KR20130085517A - Data access control apparatus and method - Google Patents

Abstract

The present invention provides a user interface for receiving an information access request of a user, an access authority providing unit for providing authority information for the user, a query converting unit for converting a data query based on the authority information and the information providing request, and the A data access control apparatus including a data provider for analyzing a data query and providing information corresponding to the analyzed data query is provided.
According to the present invention, in a system supporting multiple tenants, data access control can be effectively performed by performing access control through query transformation according to a user's access authority.

Description

DATA ACCESS CONTROL APPARATUS AND METHOD}

The present invention relates to a data access control apparatus, and more particularly, to an apparatus and method for controlling data access based on a query to support multiple tenants.

Software as a Service (SaaS) refers to a software distribution model in which a provider or service provider hosts an application, and a customer uses a hosted application over a network.

Software as a Service (SaaS) platform stores tenant data to support multiple tenants in a single database to reduce costs. Therefore, an application on the SaaS platform uses tenant data by mapping a plurality of logical schemas used by multiple tenants to a single physical schema shared by multiple tenants. Therefore, individual tenants do not use independent databases, but store individual tenant data in the same table in one database. Therefore, when multiple tenants store data in the same database space, there is a need to prevent unauthorized access to data of individual tenants.

In addition, in a multi-tenant environment such as the SaaS platform, it is not easy to control access to individual tenants because individual tenants change the configuration of Schema, Logic, and Page according to their requirements. No

In the prior art, in order to effectively control data access, there is a method of viewing an application access URL as an access control object and allowing or blocking access according to access authority.

Another conventional technique has been proposed in which an application is mapped to a workflow to view the workflow and the activities constituting the workflow as access control targets and to permit or block access according to the access authority.

Another prior art has proposed a method of granting or blocking access to a database by granting a database permission for each application.

However, as in the prior art, it is not easy to control various objects in an environment using schemas, logics, pages, etc. by changing tenants and using them, and the amount of data required for control and the error There is a risk of occurrence, and there is a need for a method to effectively control it.

An object of the present invention is to provide an apparatus and method for effectively controlling database access based on a query in a multi-tenant system.

One embodiment of the present invention for solving the above technical problem is a user interface for receiving a user access request information; An access authority providing unit for providing authority information for the user; A query conversion unit generating a data query based on the authority information and the information providing request; And a data providing unit analyzing the data query and providing information corresponding to the analyzed data query.

The user interface may be a user interface that receives an information access request of the user and obtains session information based on the input information access request.

The access authority providing unit may further include: a role information providing unit providing role information for determining whether to permit access to the data record based on the session information; And a profile information providing unit for providing profile information for determining whether to permit access to the application program, the object, and the field of the data based on the session information.

The query converting unit may generate a data query by converting the information providing request based on the role information and the profile information.

The data provider may further include a data query analyzer configured to analyze role information and profile information of the data query; A query execution unit that performs a data query only on information corresponding to the analyzed profile information; And a result providing unit which provides result information according to the data query based on the role information.

Another embodiment of the present invention for solving the above technical problem is a step of receiving a user information access request; Providing access authority for providing authority information for the user; Generating a data query based on the authority information and the information providing request; And a data providing step of analyzing the data query and providing information corresponding to the analyzed data query.

The receiving of the information access request may include receiving an information access request of a user; And obtaining fine line information based on the input information access request.

The providing of the access right may include providing role information for determining whether to permit access to the data record based on the session information; And providing profile information for providing profile information for determining whether to permit access to the application program, the object, and the field of the data based on the session information.

The data providing step may include: a data query analysis step of analyzing role information and profile information for the data query; A query performing step of performing a data query only on information corresponding to the analyzed profile information; And a result providing step of providing result information according to the data query based on the role information.

Another embodiment of the present invention for solving the above technical problem is a step of receiving a user's information access request; Providing access authority for providing authority information for the user; Generating a data query based on the authority information and the information providing request; And a data providing step of analyzing the data query and providing information corresponding to the analyzed data query. It can be characterized.

In a system supporting multi-tenant, data access control can be effectively performed by controlling access through query transformation according to a user's access authority.

1 is a block diagram illustrating a data access control apparatus according to an embodiment of the present invention.
2 is a block diagram illustrating a data access control method according to an embodiment of the present invention.

Hereinafter, some embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

The following embodiments are a combination of elements and features of the present invention in a predetermined form. Each component or feature may be considered to be optional unless otherwise stated. Each component or feature may be implemented in a form that is not combined with other components or features. In addition, some of the elements and / or features may be combined to form an embodiment of the present invention. The order of the operations described in the embodiments of the present invention may be changed. Some configurations or features of certain embodiments may be included in other embodiments, or may be replaced with corresponding configurations or features of other embodiments.

Embodiments of the invention may be implemented through various means. For example, embodiments of the present invention may be implemented by hardware, firmware, software, or a combination thereof.

For a hardware implementation, the method according to embodiments of the present invention may be implemented in one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs) , Field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, and the like.

In the case of an implementation by firmware or software, the method according to embodiments of the present invention may be implemented in the form of a module, a procedure or a function for performing the functions or operations described above. The software code can be stored in a memory unit and driven by the processor. The memory unit may be located inside or outside the processor, and may exchange data with the processor by various well-known means.

Specific terms used in the following description are provided to help the understanding of the present invention, and the use of the specific terms may be modified in other forms without departing from the technical spirit of the present invention.

A data access control apparatus according to an embodiment of the present invention will be described with reference to FIG. 1. The data access control apparatus includes a user interface 100, an access authority providing unit 200, a query converter 300, and a data providing unit 400.

The user interface 100 receives a user's request for information access. When receiving a user's information access request, the data access control device obtains session information based on a session in which the user's information access request is made.

A session refers to an activated logical connection between a user and a computer or a plurality of computers, and session information refers to information of a user or a computer on which a logical connection is activated. The session information includes, for example, information such as name, ID, email address, age, date of birth, job title, department or administrator authority.

According to an embodiment of the present invention, when a user requests information for executing a specific application, the user receives an information access request for a specific application using a user interface. The ID, name, department, position, or administrator authority of the user requesting the information access is determined, and among them, the name, position, and administrator authority are extracted to obtain session information. The information to be extracted is preferably set in advance by the user.

The access authority providing unit 200 provides authority information for the user. The access authority providing unit includes a role information providing unit (not shown) and a profile information providing unit (not shown).

The role information providing unit provides role information for determining whether to permit access to the data record based on the session information. Whether to allow access to data records is a setting regarding whether the contents of the data can be read. More specifically, even if the result data is retrieved according to the user's request for information, the user provides unique contents of the retrieved data according to the role information. It means setting whether to do it or not.

According to an embodiment of the present invention, role information is preset from a user based on information such as whether a department, a position, or an administrator authority is obtained in the obtained session information. Role information for accessing the database using an AND / OR operation is generated based on at least one or more preset role information.

The profile information providing unit determines whether to allow access to an application, an object, and a field of data based on the session information. That is, the profile providing unit provides information on the search target of the user, such as whether to allow access to an application, an object, and a field by using the user's age, title, or ID.

According to an embodiment of the present invention, profile information is generated according to a department or a job title from the acquired session information, and a user performs a query only on an object-related table and a field having authority according to the generated profile information. Thus, access control at the data level is achieved.

The query converting unit 300 generates a data query by converting the information providing request based on the authority information and the information providing request. The information providing request input by the user is a general information providing request irrespective of the user's role and profile. The query converting unit converts the information providing request based on the authority information and the information providing request to generate a data query.

According to an embodiment of the present invention, when there is a request for providing information about the object A from the user, the user interface reviews the session of the user who has made the request for providing information and obtains the user's authority information. If the user's authority information has acquired the profile information of 'administrator' and the role information of 'human resources', based on the request for providing the information and the acquired authority information, (SELECT * FROM A WHERE profile =' manager 'AND role =' human resources department) Create a data query called ').

The data provider 400 analyzes the data query and provides information corresponding to the analyzed data query. The data providing unit includes a data query analyzing unit (not shown), a query executing unit (not shown), and a result providing unit (not shown).

The data query analyzer analyzes role information and profile information for the data query. According to an embodiment of the present invention, when the query (SELECT * FROM A WHERE profile = 'administrator' AND role = 'human resources') is received, the received query is analyzed to analyze the profile information of 'manager' and 'human resources'. Extract role information

The query execution unit performs a data query only on information corresponding to the analyzed profile information. That is, since only the application, object, and field of the data corresponding to the profile information are allowed in the data query analyzer, the query execution unit performs a data query only on the data to which the access is allowed. According to an embodiment of the present invention, when the profile information is 'administrator', only the application programs, objects and fields related to personnel management are searched.

In other words, tenant data's objects (schema), fields, and records contain unique information, and do not return data for queries accessed without permission.

The result provider provides the user with the result data searched by the query execution unit based on the role information analyzed by the data query analyzer. Role information is information indicating access authority to a record. When the role information has role information without authority, role information is not provided. According to an embodiment of the present invention, when the role information is 'human resources', the result data is provided for all information other than the preset information.

Therefore, when a user inputs an incorrect information access request, access control is performed at an internal stage of the platform, and thus access control may be performed so that unauthorized data is not returned.

A process of providing a data providing unit of a data access control apparatus according to an embodiment of the present invention will be described with reference to FIG. 2.

When the role information and the profile information are analyzed for the data query, the data access control device performs the data query based on the profile information. According to an embodiment of the present invention, when the user makes a request for access to information about the schema of the object C used for the application B, the query execution unit analyzes the profile information of the user and the user can access the application A (501-). 1), B 501-2, accessible objects are assigned to A 503-1, B 503-2, C 503-3, page 505, logic 507, and schema 509. Perform a data query.

As a result of the query, when the result data is provided to Record A, Record B, and Record C as records for Field A, Field B, and Field C, the data access control apparatus confirms the role information. If the user is found to have role information allowed access to fields A and B, data is provided to the user for records A and B only. Thus, it is possible to control data access to the unauthorized field C of the user.

A data access control method according to an embodiment of the present invention will be described with reference to FIG. 3. The same contents as the configuration of the above-described data access control apparatus are replaced with the above contents.

In step S100, a user access request for information is input. The request for access to information of the user may be input through an external device such as a keyboard or a mouse.

In step S110, session information is obtained based on the input information access request. The user's ID, name, department, title, or administrator authority is extracted according to the information access request, and session information is generated based on the extracted information.

Step S120 provides the authority information for the user. The authority information includes role information for determining whether to allow data access based on session information and profile information for providing information on a user's search target.

Step S130 converts the information access request received from the user based on the authority information and the request for providing the data query.

Step S140 analyzes the generated data query to analyze the role information and profile information, performs a data query based on the profile information, and provides information to the user based on the role information.

That is, the query-based access control method controls access by adding authorization information to the query and converting the query, so that access control can be performed regardless of the internal schema. That is, since the original query is defined based on the internal schema, access control is possible regardless of the internal schema in the process of adding authorization management information. Therefore, even in a platform that supports a multi-tenant shared schema, there is a problem that can be implemented by applying the access control method of the present invention regardless of a method of providing an internal schema.

Embodiments of the present invention can be written in a computer program. The code and code segments that make up this computer program can be easily deduced by a computer programmer in the field. In addition, the computer program is stored in a computer readable medium (Computer Readable Media), and the embodiment is implemented by being read and executed by a computer. The information storage medium includes a magnetic recording medium, an optical recording medium and a carrier wave medium.

The present invention has been described above with reference to preferred embodiments. It will be understood by those skilled in the art that the present invention may be embodied in various other forms without departing from the spirit or essential characteristics thereof. Therefore, the above-described embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is shown not in the above description but in the claims, and all differences within the scope should be construed as being included in the present invention.

100: user interface 200: access authority providing unit
300: query converter 400: data provider

Claims (1)

A user interface for receiving a user's request for information access;
An access authority providing unit for providing authority information for the user;
A query converter configured to generate a data query based on the authority information and the information access request; And
And a data provider for providing information corresponding to the data query.

Images