Q to obtain the business request data. Specifically, the computer device determines whether Q is greater than or equal to L from the execution result data, and if Q is greater than or equal to L, the computer device further obtains a data group with a number of data items greater than or equal to the specified quantity threshold, and determines the data group as the business request data. If Q is less than L, the computer device determines the second business request data as empty.

[0086] For example, assume that an execution result data is shown in Table 3:

[0087] Table 3

[0088] As shown in Table 3, the execution result data can include 4 data columns (name, age, zip code, and purchase preference) and 6 data items (3 fitness equipment, 1 book, and 2 cooking tools), and the filtering data column obtained based on the output condition is the purchase preference. Grouping the 6 data items based on the filtering data column (purchase preference) can obtain 3 data groups (fitness equipment, book, and cooking tools), wherein the first data group includes 3 fitness equipment data items, the second data group includes 1 book data item, and the third data group includes 2 cooking tool data items. Assuming that the specified quantity threshold in the output condition is 2 and the L value is 3, when the computer device determines that Q is greater than 3 from the execution result data, the computer device further obtains a data group with a number of data items greater than or equal to 2, and determines the data group as the business request data. For example, refer to the result shown in Table 4, which can include 4 data columns (name, age, zip code, and purchase preference) and 5 data items (3 fitness equipment and 2 cooking tools):

[0089] Table 4

[0090] Optionally, if the second access database is associated with a business object, the output result data configured in the output condition needs to meet K-anonymity, and the corresponding K value (for example, 2). The computer device detects whether the data table corresponding to the execution result data meets the corresponding K value. If the execution result data does not meet the K value, the computer device determines that the execution result data is empty. Alternatively, the execution result data is subjected to data anonymization protection to obtain an anonymization protection result, and the anonymization protection result is determined as the business request data.

[0091] For example, assuming that an execution result data is as shown in Table 5:

[0092] Table 5

[0093] As shown in Table 5, the execution result data can include 4 data columns (name, age, zip code, and purchase preference) and 8 data items, wherein the name is an identifier, the age and the zip code are quasi-identifiers, and the purchase preference is sensitive data. The computer device can delete the data column corresponding to the identifier, or perform fuzzy processing on the data column corresponding to the quasi-identifier to obtain the business request data. For example, refer to Table 6:

[0094] Table 6

[0095] As shown in Table 6, the computer device deletes the name column and replaces it with a symbol “*”, generalizes the specific values in the age column into an age range for fuzzy processing, and for the zip code data, if all the digits are replaced with the symbol “*”, the data will lose a lot of meaningful information. The computer device can delete one digit and replace it with the symbol “*”, and keep the remaining digits to ensure that an attacker can find at least two data when querying the data by specifying the identifier. For example, by querying the purchase preference of Frank with the age of 36 and the zip code of 102201 in Table 5, two different purchase preferences can be obtained from Table 6, and Frank's real data cannot be located. Thus, the privacy of the business request data is protected by anonymization and other means, so that the attacker cannot directly locate a single data by querying, and the purpose of data leakage is achieved.

[0096] If the execution result data meets the output condition, the computer device determines the execution result data as the business request data.

[0097] In step S505, based on the business request data, the computer device sends a request result corresponding to the first business processing request to the first business object.

[0098] In the embodiment of the present application, if the first service processing request only includes the SQL instruction, the computer device can determine the service request data as the request result for the first service processing request, and send the request result to the first service object. Optionally, if the first service processing request includes the SQL instruction and the service requirement for the execution result of the SQL instruction, the computer device can obtain the service requirement included in the first service processing request, obtain the standard data index corresponding to the service requirement, statistically integrate the service request data based on the service requirement, obtain the service statistical information, analyze the service statistical information based on the standard data index, obtain the service analysis result, determine the service request data and the service analysis result as the request result for the first service processing request, and send the request result to the first service object. If the service object indicated by the data processing method in the embodiment of the present application is the advertiser and the advertisement placement participant, the computer device can perform advertisement placement effect analysis on the service request data based on the service requirement in the first service processing request, obtain the analysis result, and send the service request data and the analysis result as the request result to the first service object, so that the first service object adjusts the subsequent advertisement placement strategy according to the request result. Optionally, the analysis result can include the placement strategy suggestion for the advertisement placement, which is used to assist the first service object to adjust the subsequent advertisement placement strategy.

[0099] Optionally, the first permission information includes the first permission information associated with the first service object, and the computer device sends the specific implementation process of the request result for the first service processing request to the first service object based on the service request data. The specific implementation process can also be: if the first access database includes the first access database of the first service object, the computer device sends the request result for the first service processing request and the data completion prompt message to the first service object based on the service request data, so that the first service object determines the to-be-requested service data from the first service processing request based on the first permission information of the first service object, obtains the to-be-supplemented service data from the to-be-requested service data based on the first service processing request, and determines the to-be-supplemented service data and the request result as the target result of the first service processing request. The data completion prompt message is used to prompt the first service object to complete data or complete permission in the case that the computer device has insufficient access rights to all database contents in the first access database (i.e., the computer device cannot completely access the first access based on the first permission information). The to-be-requested service data is the service data in the first access database of the first service object except the second access database corresponding to the first service object (i.e., the service data that the computer device has no access right based on the first permission information).

[0100] The trusted third-party object can be a cloud service object for providing computing and storage services, each business object can store its business data in a cloud environment provided by the trusted third-party object, and the business data of different business objects is independent and isolated in the cloud environment. The trusted third-party object can establish a cooperation space in the cloud environment for each participant (such as a request business object associated with the first business processing request) participating in a certain business (such as the first business processing request), and realize joint access and processing of the business data of each participant through the first permission information provided by each participant.

[0101] Through the above process, the trusted third-party object establishes a cooperation space for the business objects that exist in cooperation, separates computing (i.e., the cooperation space) from storage (i.e., the data storage space), and associates the data storage space of the business object with the cooperation space, without moving the business data of the business object to the cooperation space, reducing data movement overhead and data storage overhead; and the cooperation space is a virtual logical concept, not a physically closed space like a closed domain, so that multiple computing tasks can be run simultaneously on the same computer, fully utilizing computing resources, realizing resource reuse and sharing, improving resource utilization, saving computing task queuing time, and improving computing efficiency; at the same time, the first business object processes the first business processing request involving data of each party, uses the access permission (including row and column permission and operator permission) in the first permission information to limit the use range of data and the use of SQL operators, which can prevent data leakage, improve computing security, and the verification of the access permission only needs to consume less resources; the output condition in the first access permission information is used to anonymize the execution result data, etc., to further protect the privacy of the business data. At the same time, the first business object does not need to prepare, configure, and maintain computing resources, reducing the resource overhead of the first business object, and does not need to use computationally expensive cryptography for data encryption, nor does it need to use computationally expensive multi-party secure computation, reducing the complexity of the computation. Even when the data size is large, the computing efficiency can be guaranteed.

[0102] Please refer to FIG. 6, which is a business processing flowchart provided by an embodiment of the present application. As shown in FIG. 6, the business processing process for creating a cooperation space is described, including a trusted third-party object and an initiator (a first business object), and the business processing process includes the following steps:

[0103] Step S601, a first business processing request is sent.

[0104] In the embodiments of the present application, the initiator (the first service object) can send a first service processing request (i.e., a data cooperation computing task) to the trusted third-party object through the service device. The first service processing request can include a SQL instruction and a service requirement for the execution result of the SQL instruction. The initiator can request to calculate the service data of the second service object (the participant) or request to calculate the service data of the first service object and the service data of the second service object through the first service processing request.

[0105] In step S602, the computing resource is configured.

[0106] In the embodiments of the present application, after the computer device corresponding to the trusted third-party object receives the first service processing request sent by the initiator, the computer device can configure the computing resource for the first service processing request, i.e., provide the computing resource to process the service content indicated by the first service processing request. For example, the number of computer machines required to process the first service processing request or the configuration of the computer machines is determined and provided.

[0107] In step S603, the permission resolution verification is performed.

[0108] In the embodiments of the present application, the computer device can determine the first access database based on the first service processing request, obtain the first permission information associated with the first access database, create a second access database based on the first permission information and the first access database, and update the first service processing request to a second service processing request based on the second access database. Further, the first permission information includes an access permission, the computer device performs the request resolution on the second service processing request to obtain the request information corresponding to the second service processing request. The request information is verified based on the access permission associated with the second access database. The specific implementation process can be referred to the specific description in steps S502 and S503 shown in FIG. 5, which will not be repeated here.

[0109] In step S604, it is determined whether the permission resolution verification is successful.

[0110] In the embodiments of the present application, the computer device determines whether the permission resolution verification on the second service processing request is successful. If the permission resolution verification on the second service processing request is not successful, i.e., the permission verification on the request information fails, the step S605 is executed. If the permission resolution verification on the second service processing request is successful, i.e., the permission verification on the request information is passed, the step S606 is executed.

[0111] In step S605, the execution error information is sent to the initiator.

[0112] In the embodiment of the present application, the computer device sends the execution error information to the initiator, so that the initiator receives the execution error information, and determines whether to resend the service processing request based on the execution error information.

[0113] Step S606, the second service processing request is executed.

[0114] In the embodiment of the present application, the computer device executes the second service processing request for the second access database, and obtains execution result data.

[0115] Step S607, the execution result data is subjected to output condition verification.

[0116] In the embodiment of the present application, the first permission information includes an output condition, and the computer device performs output condition verification on the execution result data based on the output condition.

[0117] Step S608, whether the execution result data meets the output condition.

[0118] In the embodiment of the present application, the computer device determines whether the execution result data meets the output condition. If the execution result data does not meet the output condition, the computer device jumps to step S609, or performs data screening on the execution result data based on the output condition, and obtains service request data. If the execution result data meets the output condition, the computer device jumps to step S610.

[0119] Step S609, the execution error information is sent to the initiator.

[0120] In the embodiment of the present application, the computer device sends the execution error information to the initiator, so that the initiator receives the execution error information, and determines whether to resend the service processing request based on the execution error information.

[0121] Step S610, the request result is sent to the initiator.

[0122] In the embodiment of the present application, the computer device can determine the execution result data as the service request data, determine the service request data as the request result for the first service processing request, and send the request result to the initiator. Optionally, the computer device can obtain a service demand included in the first service processing request, obtain a standard data index corresponding to the service demand, statistically integrate the service request data based on the service demand, obtain service statistical information, analyze the service statistical information based on the standard data index, obtain service analysis result, determine the service request data and the service analysis result as the request result for the first service processing request, and send the request result to the initiator. For specific implementation process, refer to the specific description in step S505 shown in FIG. 5, which will not be described here.

[0123] Please refer to FIG. 7, which is a schematic diagram of a data processing apparatus provided in an embodiment of the present application. The data processing apparatus can be a computer program (including program code, etc.) running in a computer device, for example, the data processing apparatus can be an application software; the data processing apparatus can be used to execute corresponding steps in the method provided in the embodiments of the present application. As shown in FIG. 7, the data processing apparatus 700 can be used in the computer device in the embodiments corresponding to FIG. 3 and FIG. 5, specifically, the data processing apparatus can include: a space creating module 11, a request obtaining module 12, a data updating module 13, an authority verifying module 14, and a data executing module 15.

[0124] The request obtaining module 12 is configured to obtain a first service processing request sent by a first service object, and determine a first access database based on the first service processing request.

[0125] The data updating module 13 is configured to obtain first authority information associated with the first access database, create a second access database based on the first authority information and the first access database, and update the first service processing request to a second service processing request based on the second access database.

[0126] The data executing module 15 is configured to execute the second service processing request for the second access database, obtain service request data, and send a request result for the first service processing request to the first service object based on the service request data.

[0127] In a possible implementation, when the data updating module 13 is used to create the second access database based on the first authority information and the first access database, the data updating module 13 is specifically configured to perform the following operations:

[0128] Determine an access range in the first authority information, and obtain accessible service data from the first access database based on the access range;

[0129] Determine a second database name based on a first database name of the first access database, take the accessible service data as database content, and compose the second access database by combining the second database name and the database content.

[0130] In a possible implementation, the number of the first access databases is N, and N is a positive integer; when the data updating module 13 is used to create the second access database based on the first authority information and the first access database, the data updating module 13 is specifically configured to perform the following operations:

[0131] Obtain request service objects corresponding to the N first access databases respectively;

[0132] If the first service object is included in the N service objects, a first access database of the first service object is determined as a second access database of the first service object, the second access database of the second service object is created based on the first permission information of the second service object and the first access database of the first service object, and the second service object is a service object other than the first service object in the N service objects.

[0133] In a possible implementation, the first permission information includes access permission, and the data processing apparatus 700 further includes a permission verification module 14, which is specifically configured to perform the following operations:

[0134] The second service processing request is parsed to obtain request information corresponding to the second service processing request;

[0135] The request information is verified based on the access permission associated with the second access database;

[0136] If the permission verification on the request information fails, a request failure message is sent to the first service object;

[0137] If the permission verification on the request information passes, a process of executing the second service processing request on the second access database is performed to obtain service request data.

[0138] In a possible implementation, the request information includes a service keyword, a to-be-accessed data column corresponding to the service keyword, and a request query format, and when the permission verification module 14 verifies the request information based on the access permission associated with the second access database, the permission verification module 14 is specifically configured to perform the following operations:

[0139] The to-be-accessed data column corresponding to the service keyword is obtained from the access permission, and if the to-be-accessed data column is included in the accessible data column and the request query format belongs to a permitted query format in the access permission, it is determined that the permission verification on the request information passes, and the permitted query format is used to indicate the number of query nesting layers allowed to be used for the second access database;

[0140] If the to-be-accessed data column is not included in the accessible data column or the request query format does not belong to the permitted query format in the access permission, it is determined that the permission verification on the request information fails.

[0141] In a possible implementation, the first permission information includes an output condition, the output condition is used to indicate a data condition allowed to be obtained for the first access database, and the data execution module 15 is specifically configured to perform the following operations when executing the second service processing request on the second access database to obtain the service request data:

[0142] The second service processing request is executed on the second access database to obtain execution result data;

[0143] If the execution result data does not meet the output condition, empty data is determined as the service request data, or the execution result data is data-filtered based on the output condition to obtain the service request data;

[0144] If the execution result data meets the output condition, the execution result data is determined as the service request data.

[0145] In a possible implementation, when the data execution module 15 is used to execute the second service processing request on the second access database to obtain the execution result data, the data execution module 15 is specifically configured to perform the following operations:

[0146] The second service processing request is parsed to obtain M query instructions included in the second service processing request and an instruction execution order corresponding to the M query instructions; M is a positive integer;

[0147] Based on the instruction execution order corresponding to the M query instructions, the second service processing request is split into M query statements, and the M query statements are executed on the second access database in sequence to obtain execution result data corresponding to each of the M query statements.

[0148] In a possible implementation, when the data execution module 15 is used to data-filter the execution result data based on the output condition to obtain the service request data, the data execution module 15 is specifically configured to perform the following operations:

[0149] P data items included in the execution result data are obtained, and a filtering data column is obtained from the output condition; P is a positive integer;

[0150] The P data items are grouped based on the filtering data column to obtain Q data groups; Q is a positive integer less than or equal to P, and each data group includes one or more data items;

[0151] The execution result data is data-filtered based on the number of data items included in each data group and Q to obtain the service request data.

[0152] In a possible implementation, when the data execution module 15 is used to send a request result of the first service processing request to the first service object based on the service request data, the data execution module 15 is specifically configured to perform the following operations:

[0153] The service request data is determined as the request result of the first service processing request, and the request result is sent to the first service object;

[0154] Alternatively, the service demand included in the first service processing request is acquired, the standard data index corresponding to the service demand is acquired, the service request data is statistically integrated based on the service demand to obtain service statistical information, the service statistical information is analyzed based on the standard data index to obtain service analysis result, the service request data and the service analysis result are determined as the request result for the first service processing request, and the request result is sent to the first service object.

[0155] In a possible implementation, the first permission information includes first permission information associated with the first service object; and when the data execution module 15 is used to send the request result for the first service processing request to the first service object based on the service request data, the data execution module 15 is specifically configured to perform the following operations:

[0156] If the first access database includes the first access database of the first service object, the request result for the first service processing request is sent to the first service object based on the service request data, and a data completion prompt message is sent to the first service object, so that the first service object determines the to-be-requested service data from the first service processing request based on the first permission information of the first service object, acquires the to-be-supplemented service data from the to-be-requested service data based on the first service processing request, and determines the to-be-supplemented service data and the request result as the target result of the first service processing request; the to-be-requested service data is service data in the first access database of the first service object, except for the second access database corresponding to the first service object.

[0157] In a possible implementation, the data processing apparatus 700 further includes a space creation module 11, which is specifically configured to perform the following operations:

[0158] Permission information of the service object is acquired; the service object includes the first service object;

[0159] A cooperation space is created for the service object, the permission information of the service object is stored in the cooperation space, and the cooperation space is associated with the data storage space of the service object;

[0160] The data update module 13 is used to acquire the first permission information associated with the first access database, and create the second access database based on the first permission information and the first access database; the data update module 13 is specifically configured to perform the following operations:

[0161] The request service object corresponding to the first access database is acquired, and the first permission information of the request service object is acquired from the request cooperation space corresponding to the request service object; the service object includes the request service object;

[0162] The request service object corresponds to a request cooperation space, a database content in a first access database is requested from a data storage space associated with the request cooperation space, a second access database is created based on the database content in the first access database.

[0163] Referring to FIG. 8, FIG. 8 is a structural schematic diagram of a computer device provided in an embodiment of the present application. As shown in FIG. 8, the computer device in the embodiment of the present application can include a processor 801, a network interface 804 and a memory 805, in addition, the computer device 800 can further include a user interface 803 and at least one communication bus 802. The communication bus 802 is used to realize the connection and communication among the components. The user interface 803 can include a display, a keyboard, and the optional user interface 803 can further include a standard wired interface, a wireless interface. The network interface 804 can optionally include a standard wired interface, a wireless interface (such as a WI-FI interface). The memory 805 can be a high-speed RAM memory, or a non-volatile memory, for example, at least one disk memory. The memory 805 can be optionally at least one storage device located away from the aforementioned processor 801. As shown in FIG. 8, the memory 805 as a computer readable storage medium can include an operating system, a network communication module, a user interface module and a device control application.

[0164] The network interface 804 can provide a network communication network element; the user interface 803 is mainly used to provide an input interface for a user; and the processor 801 can be used to call the device control application stored in the memory 805, and is used to perform the following operations:

[0165] obtain a first service processing request sent by a first service object, determine a first access database based on the first service processing request;

[0166] obtain first permission information associated with the first access database, create a second access database based on the first permission information and the first access database, and update the first service processing request to a second service processing request based on the second access database;

[0167] execute the second service processing request for the second access database, obtain service request data, and send a request result for the first service processing request to the first service object based on the service request data.

[0168] In a possible implementation, the processor 801 is configured to create the second access database based on the first permission information and the first access database, and specifically configured to perform the following operations:

[0169] determine an access range in the first permission information, and acquire the accessible business data from the first access database based on the access range;

[0170] determine a second database name based on a first database name of the first access database, take the accessible business data as database content, and group the second database name and the database content to form a second access database.

[0171] In a possible implementation, the number of the first access databases is N, and N is a positive integer; when the processor 801 is used to create the second access database based on the first permission information and the first access databases, the processor 801 is specifically used to perform the following operations:

[0172] acquire N first access databases corresponding to N request business objects respectively;

[0173] if the first business object is included in the N request business objects, determine the first access database of the first business object as the second access database of the first business object, and create the second access database of a second business object based on the first permission information of the second business object and the first access database of the second business object; the second business object is a business object other than the first business object in the N request business objects.

[0174] In a possible implementation, the first permission information includes access permission; the processor 801 is specifically further used to perform the following operations:

[0175] perform request analysis on the second business processing request to obtain request information corresponding to the second business processing request;

[0176] perform permission verification on the request information based on the access permission associated with the second access database;

[0177] if the permission verification on the request information fails, send a request failure message to the first business object;

[0178] if the permission verification on the request information passes, perform the process of executing the second business processing request on the second access database to obtain business request data.

[0179] In a possible implementation, the request information includes a business keyword, a to-be-accessed data column corresponding to the business keyword, and a request query format; when the processor 801 is used to perform permission verification on the request information based on the access permission associated with the second access database, the processor 801 is specifically used to perform the following operations:

[0180] The accessible data column corresponding to the business keyword is obtained from the access right, if the accessible data column includes the to-be-accessed data column, and the request query format belongs to the permitted query format in the access right, it is determined that the permission verification of the request information is passed; the permitted query format is used to indicate the number of query nesting layers allowed to be used for the second access database;

[0181] If the accessible data column does not include the to-be-accessed data column, or the request query format does not belong to the permitted query format in the access right, it is determined that the permission verification of the request information is not passed.

[0182] In a possible implementation, the first permission information includes an output condition; the output condition is used to indicate a data condition allowed to be obtained by the first access database; the processor 801 is configured to execute a second business processing request for the second access database to obtain business request data, and specifically configured to perform the following operations:

[0183] The second business processing request is executed for the second access database to obtain execution result data;

[0184] If the execution result data does not conform to the output condition, empty data is determined as the business request data, or the execution result data is data-filtered based on the output condition to obtain the business request data;

[0185] If the execution result data conforms to the output condition, the execution result data is determined as the business request data.

[0186] In a possible implementation, the processor 801 is configured to execute the second business processing request for the second access database to obtain execution result data, and specifically configured to perform the following operations:

[0187] The second business processing request is parsed to obtain M query instructions included in the second business processing request and an instruction execution order corresponding to the M query instructions; M is a positive integer;

[0188] Based on the instruction execution order corresponding to the M query instructions, the second business processing request is split into M query statements, and the M query statements are executed for the second access database in sequence to obtain execution result data corresponding to the M query statements respectively.

[0189] In a possible implementation, the processor 801 is configured to data-filter the execution result data based on the output condition to obtain the business request data, and specifically configured to perform the following operations:

[0190] P data items included in the execution result data are obtained, and a filtering data column is obtained from the output condition; P is a positive integer;

[0191] group the P data items based on the screening data column, to obtain Q data groups; Q is a positive integer less than or equal to P, and each data group includes one or more data items;

[0192] perform data screening on the execution result data based on the number of data items included in each data group and Q, to obtain the service request data.

[0193] In a possible implementation, when the processor 801 is configured to send the request result for the first service processing request to the first service object based on the service request data, the processor 801 is specifically configured to perform the following operations:

[0194] determine the service request data as the request result for the first service processing request, and send the request result to the first service object;

[0195] Alternatively, the processor 801 is configured to perform the following operations:

[0196] In a possible implementation, the first permission information includes first permission information associated with the first service object; and when the processor 801 is configured to send the request result for the first service processing request to the first service object based on the service request data, the processor 801 is specifically configured to perform the following operations:

[0197] If the first access database includes the first access database of the first service object, the processor 801 is configured to send the request result for the first service processing request to the first service object based on the service request data, and send a data completion prompt message, so that the first service object determines to-be-requested service data from the first service processing request based on the first permission information of the first service object, obtains to-be-supplemented service data from the to-be-requested service data based on the first service processing request, and determines the to-be-supplemented service data and the request result as a target result of the first service processing request; the to-be-requested service data is service data in the first access database of the first service object, except for a second access database corresponding to the first service object.

[0198] In a possible implementation, the processor 801 is specifically configured to perform the following operations:

[0199] obtain permission information of a service object; the service object includes the first service object;

[0200] Create a cooperation space for a business object, store permission information of the business object in the cooperation space, and associate the cooperation space with a data storage space of the business object;

[0201] The processor 801 is configured to obtain first permission information associated with the first access database, and when creating the second access database based on the first permission information and the first access database, specifically configured to perform the following operations:

[0202] Obtain a request business object corresponding to the first access database, and obtain first permission information of the request business object from a request cooperation space corresponding to the request business object; the business object includes the request business object;

[0203] Request database content in the first access database from a data storage space associated with the request cooperation space through the request cooperation space corresponding to the request business object, and create the second access database based on the database content in the first access database.

[0204] In addition, it should be noted that the embodiments of the present application also provide a computer readable storage medium, which stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method provided by each step in FIG. 3 or FIG. 5, and the specific implementation can be referred to the implementation provided by each step in FIG. 3 or FIG. 5, and will not be described here. In addition, the beneficial effects of using the same method are not described again. For the technical details not disclosed in the computer readable storage medium embodiments of the present application, please refer to the description of the method embodiments of the present application. As an example, the computer program can be deployed to execute on one computer device, or execute on multiple computer devices located in one place, or execute on multiple computer devices distributed in multiple places and interconnected through a communication network.

[0205] The computer readable storage medium can be an internal storage unit of the apparatus provided by any of the foregoing embodiments or the computer device, for example, a hard disk or a memory of the computer device. The computer readable storage medium can also be an external storage device of the computer device, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the computer readable storage medium can include both the internal storage unit and the external storage device of the computer device. The computer readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer readable storage medium can also be used to temporarily store data that has been output or will be output.

[0206] The embodiment of the present application further provides a computer program product or computer program, which comprises computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional manners in FIG. 3 or FIG. 5, and therefore, details are not described herein again.

[0207] The terms "first", "second", and the like in the description and claims of the present application and the accompanying drawings are used to distinguish different objects, and are not used to describe a particular order. In addition, the term "comprising" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, device, product or equipment including a series of steps or units is not limited to the listed steps or units, but can optionally include other steps or units not listed, or can optionally include other steps or units inherent to the process, method, device, product or equipment.

[0208] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory) or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an integral module or unit that includes the functions of the module or unit.

[0209] Those of ordinary skill in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in general terms in the description. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0210] The method and related apparatus provided by the embodiments of the present application are described with reference to the method flowchart and / or structural schematic diagram provided by the embodiments of the present application, and each flow and / or block in the method flowchart and / or structural schematic diagram and the combination of the flows and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. The computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable devices to produce a machine, so that the instructions executed by the processor of the computer or other programmable devices produce a device that implements the functions specified in one or more flows in the flowchart and / or one or more blocks in the structural schematic diagram. The computer program instructions can also be stored in a computer readable memory that can cause the computer or other programmable devices to work in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including the instruction device, or are transmitted through the computer readable storage medium. The computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through a wired (for example, coaxial cable, optical fiber, digital line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) manner. The instruction device implements the functions specified in one or more flows in the flowchart and / or one or more blocks in the structural schematic diagram. The computer program instructions can also be loaded into the computer or other programmable devices, so that a series of operation steps are performed on the computer or other programmable devices to produce a computer-implemented process, so that the instructions executed on the computer or other programmable devices provide steps for implementing the functions specified in one or more flows in the flowchart and / or one or more blocks in the structural schematic diagram.

[0211] The steps in the method embodiments of the present application can be adjusted, combined and deleted in sequence according to actual needs.

[0212] The modules in the apparatus embodiments of the present application can be combined, divided and deleted according to actual needs.

[0213] The above disclosure is only the preferred embodiments of the present application, and of course cannot limit the scope of the rights of the present application, so the equivalent changes made according to the claims of the present application still fall within the scope of the present application.

Claims

1. A data processing method, characterized by, The method is executed by a computer device corresponding to a trusted third-party object, and comprises: obtaining a first service processing request sent by a first service object, determining a first access database based on the first service processing request; obtaining first permission information associated with the first access database, creating a second access database based on the first permission information and the first access database, and updating the first service processing request into a second service processing request based on the second access database; executing the second service processing request for the second access database to obtain service request data, and sending a request result for the first service processing request to the first service object based on the service request data.

2. The method of claim 1, wherein, The method further comprises: performing request analysis on the second service processing request to obtain request information corresponding to the second service processing request; performing permission verification on the request information based on the access permission associated with the second access database; 3. The method according to any one of claims 1 to 2, characterized in that, if the permission verification on the request information fails, sending a request failure message to the first service object; if the permission verification on the request information passes, executing the process of executing the second service processing request for the second access database to obtain service request data. The request information comprises a service keyword, to-be-accessed data columns corresponding to the service keyword, and a request query format. The permission verification on the request information based on the access permission associated with the second access database comprises:

4. The method according to any one of claims 1 to 3, characterized in that, determining an access range in the first permission information, obtaining accessible service data from the first access database based on the access range; determining a second database name based on a first database name of the first access database, taking the accessible service data as database content, and composing the second access database by combining the second database name with the database content. The number of the first access databases is N, and N is a positive integer. The method further comprises: obtaining request service objects corresponding to the N first access databases respectively; if the first service object is included in the N request service objects, determining a first access database of the first service object as a second access database of the first service object, creating a second access database of a second service object based on first permission information of the second service object and a first access database of the second service object, the second service object being a service object other than the first service object in the N request service objects.

5. The method of claim 4, wherein, The first permission information comprises access permission. The method further comprises: performing request analysis on the second service processing request to obtain request information corresponding to the second service processing request; performing permission verification on the request information based on the access permission associated with the second access database; if the permission verification on the request information fails, sending a request failure message to the first service object; if the permission verification on the request information passes, executing the process of executing the second service processing request for the second access database to obtain service request data. The request information comprises a service keyword, to-be-accessed data columns corresponding to the service keyword, and a request query format. The permission verification on the request information based on the access permission associated with the second access database comprises: determining an access range in the first permission information, obtaining accessible service data from the first access database based on the access range; determining a second database name based on a first database name of the first access database, taking the accessible service data as database content, and composing the second access database by combining the second database name with the database content. obtaining, from the access permission, an accessible data column corresponding to the business keyword, and determining that the permission verification of the request information is passed if the accessible data column includes the to-be-accessed data column and the request query format belongs to a permitted query format in the access permission, the permitted query format being used to indicate a number of query nesting layers allowed to be used for the second access database; determining that the permission verification of the request information is not passed if the accessible data column does not include the to-be-accessed data column or the request query format does not belong to the permitted query format in the access permission.

6. The method according to any one of claims 1 to 5, characterized in that, The first permission information includes an output condition, and the output condition is used to indicate a data condition allowed to be obtained by the first access database. The executing the second business processing request for the second access database to obtain execution result data includes: executing the second business processing request for the second access database to obtain execution result data; if the execution result data does not conform to the output condition, determining empty data as the business request data, or performing data filtering on the execution result data based on the output condition to obtain the business request data; if the execution result data conforms to the output condition, determining the execution result data as the business request data.

7. The method of claim 6, wherein, The executing the second business processing request for the second access database to obtain execution result data includes: parsing the second business processing request to obtain M query instructions included in the second business processing request and an instruction execution order corresponding to the M query instructions, M being a positive integer; based on the instruction execution order corresponding to the M query instructions, splitting the second business processing request into M query statements, and executing the M query statements for the second access database in sequence to obtain execution result data corresponding to the M query statements respectively.

8. The method of claim 6, wherein, The performing data filtering on the execution result data based on the output condition to obtain the business request data includes: obtaining P data items included in the execution result data, and obtaining a filtering data column from the output condition, P being a positive integer; grouping the P data items based on the filtering data column to obtain Q data groups, Q being a positive integer less than or equal to P, and each data group including one or more data items; performing data filtering on the execution result data based on a number of data items included in each data group and Q to obtain the business request data.

9. The method according to any one of claims 1 to 8, characterized in that, The sending, based on the business request data, a request result for the first business processing request to the first business object includes: determining the business request data as the request result for the first business processing request, and sending the request result to the first business object. Or, the business demand included in the first business processing request is acquired, the standard data index corresponding to the business demand is acquired, the business request data is statistically integrated based on the business demand, business statistical information is obtained, the business statistical information is analyzed based on the standard data index, business analysis results are obtained, the business request data and the business analysis results are determined as request results for the first business processing request, and the request results are sent to the first business object.

10. The method according to any one of claims 1 to 9, characterized in that, The first permission information includes first permission information associated with the first business object. The first permission information includes first permission information associated with the first business object. The first permission information includes first permission information associated with the first business object. If the first access database includes the first access database of the first business object, the request results for the first business processing request are sent to the first business object based on the business request data, and a data completion prompt message is sent to the first business object, so that the first business object determines to-be-requested business data from the first business processing request based on the first permission information of the first business object, and obtains to-be-supplemented business data from the to-be-requested business data based on the first business processing request, and determines the to-be-supplemented business data and the request results as target results of the first business processing request.

11. The method according to any one of claims 1 to 10, characterized in that, The to-be-requested business data is business data in the first access database of the first business object, except for the second access database corresponding to the first business object. The method further includes: Acquiring permission information of a business object, the business object including the first business object; Creating a cooperation space for the business object, storing the permission information of the business object in the cooperation space, and associating the cooperation space with a data storage space of the business object; The first permission information associated with the first access database is acquired, and the second access database is created based on the first permission information and the first access database, including: Acquiring a request business object corresponding to the first access database, acquiring first permission information of the request business object from a request cooperation space corresponding to the request business object, and the business object including the request business object; 12. A data processing apparatus, characterized by Requesting database content in the first access database from a data storage space associated with the request cooperation space through the request cooperation space corresponding to the request business object, and creating a second access database based on the database content in the first access database. The apparatus includes: A request acquisition module is configured to acquire a first business processing request sent by a first business object and determine a first access database based on the first business processing request. A data update module is configured to acquire first permission information associated with the first access database, create a second access database based on the first permission information and the first access database, and update the first business processing request to a second business processing request based on the second access database. A data execution module is configured to execute the second service processing request for the second access database to obtain service request data, and send a request result for the first service processing request to the first service object based on the service request data.

13. A computer device, comprising: The computer device comprises a processor, a memory and an input / output interface. The processor is connected with the memory and the input / output interface respectively, wherein the input / output interface is configured to receive and output data, the memory is configured to store a computer program, and the processor is configured to call the computer program to enable the computer device to execute the method in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is adapted to be loaded and executed by the processor to enable the computer device with the processor to execute the method in any one of claims 1-11.

15. A computer program product comprising computer programs / instructions, characterized in that, The computer program / instruction is executed by the processor to implement the method in any one of claims 1-11.

Images