CN116226164A - A data isolation method, device, electronic equipment and storage medium - Google Patents

Abstract

The present application provides a data isolation method, device, electronic equipment, and storage medium, the method including: obtaining user login information; according to the user login information, calling the corresponding data display page; according to the isolation conditions corresponding to the data list in the data display page , to generate target database statement fragments; splicing the target database statement fragments into the basic database statement of the data list to obtain the target database statement; calling the target data based on the target database statement, and displaying the target data in the data list. In the method provided by the above solution, by binding the isolation condition to the data list, the data in the database must be bound to the corresponding data list to ensure that the data can achieve data isolation, thereby improving the security of the data.

Description

A data isolation method, device, electronic equipment and storage medium

technical field

The present application relates to the technical field of data management, and in particular to a data isolation method, device, electronic equipment and storage medium.

Background technique

At present, both the enterprise management system and the engineering management system are oriented to a large number of users. In the environment of a large number of users and a complex permission system, data isolation technology is generally used to strictly control the data display.

In the existing technology, the role-bound department is usually isolated. When the user obtains data, the relevant data of the department bound to the user will be obtained. If there is business data that is not associated with the department, the business data will not be able to achieve data isolation, reducing the Data Security.

Contents of the invention

The present application provides a data isolation method, device, electronic equipment, and storage medium to solve defects such as lowering data security in the prior art.

The first aspect of this application provides a data isolation method, including:

Obtain user login information;

Call the corresponding data display page according to the user login information;

Generate target database statement fragments according to the isolation conditions corresponding to the data list in the data display page;

Splicing the target database statement fragments into the basic database statement of the data list to obtain the target database statement;

calling target data based on the target database statement, and displaying the target data in the data list.

Optionally, calling the corresponding data display page according to the user login information includes:

Determine the isolation dimension of the user according to the user login information; wherein, the isolation dimension is at least divided into three types: department, role and personnel;

According to the user's isolation dimension, determine the corresponding target isolation strategy;

According to the target isolation strategy, the corresponding data display page is called.

Optionally, the determining the isolation dimension of the user according to the user login information includes:

According to the association type represented by the user's login information, the isolation dimension of the user is determined.

Optionally, the determining the isolation dimension of the user according to the association type represented by the user login information includes:

When the user login information indicates that the user includes two or more association types, determine the target association type according to the priority of each association type;

According to the target association type, the isolation dimension of the user is determined.

Optionally, according to the isolation conditions corresponding to the data list in the data display page, generating target database statement fragments includes:

According to the isolation condition corresponding to the data list in the data display page, determine the corresponding isolation script and dimension logic;

Generate target database statement fragments according to the isolation script and dimension logic.

Optionally, also include:

According to the isolation condition corresponding to the data list in the data display page, it is judged whether the current isolation dimension includes a subquery;

If the current isolation dimension includes a subquery, obtain the dimension field corresponding to the subquery;

Adding the dimension field to the target database statement fragment.

Optionally, the invoking target data based on the target database statement includes:

Call the database query script interface;

Based on the database query script interface, the target database statement is input into a preset database, so as to call the target data in the preset database.

The second aspect of the present application provides a data isolation device, including:

The acquisition module is used to obtain user login information;

A page calling module, configured to call a corresponding data display page according to the user login information;

A generating module, configured to generate target database statement fragments according to the isolation condition corresponding to the data list in the data display page;

A splicing module, configured to splice the target database statement fragments into the basic database statement of the data list to obtain the target database statement;

The data calling module is used for calling target data based on the target database statement, and displaying the target data in the data list.

Optionally, the page calling module is specifically used for:

Determine the isolation dimension of the user according to the user login information; wherein, the isolation dimension is at least divided into three types: department, role and personnel;

According to the user's isolation dimension, determine the corresponding target isolation strategy;

According to the target isolation strategy, the corresponding data display page is called.

Optionally, the page calling module is specifically used for:

According to the association type represented by the user's login information, the isolation dimension of the user is determined.

Optionally, the page calling module is specifically used for:

When the user login information indicates that the user includes two or more association types, determine the target association type according to the priority of each association type;

According to the target association type, the isolation dimension of the user is determined.

Optionally, the generating module is specifically used for:

According to the isolation condition corresponding to the data list in the data display page, determine the corresponding isolation script and dimension logic;

Generate target database statement fragments according to the isolation script and dimension logic.

Optionally, the generating module is also used for:

According to the isolation condition corresponding to the data list in the data display page, it is judged whether the current isolation dimension includes a subquery;

If the current isolation dimension includes a subquery, obtain the dimension field corresponding to the subquery;

Adding the dimension field to the target database statement fragment.

Optionally, the data calling module is specifically used for:

Call the database query script interface;

Based on the database query script interface, the target database statement is input into a preset database, so as to call the target data in the preset database.

A third aspect of the present application provides an electronic device, including: at least one processor and a memory;

the memory stores computer-executable instructions;

The at least one processor executes the computer-executed instructions stored in the memory, so that the at least one processor executes the method described in the above first aspect and various possible designs of the first aspect.

The fourth aspect of the present application provides a computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the above first aspect and the first Aspects of various possible designs of the described method.

The technical solution of the present application has the following advantages:

The present application provides a data isolation method, device, electronic equipment and storage medium, the method comprising: obtaining user login information; according to the user login information, calling the corresponding data display page; according to the isolation condition corresponding to the data list in the data display page , to generate target database statement fragments; splicing the target database statement fragments into the basic database statement of the data list to obtain the target database statement; calling the target data based on the target database statement, and displaying the target data in the data list. In the method provided by the above solution, by binding the isolation condition to the data list, the data in the database must be bound to the corresponding data list to ensure that the data can achieve data isolation, thereby improving the security of the data.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present application, and those skilled in the art can also obtain other drawings based on these drawings.

FIG. 1 is a schematic structural diagram of the data isolation system based on the embodiment of the present application;

FIG. 2 is a schematic flow diagram of a data isolation method provided in an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a data isolation device provided in an embodiment of the present application;

FIG. 4 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

By means of the above drawings, specific embodiments of the present application have been shown, which will be described in more detail hereinafter. These drawings and written description are not intended to limit the scope of the disclosed concept in any way, but to illustrate the concept of the application for those skilled in the art by referring to specific embodiments.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of this application.

In addition, the terms "first", "second", etc. are used for descriptive purposes only, and should not be understood as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. In the descriptions of the following embodiments, "plurality" means two or more, unless otherwise specifically defined.

In the existing technology, the role-bound department is usually isolated. When the user obtains data, the relevant data of the department bound to the user will be obtained. If there is business data that is not associated with the department, the business data will not be able to achieve data isolation, reducing the Data Security.

In view of the above problems, the data isolation method, device, electronic equipment, and storage medium provided by the embodiments of the present application obtain user login information; retrieve the corresponding data display page according to the user login information; Isolate conditions to generate target database statement fragments; splice the target database statement fragments into the basic database statement of the data list to obtain the target database statement; call the target data based on the target database statement, and display the target data in the data list. In the method provided by the above solution, by binding the isolation condition to the data list, the data in the database must be bound to the corresponding data list to ensure that the data can achieve data isolation, thereby improving the security of the data.

The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. Embodiments of the present invention will be described below in conjunction with the accompanying drawings.

First, explain the structure of the data isolation system on which this application is based:

The data isolation method, device, electronic device, and storage medium provided in the embodiments of the present application are suitable for data isolation in data systems such as enterprise management systems or engineering management systems. As shown in FIG. 1 , it is a schematic structural diagram of the data isolation system based on the embodiment of the present application, which mainly includes a web front-end service, a database, and a data isolation device. Specifically, the user inputs login information to the web front-end service, and the data isolation device obtains the user login information from the web front-end service, and then calls the target data in the database according to the user login information, and displays it to the user through the web front-end service for the user to read. Pick.

The embodiment of the present application provides a data isolation method, which is used for data isolation in a data system such as an enterprise management system or an engineering management system. The execution subject of the embodiment of the present application is an electronic device, such as a server, a desktop computer, a notebook computer, a tablet computer, and other electronic devices that can be used for data isolation.

As shown in Figure 2, it is a schematic flow diagram of the data isolation method provided by the embodiment of the present application, the method includes:

Step 201, obtain user login information.

Wherein, the user login information at least includes the user name and password input by the user to the web front-end service.

Step 202, call the corresponding data display page according to the user login information.

Specifically, the user's access authority can be determined according to the user's login information, and then the corresponding data display page is called in the web front-end service, and the data display page includes display boxes of all information accessible to the user.

Step 203, generate target database statement fragments according to the isolation condition corresponding to the data list in the data display page.

It should be noted that the data display page includes multiple data lists, and different data lists display different types of data, and each data list corresponds to a display frame. The isolation conditions include multiple isolation parameters, with fixed values and dynamic values,

Specifically, for any data list in the data presentation page, the corresponding target database statement fragment can be generated according to the isolation condition bound to the data list.

Specifically, in one embodiment, the corresponding isolation script and dimension logic can be determined according to the isolation condition corresponding to the data list in the data display page; and the target database statement fragment can be generated according to the isolation script and dimension logic.

Among them, the isolation script includes query fields, and the dimension logic includes intersection and union.

Specifically, according to the preset standards for writing data statements, and according to the isolation conditions corresponding to the data list in the data display page, determine the corresponding isolation script and dimension logic, and then generate target database statement fragments. Wherein, the statement fragment of the target database may be an SQL statement.

Step 204, splicing target database statement fragments into the basic database statement of the data list to obtain the target database statement.

Specifically, the basic database statement can be determined according to the attribute information of the data list itself, and the target database statement can be obtained by splicing target database statement fragments into the basic database statement.

Step 205, call the target data based on the target database statement, and display the target data in the data list.

Specifically, the target database statement can be input into the preset database, so as to call the corresponding target data in the preset database.

Specifically, in an embodiment, the database query script interface may be invoked; based on the database query script interface, the target database statement is input into the preset database, so as to call the target data in the preset database.

Specifically, the database query script interface can be invoked based on the preset vform service, and then based on the database query script interface, the target database statement can be input into the preset database.

On the basis of the above embodiments, as an implementable manner, in one embodiment, according to the user login information, call the corresponding data display page, including:

Step 2021, according to the user login information, determine the isolation dimension of the user; wherein, the isolation dimension is divided into at least three types: department, role and personnel;

Step 2022, according to the isolation dimension of the user, determine the corresponding target isolation strategy;

Step 2023, call the corresponding data display page according to the target isolation policy.

Specifically, the isolation dimension corresponding to the user name represented by the user login information can be determined according to the preset correspondence between the user name and the isolation dimension, and then the target isolation strategy corresponding to the isolation dimension can be determined. Finally, according to the target isolation strategy, determine The user's data access rights, and call the data display page that meets the data access rights.

Specifically, in an embodiment, the user's isolation dimension may be determined according to the association type represented by the user's login information.

It should be noted that the association type can also be divided into three types: department, role and personnel.

Specifically, in one embodiment, when the user login information indicates that the user includes two or more association types, the target association type is determined according to the priority of each association type; and the isolation dimension of the user is determined according to the target association type.

Exemplarily, if the priority of the association type from high to low is personnel, role, and department, and the current user login information indicates that the user includes two association types of personnel and roles, then determine personnel as the target association type of the user , and then the isolation dimension of person is determined as the isolation dimension of the user.

On the basis of the above-mentioned embodiments, in order to improve the flexibility of data isolation while improving data security, as an implementable manner, in one embodiment, the method further includes:

Step 301, according to the isolation condition corresponding to the data list in the data display page, determine whether the current isolation dimension includes a subquery;

Step 302, if the current isolation dimension includes a subquery, obtain the dimension field corresponding to the subquery;

Step 303, adding the dimension field to the statement fragment of the target database.

It should be noted that the subquery may specifically refer to a data filtering query.

Specifically, when the current isolation dimension includes a subquery, a text input box can be generated so that the user can enter a dimension field in the text input box to obtain the dimension field corresponding to the subquery, and then add the dimension field to the target The database statement fragment realizes the user-defined subquery and improves the flexibility of data isolation.

Among them, considering the security of the system, the dimension field corresponding to the subquery is not allowed to be entered and displayed on the front end of the web. To ensure normal isolation, the user can enter through the background database account.

The data isolation method provided by the embodiment of the present application obtains the user login information; according to the user login information, the corresponding data display page is called; according to the isolation conditions corresponding to the data list in the data display page, the target database sentence fragment is generated; the target database The statement fragment is spliced into the basic database statement of the data list to obtain the target database statement; the target data is called based on the target database statement, and the target data is displayed in the data list. In the method provided by the above solution, by binding the isolation condition to the data list, the data in the database must be bound to the corresponding data list to ensure that the data can achieve data isolation, thereby improving the security of the data. And, according to the isolation condition corresponding to the data list in the data display page, it is judged whether the current isolation dimension includes a subquery; if the current isolation dimension includes a subquery, obtain the dimension field corresponding to the subquery; add the dimension field to the target The database statement fragment realizes the user-defined subquery and improves the flexibility of data isolation.

An embodiment of the present application provides a data isolation device, configured to implement the data isolation method provided in the foregoing embodiments.

As shown in FIG. 3 , it is a schematic structural diagram of the data isolation device provided by the embodiment of the present application. The data isolation device 30 includes: an acquiring module 301 , a page calling module 302 , a generating module 303 , a splicing module 304 and a data calling module 305 .

Among them, the acquisition module is used to obtain user login information; the page call module is used to call the corresponding data display page according to the user login information; the generation module is used to generate The target database statement fragment; the splicing module is used to splice the target database statement fragment into the basic database statement of the data list to obtain the target database statement; the data calling module is used to call the target data based on the target database statement and display the target data on the data list.

Specifically, in one embodiment, the page calling module is specifically used for:

Determine the user's isolation dimension according to the user's login information; among them, the isolation dimension is divided into at least three types: department, role, and person;

According to the user's isolation dimension, determine the corresponding target isolation strategy;

Call the corresponding data display page according to the target isolation strategy.

Specifically, in one embodiment, the page calling module is specifically used for:

Determine the user's isolation dimension according to the association type represented by the user's login information.

Specifically, in one embodiment, the page calling module is specifically used for:

When the user login information indicates that the user includes two or more association types, determine the target association type according to the priority of each association type;

Determine the user's isolation dimension according to the target association type.

Specifically, in an embodiment, the generating module is specifically used for:

Determine the corresponding isolation script and dimension logic according to the isolation conditions corresponding to the data list in the data display page;

According to the isolation script and dimension logic, generate target database statement fragments.

Specifically, in one embodiment, the generating module is also used for:

According to the isolation conditions corresponding to the data list in the data display page, determine whether the current isolation dimension includes subqueries;

If the current isolation dimension includes a subquery, obtain the dimension field corresponding to the subquery;

Add dimension fields to target database statement fragments.

Specifically, in one embodiment, the data calling module is specifically used for:

Call the database query script interface;

Based on the database query script interface, the target database statement is input into the preset database, so as to call the target data in the preset database.

Regarding the data isolation device in this embodiment, the specific manner in which each module executes operations has been described in detail in the embodiment of the method, and will not be described in detail here.

The data isolation device provided in the embodiment of the present application is used to implement the data isolation method provided in the above embodiment, and its implementation method is the same as the principle, and will not be repeated here.

An embodiment of the present application provides an electronic device configured to implement the data isolation method provided in the foregoing embodiments.

As shown in FIG. 4 , it is a schematic structural diagram of an electronic device provided in an embodiment of the present application. The electronic device 40 includes: at least one processor 41 and a memory 42 .

The memory stores computer-executable instructions; at least one processor executes the computer-executable instructions stored in the memory, so that at least one processor executes the data isolation method provided in the above embodiments.

An electronic device provided in the embodiment of the present application is used to execute the data isolation method provided in the above embodiment, and the implementation method is the same as the principle, and will not be repeated here.

An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored, and when a processor executes the computer-executable instructions, the data isolation method provided in any one of the above embodiments is implemented.

The storage medium containing the computer-executable instructions in the embodiment of the present application can be used to store the computer-executable instructions of the data isolation method provided in the foregoing embodiments, and the implementation method is the same as the principle, and will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

A unit described as a separate component may or may not be physically separated, and a component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above-mentioned integrated units implemented in the form of software functional units may be stored in a computer-readable storage medium. The above-mentioned software functional units are stored in a storage medium, and include several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (processor) execute the method described in each embodiment of the present application. partial steps. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other various media that can store program codes. .

Those skilled in the art can clearly understand that for the convenience and brevity of the description, only the division of the above-mentioned functional modules is used as an example for illustration. The internal structure of the system is divided into different functional modules to complete all or part of the functions described above. For the specific working process of the device described above, reference may be made to the corresponding process in the foregoing method embodiments, and details are not repeated here.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, rather than limiting them; although the application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present application. scope.

Claims (10)

1. A data isolation method, characterized in that, comprising: Obtain user login information; Call the corresponding data display page according to the user login information; Generate target database statement fragments according to the isolation conditions corresponding to the data list in the data display page; Splicing the target database statement fragments into the basic database statement of the data list to obtain the target database statement; calling target data based on the target database statement, and displaying the target data in the data list. 2. The method according to claim 1, wherein said calling the corresponding data display page according to the user login information includes: Determine the isolation dimension of the user according to the user login information; wherein, the isolation dimension is at least divided into three types: department, role and personnel; According to the user's isolation dimension, determine the corresponding target isolation strategy; According to the target isolation strategy, the corresponding data display page is called. 3. The method according to claim 2, wherein said determining the isolation dimension of the user according to the user login information comprises: According to the association type represented by the user's login information, the isolation dimension of the user is determined. 4. The method according to claim 3, wherein the determining the isolation dimension of the user according to the association type represented by the user login information includes: When the user login information indicates that the user includes two or more association types, determine the target association type according to the priority of each association type; According to the target association type, the isolation dimension of the user is determined. 5. The method according to claim 4, wherein, according to the isolation condition corresponding to the data list in the data display page, generating the target database sentence fragment comprises: According to the isolation condition corresponding to the data list in the data display page, determine the corresponding isolation script and dimension logic; Generate target database statement fragments according to the isolation script and dimension logic. 6. The method according to claim 1, further comprising: According to the isolation condition corresponding to the data list in the data display page, it is judged whether the current isolation dimension includes a subquery; If the current isolation dimension includes a subquery, obtain the dimension field corresponding to the subquery; Adding the dimension field to the target database statement fragment. 7. The method according to claim 1, wherein said invoking target data based on said target database statement comprises: Call the database query script interface; Based on the database query script interface, the target database statement is input into a preset database, so as to call the target data in the preset database. 8. A data isolation device, characterized in that, comprising: The acquisition module is used to obtain user login information; A page calling module, configured to call a corresponding data display page according to the user login information; A generating module, configured to generate target database statement fragments according to the isolation condition corresponding to the data list in the data display page; A splicing module, configured to splice the target database statement fragments into the basic database statement of the data list to obtain the target database statement; The data calling module is used for calling target data based on the target database statement, and displaying the target data in the data list. 9. An electronic device, comprising: at least one processor and a memory; the memory stores computer-executable instructions; The at least one processor executes the computer-implemented instructions stored in the memory, such that the at least one processor performs the method according to any one of claims 1-7. 10. A computer-readable storage medium, wherein computer-readable instructions are stored in the computer-readable storage medium, and when the processor executes the computer-executable instructions, the computer-readable storage medium according to any one of claims 1 to 7 is implemented. described method.

Images