CN115510464A - A dynamic authority control method, system and device - Google Patents

Abstract

The present invention relates to the technical field of information security, in particular to a dynamic authority control method, system and device. In the present invention, the viewing request input by the user is obtained, and the viewing content of the user in the data set is set through a visual interface, and it is judged whether the user has the authority corresponding to the viewing request, and if so, release, and display the operating authority of the data set , if not, intercept and prompt that there is no right to view. The technical solution of the present invention can greatly reduce the threshold and cost of database user authority control. Users do not need to know the professional details of various types of database authority control, and set the , greatly improving the efficiency of user rights management, and meeting the user's control needs for various business scenarios through data sets.

Description

A dynamic authority control method, system and device

technical field

The present invention relates to the technical field of information security, in particular to a dynamic authority control method, system and device.

Background technique

With the development of Internet applications, the efficiency of information storage and real-time exchange has also been greatly improved. At the same time, this also puts forward higher requirements for data sharing technology. Nowadays, data exchange in the form of an open network is mostly used in different fields. This highly open network can easily become the target of illegal attackers. How to ensure that all kinds of data Information security and ensuring the normal operation of various devices is a difficult problem that data sharing technology needs to solve.

At present, while enjoying the great convenience brought by the Internet, people are also worried about the security of their private data. As one of the cores of data security, access control technology can ensure that data can only be accessed by members with corresponding attribute permissions. Accessing different levels of shared resources with different attribute parameters enables flexible, dynamic, and fine-grained access to resources, which greatly improves data security.

In order to prevent illegal terminals without permission from joining inter-domain data sharing, terminal members need to perform identity authentication before sharing information resources, that is, the roles involved in database operation and maintenance usually include database Business people, developers or outsourcers. DBAs need to set different permissions according to different roles. For example, outsourcing personnel can only have viewing permissions for a few specified tables during the operation and maintenance process. The DBA generally controls the user's authority by using SQL commands to create users for specified roles in the database, and controls the user's authorization authority, so that the user can only view the authorized database information.

Contents of the invention

In view of this, the object of the present invention is to provide a dynamic authority control method, system and device to solve the problem of time-consuming access to the database for each additional user in the prior art, and the use of SQL commands to create and authorize user names and passwords for users. Difficult technical issues.

According to the first aspect of the embodiments of the present invention, a dynamic permission control method is provided, including:

Obtain the view request entered by the user;

Set the user's viewing content in the data set through the interface visualization method, and determine whether the user has the permission corresponding to the viewing request;

If yes, let it go, and display the operation authority of the dataset;

If not, block it and prompt that you have no right to view it.

Preferably, said obtaining the connection information of the database includes:

Obtain the IP address of the server where the database is located, the type of the database, the port number of the database connection, and the user name and password for database authentication.

Preferably, the setting of the viewing content of the user in the database includes:

The operation authority of database tables and fields, the frequency of users requesting data, the maximum amount of data returned, the IP address of users accessing data, and the time period.

Preferably, the operation authority of the described and displayed data set includes:

Data content: read permission, write permission, modify permission, delete permission, and/or, execute permission;

Data table: table addition permission, table deletion permission, table modification permission, table insert data permission, table query data permission, table delete data permission, table update data permission;

Row-level data range: When putting a data table into a dataset, filter the data that can be added to the dataset through filter conditions; when accessing a dataset, you can access the filtered row-level data.

Preferably, the method also includes:

Through data sets, authority control is performed on the data of multiple databases at the same time to meet the user's control needs in different business scenarios.

Preferably, business isolation authority control, when multiple business systems share a database, can control the users of A business department to only access the data of A business department, and the users of B business department can only access the data of B business department, and cannot visit each other.

Preferably, it also includes: outsourcing role authority control: authorized outsourcing personnel can only have the viewing authority of the specified table, and set the validity period of the authority, and the authority will be automatically recovered when it expires.

Preferably, it also includes: data analyst access control: setting the maximum number of data pieces returned by data analysts each time they request data through the management and control system.

According to the second aspect of the embodiments of the present invention, a dynamic authority control system is provided, which is applied to management and control terminals, including:

An acquisition module, configured to acquire a viewing request input by a user;

The setting module sets the user's viewing content in the data set through the interface visualization method, and determines whether the user has the permission corresponding to the viewing request;

If yes, let it go, and display the operation authority of the dataset;

If not, block it and prompt that you have no right to view it.

According to a third aspect of the embodiments of the present invention, there is provided a dynamic permission control device, including: the above-mentioned method.

The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

In the present invention, the viewing request input by the user is obtained, and the viewing content of the user in the data set is set through a visual interface, and it is judged whether the user has the permission corresponding to the viewing request, and if so, release, and display the operation permission of the data set , if not, intercept and prompt that there is no right to view. The technical solution of the present invention can greatly reduce the threshold and cost of database user authority control. Users do not need to know the professional details of various types of database authority control, and set the , greatly improving the efficiency of user rights management, and meeting the user's control needs for various business scenarios through data sets.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention.

Description of drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description serve to explain the principles of the invention.

Fig. 1 is a flow chart of a method for dynamic authority control according to an exemplary embodiment;

Fig. 2 is a schematic block diagram of a dynamic permission control system according to an exemplary embodiment.

detailed description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary examples do not represent all implementations consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with aspects of the invention as recited in the appended claims.

Embodiment one

In an embodiment, please refer to FIG. 1. FIG. 1 is a flow chart of a dynamic permission control method according to an exemplary embodiment. As shown in FIG. 1, the method includes:

Step S01, obtaining a viewing request input by a user;

Step S02: Set the viewing content of the user in the data set through a visualized interface, and determine whether the user has the permission corresponding to the viewing request;

Step S03, if yes, release, and display the operation authority of the data set;

If not, block it and prompt that you have no right to view it.

It should be noted that the technical solution provided by this embodiment is applicable to application scenarios such as banks, securities companies, insurance companies, etc. that need to restrict customer viewing authority, perform business isolation, control authority of outsourcing units, and use occasions such as data analysts.

It should be noted that the technical solution provided by this embodiment obtains the viewing request input by the user, sets the viewing content of the user in the data set through a visual interface, and determines whether the user has the authority corresponding to the viewing request. , release, and display the operation authority of the data set, if not, intercept, and prompt that there is no right to view, the technical solution of the present invention can greatly reduce the threshold and cost of database user authority control, and users do not need to understand the authority control of various types of databases The professional details are set through visual interaction, which greatly improves the efficiency of user rights management, and meets the user's management and control needs for various business scenarios through data sets.

It should be noted that the traditional authorization method is to directly create the corresponding user name and password in the database and control the user's authority. The dynamic authority control of the present invention means that it is not necessary to create and authorize users in the database, but to perform policy authorization on the management and control terminal. The management and control system will intercept all SQL requests of users, and dynamically judge users according to the policies set by users. Whether there is permission for SQL commands to decide whether to release or not.

It should be noted that the user only needs to precisely control the user's authority in the management and control system through a friendly and visual interface, without using professional tools to establish a connection with the database, and without writing professional SQL commands to control authority, which is more convenient It is fast and has low professional requirements for users.

In specific practice, the setting of the user's viewing content in the database includes:

The operation authority of database tables and fields, the frequency of users requesting data, the maximum amount of data returned, the IP address of users accessing data, and the time period.

In practice, the operation authority of the dataset is described and displayed, including:

Data content: read permission, write permission, modify permission, delete permission, and/or, execute permission;

Data table: table addition permission, table deletion permission, table modification permission, table insert data permission, table query data permission, table delete data permission, table update data permission;

Row-level data range: When putting a data table into a dataset, filter the data that can be added to the dataset through filter conditions; when accessing a dataset, you can access the filtered row-level data.

It should be noted that the user only needs to precisely control the user's operation authority to the database tables and fields, the frequency of the user's request for data, the maximum amount of data returned, and the user's access to data in the management and control system through a friendly and visual interface. IP address, time period, etc., without professional SQL commands to control permissions.

In specific practice, said method also includes:

Through data sets, authority control is performed on the data of multiple databases at the same time to meet the user's control needs in different business scenarios.

In practice, the method includes:

Business isolation authority control, when multiple business systems share a database, it can be controlled that users of A business department can only access the data of A business department, and users of B business department can only access the data of B business department, and cannot visit each other.

In specific practice, said method also includes:

Outsourcing role authority control: Authorized outsourcing personnel can only have the viewing authority of the specified table, and set the validity period of the authority, and the authority will be automatically revoked when it expires.

In specific practice, said method also includes:

Data analyst access control: Set the maximum number of data returned by data analysts each time they request data through the management and control system.

It should be noted that in business isolation authority control, when multiple business systems share a database, users in business department A can only access data in business department A, and users in business department B can only access data in business department B. Users of business department A cannot access the data of business department B, and users of business department B cannot access the data of business department A, that is, they cannot access each other.

It should be noted that in the control of outsourcing role permissions, the operation and maintenance of outsourced personnel is characterized by only requiring the query permissions of certain tables, and the permissions need to be recovered after a period of time. The management and control system can authorize outsourced personnel to only have the viewing authority of the specified table, and set the validity period of the authority, and the authority will be automatically revoked when it expires. The technical scheme of the invention is more practical and convenient.

It should be noted that in data analyst authority control, due to the characteristics of data analysts' use of data, they generally do not perform full data query, but use the calculated intermediate result data, and full data query is a relatively sensitive operation Therefore, this problem can be effectively avoided by setting the maximum number of data returned by data analyst users each time they request data through the visual interface in the management and control system.

Embodiment two

In an embodiment, please refer to FIG. 2 , which is a schematic block diagram of a dynamic permission control system 200 according to an exemplary embodiment. As shown in FIG. 2 , the system includes:

An acquisition module 201, configured to acquire a viewing request input by a user;

The setting module 202 is configured to set the viewing content of the user in the data set through a visualized interface, and determine whether the user has the corresponding authority of the viewing request;

Judgment module 203, if there is, release, and display the operation authority of the data set;

If not, block it and prompt that you have no right to view it.

It should be noted that the technical solution provided by this embodiment is applicable to application scenarios such as banks, securities companies, insurance companies, etc. that need to restrict customer viewing authority, perform business isolation, control authority of outsourcing units, and use occasions such as data analysts.

It should be noted that, in the technical solution of this embodiment, the obtaining module 201 is used to obtain the viewing request input by the user, and the setting module 202 is used to set the viewing content of the user in the data set through a visual interface, and judge the user's Whether there is the authority corresponding to the viewing request, the judging module 203, if yes, let it go, and display the operation authority of the data set, if not, intercept, and prompt that you have no right to view, the technical solution of the present invention can greatly reduce the impact on database users. The threshold and cost of authority control, users do not need to know the professional details of authority control for various types of databases, through the setting of visual interaction, the efficiency of user authority management is greatly improved, and the data set is used to meet the needs of users for various business scenarios control needs.

Embodiment Three

A dynamic permission control device is characterized by including the above-mentioned method.

It should be noted that the technical solution provided by this embodiment is applicable to application scenarios such as banks, securities companies, insurance companies, etc. that need to restrict customer viewing authority, perform business isolation, control authority of outsourcing units, and use occasions such as data analysts.

It can be understood that in the present invention, the viewing request input by the user is obtained, and the viewing content of the user in the data set is set through the interface visualization mode, and it is judged whether the user has the permission corresponding to the viewing request, and if so, it is released and displayed If there is no operation authority for the data set, it will be intercepted and prompted to view without permission. The technical solution of the present invention can greatly reduce the threshold and cost of authority control for database users. Users do not need to know the professional details of authority control for various types of databases. The setting of visual interaction greatly improves the efficiency of user rights management, and meets the user's management and control needs for various business scenarios through data sets.

The computer-readable storage medium disclosed in this embodiment includes, but is not limited to: electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or devices, or any combination thereof. More specific examples (non-exhaustive list) of computer readable storage media include: electrical connections with one or more leads, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), Erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

It can be understood that, the same or similar parts in the above embodiments can be referred to each other, and the content that is not described in detail in some embodiments can be referred to the same or similar content in other embodiments.

Any process or method descriptions in flowcharts or otherwise described herein may be understood to represent modules, segments or portions of code comprising one or more executable instructions for implementing specific logical functions or steps of the process , and the scope of preferred embodiments of the invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including substantially concurrently or in reverse order depending on the functions involved, which shall It is understood by those skilled in the art to which the embodiments of the present invention pertain.

It should be understood that various parts of the present invention can be realized by hardware, software, firmware or their combination. In the embodiments described above, various steps or methods may be implemented by software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques known in the art: Discrete logic circuits, ASICs with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

Those of ordinary skill in the art can understand that all or part of the steps carried by the methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. During execution, one or a combination of the steps of the method embodiments is included.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing module, each unit may exist separately physically, or two or more units may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules. If the integrated modules are realized in the form of software function modules and sold or used as independent products, they can also be stored in a computer-readable storage medium.

The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, and the like.

In the description of this specification, descriptions referring to the terms "one embodiment", "some embodiments", "example", "specific examples", or "some examples" mean that specific features described in connection with the embodiment or example , structure, material or characteristic is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention, those skilled in the art can make the above-mentioned The embodiments are subject to changes, modifications, substitutions and variations.

Claims (9)

1. A dynamic authority control method is applied to a management and control system and is characterized by comprising the following steps:

acquiring a viewing request input by a user;

setting the viewing content of a user in a data set in an interface visualization mode, and judging whether the user has the authority corresponding to the viewing request;

if yes, releasing and displaying the operation authority of the data set;

if not, intercepting and prompting that the user has no right to check.

2. The method of claim 1, wherein the setting of the user's viewing content in the database comprises:

the operation authority of the database table and the field, the frequency of data request of the user, the maximum data volume returned, the IP address of the data access of the user and the time period.

3. The method of claim 1, wherein the merging and displaying the operational rights of the data set comprises:

data content: read permission, write permission, modify permission, delete permission, and/or execute permission;

data table: table adding authority, table deleting authority, table modifying authority, table inserting data authority, table inquiring data authority, table deleting data authority and table updating data authority;

line level data range: when the data table is put into the data set, screening out data which can be added into the data set through filtering conditions; the screened row level data may be accessed when accessing the data set.

4. The method of any of claims 1-3, further comprising:

and simultaneously carrying out authority control on the data of the multiple databases in a data set mode so as to meet the control requirements of users on different service scenes.

5. The method of claim 4, comprising:

and when a plurality of service systems share one database, the service isolation authority control can control that the users in the service department A can only access the data in the service department A, and the users in the service department B can only access the data in the service department B, so that the users cannot access each other.

6. The method of claim 4, further comprising: outsourcing role authority control: the authorized outsourcing personnel only have the viewing authority of the appointed table, the validity period of the authority is set, and the authority is automatically recovered after expiration.

7. The method of claim 4, further comprising: and (3) controlling the authority of a data analyst: and setting the maximum data number returned by the data analyst requesting data each time through the management and control system.

8. The utility model provides a dynamic authority control system, is applied to management and control terminal, its characterized in that includes:

the acquisition module is used for acquiring a viewing request input by a user;

the setting module is used for setting the viewing content of the user in the data set in an interface visualization mode and judging whether the user has the authority corresponding to the viewing request;

the judging module, if there is, release, and display the operation authority of the data set;

if not, intercepting and prompting that the user has no right to check.

9. A dynamic rights control device comprising a method as claimed in any one of claims 1 to 7.

Images