CN115168836A - Data permission isolation method based on ORM framework - Google Patents

Abstract

The invention discloses a data authority isolation method based on an ORM framework, and relates to the technical field of data security; a Java-based database persistence layer framework configures a user's data authority, and uses a custom annotation to mark a data owner field in a mapping class through the ORM framework , through the ORM framework custom interceptor, according to the user's data query request, to obtain the user's data authority and the data owner field of the data master table, and modify the user's data authority and data The SQL statement corresponding to the owner field of the database needs to be executed , execute the modified SQL statement to complete the data permission control.

Description

A Data Privilege Isolation Method Based on ORM Framework

technical field

The invention discloses a method, which relates to the technical field of data security, in particular to a data authority isolation method based on an ORM framework.

Background technique

In the construction of the business platform, it is usually necessary to consider the control and isolation of various permissions, such as page permissions, interface permissions, data permissions, etc. In the general RBAC permission model, there is general and better support for page permissions and interface permissions, but For data permissions, for example, for a certain kind of data, only the data owner can view it, or people in the same department as the data owner can view it. The implementation process of this scenario usually uses hard coding, but modifying the hard coding is more complicated and insufficient. Friendly, and involves the entire process of recoding, testing, publishing, etc., which is time-consuming and labor-intensive.

SUMMARY OF THE INVENTION

Aiming at the problems of the prior art, the present invention provides a data authority isolation method based on an ORM framework, which has the characteristics of strong versatility, easy implementation and the like, and has broad application prospects.

The concrete scheme proposed by the present invention is:

The invention provides a data authority isolation method based on an ORM framework, a database persistence layer framework based on java, configures a user's data authority, and uses a custom annotation to mark the data owner field in the mapping class through the ORM framework,

Through the ORM framework custom interceptor, according to the user's data query request, the user's data authority and the data owner field of the data master table are obtained, and the SQL statement to be executed by the database corresponding to the user's data authority and the data owner field is modified, Execute the modified SQL statement to complete data permission control.

Further, in the described ORM framework-based data authority isolation method, based on Mybatis, the user's data authority is configured, and the data owner field is marked with a custom annotation in the mapping class through the ORM framework,

Through the ORM framework custom interceptor, according to the user's data query request, the user's data authority and the data owner field of the data master table are obtained, and the SQL statement to be executed by the database corresponding to the user's data authority and the data owner field is modified, Execute the modified SQL statement to complete data permission control.

Further, according to the data query request of the user, in the described data authority isolation method based on the ORM framework, the SQL statement that needs to be executed by the database is assembled and output by Mybatis, and the user is obtained according to the data query request of the user through the custom interceptor. The data authority and the data owner field of the data master table, modify the SQL statement that the database needs to execute.

Further, in the described data authority isolation method based on ORM framework, the SQL statement that the database corresponding to the data authority of the user and the data owner field needs to be executed, including:

Added WHERE condition to filter the output SQL statement.

The present invention also provides a data authority isolation system based on the ORM framework, comprising a persistence layer module and a mapping module,

The persistence layer module is based on the Java database persistence layer framework to configure the user's data permissions. The mapping module uses the ORM framework to mark the data owner field with custom annotations in the mapping class.

The mapping module obtains the user's data authority and the data owner field of the data master table according to the user's data query request through the ORM framework custom interceptor, and modifies the SQL that the database corresponding to the user's data authority and the data owner field needs to execute statement, execute the modified SQL statement to complete data permission control.

Further, the persistent layer module in the described ORM framework-based data authority isolation system is based on Mybatis, configures the user's data authority, and the mapping module uses the ORM framework to use custom annotations in the mapping class to mark the data owner field,

The mapping module obtains the user's data authority and the data owner field of the data master table according to the user's data query request through the ORM framework custom interceptor, and modifies the SQL that the database corresponding to the user's data authority and the data owner field needs to execute statement, execute the modified SQL statement to complete data permission control.

Further, in the described data authority isolation system based on the ORM framework, the persistent layer module assembles and outputs the SQL statement that the database needs to execute according to the user's data query request, and the mapping module uses the custom interceptor according to the user's data query request. The data query request obtains the user's data authority and the data owner field of the data master table, and modifies the SQL statement to be executed by the database.

Further, in the described data authority isolation system based on the ORM framework, the mapping module modifies the SQL statement that the database corresponding to the data authority of the user and the data owner field needs to execute, including:

Added WHERE condition to filter the output SQL statement.

The benefits of the present invention are:

The invention provides a data authority isolation method based on the ORM framework. Based on the ORM framework, the data authority isolation in a general business scenario can be realized, and the data authority can be controlled without invading business codes and hard codes, and users can be changed through configuration. The data authority can be implemented in real time through the interceptor, and the SQL statement can be modified and executed, which improves the efficiency of coding and business implementation, and reduces the cost of business coding implementation.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are For some embodiments of the present invention, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without any creative effort.

FIG. 1 is a schematic diagram of a data rights isolation process in the prior art.

FIG. 2 is a schematic diagram of the data rights isolation flow of the present invention.

3 is a schematic diagram of the application of the method of the present invention.

Detailed ways

The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

The invention provides a data authority isolation method based on an ORM framework, a database persistence layer framework based on java, configures a user's data authority, and uses a custom annotation to mark the data owner field in the mapping class through the ORM framework,

Through the ORM framework custom interceptor, according to the user's data query request, the user's data authority and the data owner field of the data master table are obtained, and the SQL statement to be executed by the database corresponding to the user's data authority and the data owner field is modified, Execute the modified SQL statement to complete data permission control.

The data permission isolation technology based on the ORM framework (Object Relational Mapping, ORM for short) is used to solve the problem of data permission isolation in general business scenarios.

The data authority management mode of the method of the present invention can be completed through configuration, does not invade business codes, and has relatively good practical effects.

In specific applications, in some embodiments of the method of the present invention, the specific implementation process is described by taking Mybatis as an example.

The above permission control is implemented based on Mybatis and configuration. In the mapping class with the database table through the ORM framework, the fields of the data owner, such as the data creator, are marked with custom annotations. Secondly, the Mybatis framework is used in the configurable The user's data permission is configured on the page, for example, it can be configured to view the department. At this point, the preparatory work is completed, and the user can initiate business operations.

When the user initiates a data query request, the Mybatis framework assembles and outputs the SQL statements that the database needs to execute. During this process, the Mybatis interceptor customized by the ORM framework reads the data permission configuration of the current user, and reads the current read The data owner field of the main data table, the data owner field has been marked in the code through annotations, the SQL statement is modified according to the data permission configuration and the data owner field, and additional WHERE conditions are added to filter the output statement, so as to achieve data permission purpose of control.

Further, for example, there is a piece of data A in the database, the owner of the data is determined by the creator field, and the department that owns the data is determined by the department field. It is assumed that this piece of data can be viewed by people in the same department, that is, "View data created by me". For example, in the prior art, the determination of “whether the viewer department is the same as the target data department” is generally determined by hard coding. If the determination method changes, it needs to be implemented by modifying the code, which is complicated and not friendly enough.

For example, in the judgment method of "whether the viewing department is the same as the target data department", the SQL code may be "SELECT*FROM TABLE WHERE dept=viewing person department;", if the judgment method is changed to "view the data created by me", you need to Modifying the SQL to "SELECT*FROM TABLE WHERE createUser=Viewer;" involves the entire process of recoding, testing, and publishing, which is time-consuming and labor-intensive.

And the SQL that Mybatis initially generates in the method of the present invention is shown as follows:

SELECT*FROM TABLE;

The data permission configured by the administrator for user A is "view data created by me";

The data owner field of TABLE data in the code is "createUser", and the code is as follows:

After user A initiates a viewing request for TABLE data, the SQL received by the ORM framework custom interceptor is "SELECT*FROM TABLE;", the data permission for reading user A is "view data created by me", and the data owner field If it is "createUser", you can modify the final executed SQL "SELECT*FROM TABLE;" to "SELECT*FROM TABLEWHERE createUser=A;", and execute it to return the result.

After the above process, it is possible to realize the control of data permissions without invading business code and hard coding, and if you need to modify the user's data permissions, you can change it through configuration. This configuration can take effect in real time in the interceptor. If you need to add other data permission types, you can expand it in the above way, and the principle is the same.

The above takes Mybatis as an example to implement a specific data rights management model, and the implementation principles of other ORM frameworks are the same.

The present invention also provides a data authority isolation system based on the ORM framework, comprising a persistence layer module and a mapping module,

The persistence layer module is based on the Java database persistence layer framework to configure the user's data permissions. The mapping module uses the ORM framework to mark the data owner field with custom annotations in the mapping class.

The mapping module obtains the user's data authority and the data owner field of the data master table according to the user's data query request through the ORM framework custom interceptor, and modifies the SQL that the database corresponding to the user's data authority and the data owner field needs to execute statement, execute the modified SQL statement to complete data permission control.

Since the information exchange and execution process among the modules in the above system are based on the same concept as the method embodiment of the present invention, the specific content can be found in the description in the method embodiment of the present invention, which will not be repeated here.

Similarly, based on the ORM framework, the system of the present invention realizes the isolation of data rights in general business scenarios, can realize the control of data rights without invading business codes and hard codes, and can change the user's data rights through configuration, and through the interceptor Effective in real time, modify and execute SQL statements, improve the efficiency of coding and business implementation, and reduce the cost of business coding implementation.

It should be noted that not all steps and modules in the above processes and system structures are necessary, and some steps or modules may be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as required. The system structure described in the above embodiments may be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or may be implemented by multiple physical entities. Some components in separate devices are implemented together.

The above-mentioned embodiments are only preferred embodiments for fully illustrating the present invention, and the protection scope of the present invention is not limited thereto. Equivalent substitutions or transformations made by those skilled in the art on the basis of the present invention are all within the protection scope of the present invention. The protection scope of the present invention is subject to the claims.

Claims (8)

1. A data authority isolation method based on an ORM framework, characterized in that a database persistence layer framework based on java, configures a user's data authority, and uses a custom annotation to mark the data owner field in the mapping class through the ORM framework, Through the ORM framework custom interceptor, according to the user's data query request, the user's data authority and the data owner field of the data master table are obtained, and the SQL statement to be executed by the database corresponding to the user's data authority and the data owner field is modified, Execute the modified SQL statement to complete data permission control. 2. a kind of data authority isolation method based on ORM framework according to claim 1, it is characterized in that based on Mybatis, configure the data authority of user, use self-defined annotation mark data owner field in mapping class by ORM framework, Through the ORM framework custom interceptor, according to the user's data query request, the user's data authority and the data owner field of the data master table are obtained, and the SQL statement to be executed by the database corresponding to the user's data authority and the data owner field is modified, Execute the modified SQL statement to complete data permission control. 3. a kind of data authority isolation method based on ORM framework according to claim 2, it is characterized in that according to the data query request of user, by Mybatis assemble and output the SQL statement that database needs to execute, by self-defined interceptor according to described The user's data query request obtains the user's data authority and the data owner field of the data master table, and modifies the SQL statement to be executed by the database. 4. a kind of data authority isolation method based on ORM framework according to any one of claim 1-3, it is characterized in that the SQL statement that the database corresponding to the data authority of described modification described user and data owner field needs to execute ,include: Added WHERE condition to filter the output SQL statement. 5. a data authority isolation system based on ORM framework, is characterized in that comprising persistence layer module and mapping module, The persistence layer module is based on the Java database persistence layer framework to configure the user's data permissions. The mapping module uses the ORM framework to mark the data owner field with custom annotations in the mapping class. The mapping module obtains the user's data authority and the data owner field of the data master table according to the user's data query request through the ORM framework custom interceptor, and modifies the SQL that the database corresponding to the user's data authority and the data owner field needs to execute statement, execute the modified SQL statement to complete data permission control. 6. a kind of data authority isolation system based on ORM framework according to claim 5, it is characterized in that persistence layer module is based on Mybatis, configures user's data authority, and mapping module uses self-defined annotation mark data in mapping class by ORM framework owning field, The mapping module obtains the user's data authority and the data owner field of the data master table according to the user's data query request through the ORM framework custom interceptor, and modifies the SQL that the database corresponding to the user's data authority and the data owner field needs to execute statement, execute the modified SQL statement to complete data permission control. 7. a kind of data authority isolation system based on ORM framework according to claim 6, it is characterized in that persistence layer module according to user's data query request, is assembled by Mybatis and outputs the SQL statement that database needs to execute, the mapping module is through self-defining The interceptor obtains the user's data authority and the data owner field of the data master table according to the user's data query request, and modifies the SQL statement to be executed by the database. 8. a kind of data authority isolation system based on ORM framework according to any one of claim 5-7, it is characterized in that described mapping module revises described user's data authority and the database corresponding to data owner field needs to perform. SQL statements, including: Added WHERE condition to filter the output SQL statement.

Images