CN115017185A

CN115017185A - Data processing method, device and storage medium

Info

Publication number: CN115017185A
Application number: CN202110243958.3A
Authority: CN
Inventors: 孟善珏
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2021-03-04
Filing date: 2021-03-04
Publication date: 2022-09-06

Abstract

The embodiment of the invention discloses a data processing method, a data processing device and a storage medium, which are mainly applied to a database management system. The method comprises the following steps: responding to the query operation of a user, and acquiring a data identifier of data to be queried; constructing an authority query function containing the data identification, and generating a query request, wherein the query request comprises the authority query function; sending a query request to a server so that the server converts an authority query function into a conditional query function, wherein the conditional query function comprises a data identifier, the server generates a blank query interface based on the conditional query function, searches query data matched with the conditional query function in a database of the server based on the data identifier, and fills the query data into the blank query interface to obtain a query result; and receiving the query result sent by the server and displaying the query result. The data processing method provided by the embodiment of the invention can effectively improve the efficiency of data authority management.

Description

Data processing method, device and storage medium

Technical Field

The present invention relates to the field of computer technologies, and in particular, to a data processing method, an apparatus, and a storage medium.

Background

Thanks to the explosion of internet technology, database technology brings great convenience to data processing of various enterprises. In a big data scenario, there is often a need for cross-department access, for example, in an enterprise data processing scenario, there may be a need for users of one department to query information managed by another department.

In order to ensure the security of information, it is necessary to perform authority management on a database storing information, including cross-department authority management (that is, authority management for one department to access information of another department), so that when a user queries data, the database only returns data related to the department where the user is located, and data of other departments cannot be leaked out. In the prior art, the mode of performing cross-department authority management on the database is too complex, so how to improve the efficiency of data authority management becomes a hot topic of current research.

Disclosure of Invention

The embodiment of the invention provides a data processing method, a data processing device and a storage medium, which can improve the efficiency of data authority management.

In one aspect, an embodiment of the present invention provides a data processing method, where the method is applied to a client, and includes:

responding to the query operation of a user, and acquiring a data identifier of data to be queried;

constructing an authority query function containing the data identification, and generating a query request, wherein the query request comprises the authority query function;

sending the query request to a server so that the server converts the authority query function into a conditional query function, wherein the conditional query function comprises the data identifier, the server generates a blank query interface based on the conditional query function, the server searches query data matched with the conditional query function in a database of the server based on the data identifier, and the server fills the query data into the blank query interface to obtain a query result;

and receiving the query result sent by the server and displaying the query result.

In one aspect, an embodiment of the present invention provides another data processing method, where the method is applied to a server, and includes:

receiving a query request sent by a client, wherein the query request comprises an authority query function, and the authority query function comprises a data identifier of data to be queried;

converting the authority query function into a conditional query function, wherein the conditional query function comprises the data identifier;

generating a blank query interface based on the conditional query function;

searching query data matched with the condition query function in a database of a server based on the data identification, and filling the query data into the blank query interface to obtain a query result;

and sending the query result to the client so that the client displays the query result.

In one aspect, an embodiment of the present invention provides a data processing apparatus, where the apparatus includes:

the first acquisition unit is used for responding to the query operation of a user and acquiring the data identifier of the data to be queried;

the first processing unit is used for constructing an authority query function containing the data identification and generating a query request, wherein the query request comprises the authority query function;

the first sending unit is used for sending the query request to a server so that the server converts the authority query function into a conditional query function, the conditional query function comprises the data identifier, the server generates a blank query interface based on the conditional query function, the server searches query data matched with the conditional query function in a database of the server based on the data identifier, and the server fills the query data into the blank query interface to obtain a query result;

and the first receiving unit is used for receiving the query result sent by the server and displaying the query result.

In one aspect, an embodiment of the present invention provides another data processing apparatus, where the apparatus includes:

the second receiving unit is used for receiving a query request sent by a client, wherein the query request comprises an authority query function, and the authority query function comprises a data identifier of data to be queried;

the second processing unit is used for converting the authority query function into a conditional query function, and the conditional query function comprises the data identifier;

the second processing unit is further configured to generate a blank query interface based on the conditional query function;

the second processing unit is further configured to search query data matched with the conditional query function in a database of a server based on the data identifier, and fill the query data in the blank query interface to obtain a query result;

and the second sending unit is used for sending the query result to the client so as to enable the client to display the query result.

In one aspect, an embodiment of the present invention provides a terminal, including:

a processor adapted to implement one or more computer programs;

a computer storage medium storing one or more computer programs adapted to be loaded and executed by the processor to:

responding to the query operation of a user, and acquiring a data identifier of data to be queried; constructing an authority query function containing the data identification, and generating a query request, wherein the query request comprises the authority query function; sending the query request to a server so that the server converts the authority query function into a conditional query function, wherein the conditional query function comprises the data identifier, the server generates a blank query interface based on the conditional query function, the server searches query data matched with the conditional query function in a database of the server based on the data identifier, and the server fills the query data into the blank query interface to obtain a query result; and receiving the query result sent by the server and displaying the query result.

In one aspect, an embodiment of the present invention provides a server, including:

a processor adapted to implement one or more computer programs;

receiving a query request sent by a client, wherein the query request comprises an authority query function, and the authority query function comprises a data identifier of data to be queried; converting the authority query function into a conditional query function, wherein the conditional query function comprises the data identifier; generating a blank query interface based on the conditional query function; searching query data matched with the conditional query function in a database of a server based on the data identification, and filling the query data into the blank query interface to obtain a query result; and sending the query result to the client so that the client displays the query result.

In one aspect, an embodiment of the present invention provides a computer storage medium, where one or more computer programs are stored, and the one or more computer programs are adapted to be loaded by the processor and executed to:

responding to the query operation of a user, and acquiring a data identifier of data to be queried; constructing an authority query function containing the data identification, and generating a query request, wherein the query request comprises the authority query function; sending the query request to a server so that the server converts the authority query function into a conditional query function, wherein the conditional query function comprises the data identifier, the server generates a blank query interface based on the conditional query function, the server searches query data matched with the conditional query function in a database of the server based on the data identifier, and the server fills the query data into the blank query interface to obtain a query result; and receiving the query result sent by the server, and displaying the query result.

In one aspect, an embodiment of the present invention provides a computer storage medium, where one or more computer programs are stored, and the one or more computer programs are adapted to be loaded and executed by the processor to:

In one aspect, an embodiment of the present invention provides a computer program product or a computer program, where the computer program product includes a computer program, the computer program is stored in a computer storage medium, a processor of a client reads the computer program from the computer storage medium, and the processor executes the computer program to make a data processing apparatus execute:

responding to the query operation of a user, and acquiring a data identifier of data to be queried; constructing an authority query function containing the data identification, and generating a query request, wherein the query request comprises the authority query function; sending the query request to a server so that the server converts the authority query function into a condition query function, wherein the condition query function comprises the data identifier, the server generates a blank query interface based on the condition query function, the server searches query data matched with the condition query function in a database of the server based on the data identifier, and the server fills the query data into the blank query interface to obtain a query result; and receiving the query result sent by the server and displaying the query result.

In one aspect, an embodiment of the present invention provides a computer program product or a computer program, where the computer program product includes a computer program stored in a computer storage medium, and a processor of a client reads the computer program from the computer storage medium, and the processor executes the computer program to make a data processing apparatus execute:

The embodiment of the invention enables the server to obtain the query authority of the client and the data to be queried by constructing the authority query function containing the data identifier and generating the query request, further enables the server to generate the conditional query function containing the data identifier of the data to be queried based on the authority query function, realizes the safety management of the data through the rewriting (or called SQL rewriting) of the query language, effectively ensures the safety of the data, then enables the server to search based on the conditional query function, can generate the query result, enables the client to receive and display the query result sent by the server, and improves the efficiency of the data authority management while ensuring the safety of the data.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

FIG. 1a is a schematic diagram of a data processing system according to an embodiment of the present invention;

FIG. 1b is a schematic flow chart of a data authority relationship provided by an embodiment of the present invention;

FIG. 2 is a diagram illustrating a data processing method according to an embodiment of the present invention;

FIG. 3a is a schematic diagram of a user query interface provided by an embodiment of the present invention;

FIG. 3b is a diagram illustrating a query result according to an embodiment of the present invention;

FIG. 4 is a flow chart illustrating a data processing method according to an embodiment of the present invention;

FIG. 5 is a diagram illustrating another data processing method according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a data processing apparatus according to an embodiment of the present invention;

FIG. 7 is a block diagram of another data processing apparatus according to an embodiment of the present invention;

fig. 8 is a schematic structural diagram of a terminal according to an embodiment of the present invention;

fig. 9 is a schematic structural diagram of a server according to an embodiment of the present invention.

Detailed Description

The embodiment of the invention provides a data processing method which is mainly applied to authority management of data, in particular to a data processing scene with cross-authority inquiry. In one embodiment, cross-rights queries can be understood with reference to FIG. 1 a: the data processing system corresponding to the advertisement service has three models of user, data authority and advertiser-department relationship, and the relationship between the three models. In addition, there are also users in the data processing system and user fields corresponding to the users, and the users belong to user departments (or user clusters), wherein the user fields may be, for example, authorization information of the users obtained by the data processing system by granting different database permissions (including library permissions, table permissions, and column permissions) to different users. When actually applied in business, the data processing system always has an advertiser field besides the user field, and the advertiser generally belongs to the advertiser department. It will be understood, then, that the relationship between the user and the advertiser may be generated by a relationship between the advertiser's division and the user's division. For example, suppose that there is a user a in the user department, and the user a corresponds to a database authority (or called user authorization information); and suppose that advertiser B exists in the advertiser department and has a department relationship with advertiser B. Then, since user A and advertiser B do not belong to the same department, the relationship of user department to advertiser department may be used to represent (or generate) the relationship between user A and advertiser B. The relationship between the user A and the advertiser B is cross-department authority information (or called cross-cluster authority information), and the cross-department authority information can be used for cross-department authority management.

In one embodiment, the data processing method is mainly achieved by: the client responds to the data query operation of a user, acquires the data identifier of the data to be queried, constructs an authority query function containing the data identifier, and then generates a query request. And the query request is sent to the server, so that the server can convert the authority query function into a condition query function, then the server queries data based on the condition query function and generates a query result, and the client receives and displays the query result sent by the server, thereby improving the efficiency of data authority management.

The data identifier of the data to be queried may be a name of the data to be queried, for example, in an enterprise personnel data processing scenario, the data identifier may be a "staff name", "personal performance", or the like; in a corporate performance data processing scenario, the data identification may be exposure, cash consumption, etc. The authority query function may be understood as a template function (template function, i.e. a function generated by a template) with authority, which is a query authority of a client, for example: the query authority of the client a is "a-type data in the queryable data table 1", and the query authority of the client B is "all data in the queryable data table 2 and the data table 3". The conditional query function can be understood as: the query authority and the data identifier are converted into a function after a conditional query statement, for example, a function with authority "a type data of the queryable data table 1" is converted into a function with query condition "query a type data".

In one embodiment, the data processing method can be applied to a data processing system as shown in fig. 1b, wherein the system comprises at least one client 101 and a server 102 as shown in fig. 1 b. Therein, the client 101 may run in a terminal, which may establish a communication connection with the server. The terminal includes, but is not limited to, a smart phone, a smart speaker, a tablet computer, and the like, and the server may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing basic cloud computing services such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a Network service, cloud communication, a middleware service, a domain name service, a security service, a Content Delivery Network (CDN), and a big data and artificial intelligence platform. The terminal may be, but is not limited to, a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and the like. The terminal and the server may be directly or indirectly connected through wired or wireless communication, and the present invention is not limited thereto.

Referring to fig. 2, fig. 2 is a schematic diagram of a data processing method according to an embodiment of the present invention, where the method is applicable to a client. As shown in fig. 2, the method includes:

s201, responding to the query operation of the user, and acquiring the data identification of the data to be queried.

In one embodiment, the query operation of the user may be an input operation of the user on a user query interface, which may be referred to as shown in fig. 3 a. The data to be queried can be understood as: the user wants to identify the data queried by entering some (or some) data in the user query interface. Illustratively, the data identification may be a data model and a data index, such as: after the client displays the user query interface, the user can select a data model in the user query interface as the "big disc performance", the time range is "2020X month X day-2020X month X day", and the income index is a data identifier of "performance consumption", and then the client can obtain the three data identifiers of "big disc performance", "2020X month X day-2020X month X day", and "performance consumption" selected by the user.

S202, constructing an authority query function containing the data identification, and generating a query request.

In one embodiment, the query request includes an authority query function, and the authority query function is used for indicating the data identifier of the data to be queried selected by the user corresponding to the client and the user cluster to which the user belongs. For example, the client may generate a template function with permission according to the data index clicked by the user, and may specifically be a template function with permission f-permission, and the user cluster may be a department or an organization (e.g., a division of company a) where the user is located, and the like.

S203, sending a query request to the server so that the server converts the authority query function into a condition query function, generating a blank query interface by the server based on the condition query function, searching query data matched with the condition query function in a database of the server based on the data identification by the server, and filling the query data into the blank query interface by the server to obtain a query result.

In one embodiment, the conditional query function includes a data identification. As can be seen from the foregoing, the query request includes an authority query function, so that after the client sends the query request to the server, the server can analyze the query request to obtain the authority query function, then the server converts the authority query function to obtain a conditional query function including a conditional query statement, and generates a blank query interface based on the conditional query function, where the blank query interface is used to display a query result, and specifically, the server searches for data corresponding to the data identifier in a database (or called a data warehouse) of the server based on the data identifier included in the conditional query function, and fills the blank query interface with the data obtained by query, so that the blank query interface can display a final query result.

Illustratively, the conditional Query function may be an SQL (Structured Query Language) function with condition. Suppose that the user 1 is in a department a of company a and wants to query employee information (employee name, affiliated department, position information) of a department B stored in the data warehouse, wherein the department B includes an employee a, an employee B, and an employee C. Then, the data to be queried is "employee information of department b", the data identifier is "employee name", "affiliated department", and "job information", then the server will look up according to the data identifier "employee name": similarly, the server respectively searches the department corresponding to the employee a, the department corresponding to the employee B and the department corresponding to the employee C according to the data identifier "affiliated department", respectively searches the position corresponding to the employee a, the position corresponding to the employee B and the position corresponding to the employee C according to the data identifier "position information", and respectively obtains "position 1, position 2 and position 3". And after the acquisition of the data to be queried is finished, the server fills the data obtained by querying into a blank query interface to obtain a query result.

And S204, receiving the query result sent by the server and displaying the query result.

After the server obtains the query result, the client receives the query result sent by the server and displays the filled query interface. Illustratively, in the above example, the query result may be as shown in FIG. 3 b.

The embodiment of the invention enables the server to obtain the query authority of the client and the data to be queried by constructing the authority query function containing the data identifier and generating the query request, further enables the server to generate the conditional query function containing the data identifier (namely, the data identifier of the data to be queried) based on the authority query function, realizes the safety management of the data through the rewriting (or called SQL rewriting) of the query language, effectively ensures the safety of the data, and then enables the server to search based on the conditional query function and generate the query result, so that the client can accept and display the query result sent by the server, and the efficiency of data authority management is improved while the safety of the data is ensured.

Referring to fig. 4, fig. 4 is a schematic diagram illustrating another data processing method according to an embodiment of the present invention, where the method is applicable to a server. As shown in fig. 4, the method includes:

s401, responding to the query operation of the user, and acquiring the data of the data to be queried.

In an embodiment, the specific embodiment in step S401 may refer to that in step S201, which is not described herein again.

S402, constructing an authority query function containing the data identification and generating a query request.

In one embodiment, the query request comprises a permission query function and a client identifier of the client, wherein the permission query function comprises a data identifier of the data to be queried. In a specific embodiment, one client may correspond to one user, and the client identifier may also identify the user using the client; the authority query function may be understood as a function that instructs the server to perform a data query within the authority range to which the client belongs. For example: when the client 1 can only query the data in the data table 1, but the data to be queried included in the initiated query request includes the data in the data table 2, the authority query function is used to instruct the server to query the data in the data table 1.

S403, sending a query request.

Specifically, the client sends the query request to the server.

S404, the authority query function is converted into a condition query function.

In one embodiment, the permission query function further includes permission information of a user cluster to which the client identifies the corresponding user. Then, the server may obtain the query permission information of the user corresponding to the client identifier based on the client identifier and the permission information of the user cluster to which the user corresponding to the client identifier belongs. In a specific embodiment, the query permission information may include user authorization information and cross-cluster permission information of a user cluster, and thus, when the server obtains the query permission information of a user, the server may specifically obtain the user authorization information of the user corresponding to the client identifier first, and then obtain the cross-cluster permission information of the user cluster based on the permission information of the user cluster corresponding to the user and based on the user cluster associated with the data to be queried.

In an embodiment, the authority information of the user cluster may be understood as authority information of a department to which the user belongs, so that the user authorization information in the query authority information of the user may be obtained specifically according to the authority information of the department to which the user belongs and user information corresponding to the client identifier, such as: and obtaining the information according to the department authority information and the user category. For example, assuming that the employee information includes employee name, affiliated department, job title information, and job age, the data processing system of a company provides that the users of department 1 can query the employee information of department 2 (i.e., the authority information of this user cluster of department 1 is "employee information of queryable department 2"), and the employee information that the class a users can query is "employee name", "affiliated department". If the user a is a class a employee in the department 1, the user authorization information corresponding to the user a is "name and belonging department of employee in the queriable department 2".

In one embodiment, cross-cluster privilege information may also be understood as cross-department privilege information. Then, the cross-cluster authority information in the query authority information of the user may be obtained specifically according to the department related to the data to be queried and the department to which the user corresponding to the client initiating the query request belongs. For example, suppose that company a has a department 1 and a department 2, and the data table 1 includes user data (employee name, job information) of the department 2, and the user a belongs to the department 1. Then, when the user a selects to query the data in the data table 1, since the user data of the department 2 stored in the data table 1 (i.e. the associated user cluster is "department 2"), the user a belongs to the department 1, and therefore, the cross-cluster authority information (or, referred to as cross-department authority information) can be understood as the authority relationship between the department 1 and the department 2 (e.g. the department 1 can query part of the data of the department 2, and the department 2 can query the whole data of the department 1).

In one embodiment, after obtaining the query authority information of the user, the server may screen out a first data identifier matching the query authority information of the user from the data identifiers, and convert the authority query function into a conditional query function after obtaining the first data identifier. In a specific embodiment, the "first data identifier" may be understood as: in the data to be queried, the identifier corresponding to the data of which the user corresponding to the client initiating the query request has the query right is found to be "matched with the query right information of the user", that is: the data is in the inquiry authority range of the user, and the data belongs to the data to be inquired. Then, it can be further understood that the first data identifier matching the query authority information of the user is screened out from the data identifiers, that is: selecting data with query authority of the client from the data to be queried corresponding to the client, and taking a data identifier corresponding to the data as a first data identifier.

For example, suppose a company includes department 1 and department 2, employee information includes employee name, affiliated department, position information and working age, and the query authority information corresponding to the user a is "employee name and affiliated department in queriable department 2". Then, when the user a wants to query two pieces of information, namely "employee name" and "employee position" in the department 2, the data included in the authority query function generated by the client corresponding to the user a is identified as "employee name" and "employee position", and since the user a cannot query the data of "employee position", the data matched with the query authority information only has the data of "employee name", so that it can be known that the first data after being screened is identified as "employee name", that is: the conditional query function includes only "employee name".

S405, generating a blank query interface based on the condition query function.

In one embodiment, the blank query interface may include a join cross-department permission table, which may include data identifications of data to be queried. In an embodiment of the present invention, the node in the Abstract Syntax Tree may be used to identify a specific location (e.g., a library location, a table location, and a column location) where query data is located, specifically as follows: column C identifying that data 1 is in the B table of the a database. It can be seen that, in a specific embodiment, the abstract syntax tree includes a node identifier of at least one node of the query data corresponding to the first data identifier, and the node can be understood as a hierarchy, that is: library, table, column. For example, if query data 1 is located in the a library B table, then query data 1 corresponds to 2 nodes, which are the a library and the B table, respectively.

In one embodiment, after the server generates the abstract syntax tree according to the conditional query function, validity verification may be performed on the first data identifier based on the abstract syntax tree to determine whether the second data identifier can be obtained by filtering the first data identifier. And if the second data identifier can be obtained by screening, the validity of the first data identifier is considered to be verified, and the 'generating of a blank query interface based on the condition query function' is triggered and executed. Specifically, the server performs validity verification on the node identifier of each node of the query data corresponding to the first data identifier, which may be understood as: the server verifies whether the query data corresponding to the first data identifier exists by verifying whether a library/table/column field in the abstract syntax tree exists, if the query data corresponding to the first data identifier exists, the verification is passed, the server takes the data identifier of the query data as a second data identifier (namely, the second data identifier is obtained according to the node corresponding to the node identifier passing the verification), and then the conditional query function including the first data identifier is updated to the conditional query function including the second data identifier, or the conditional query function including the first data identifier is understood as: and rewriting the abstract syntax tree after the nodes are screened into a new conditional query function.

For example, assume that a library a exists in the data processing system, where library a includes table B, table C, and table C includes column C. If the first data identifier comprises data 1 and data 2, and the first data identifier data 1 corresponds to three nodes which are respectively a library node corresponding to field A, a table node corresponding to field B and a column node corresponding to field C; the first data identifier "data 2" corresponds to two nodes, which are respectively a library node corresponding to the "field a" and a table node corresponding to the "field B". Then, as known from the three nodes of the first data identification "data 1", the search path of "data 1" is "a bank → table B → column C", and it can be seen that the query data corresponding to "data 1" does not exist (because column C does not exist in table B); known by the two nodes of the second data identifier "data 2", the search path of "data 2" is "a bank → table B", it can be seen that the query data corresponding to "data 2" exists, and further the second data identifier "data 2" can be obtained, since the second data identifier is screened out from the first data identifier "data 1" and "data 2", the server can determine that the verification is passed, then modify the conditional query function 1 including the first data identifier "data 1" and "data 2" into the conditional query function 2 including the second data identifier "data 2", and generate a blank query interface according to the conditional query function 2.

S406, searching query data matched with the conditional query function in a database of the server based on the data identification, and filling the query data into a blank query interface to obtain a query result.

In one embodiment, the server searches query data corresponding to the second data identifier in a database corresponding to the server based on the rewritten conditional query function (i.e., the conditional query function including the second data identifier), and then the server fills the query data corresponding to each data identifier into a grid to be filled corresponding to each data identifier to obtain a query result.

In a specific embodiment, the blank query interface includes at least one grid to be filled, and one or more grids to be filled in the at least one grid to be filled correspond to one data identifier. It is to be understood that the grid to be populated may be generated according to the first data identifier, and if the user a needs to query "employee name" and "department to which" the user a belongs, "the blank query interface generated by the server may include one or more forms to be populated corresponding to" employee name "and one or more forms to be populated corresponding to" department to which "the user a belongs. For example: the data identification of "employee name" may correspond to a number of grids to be populated: a blank grid of employee names, such as employee a, employee b, and employee c, is to be filled.

S407, sending the query result to the client so that the client displays the query result.

In one embodiment, after the server obtains the query result, the query result is returned to the client sending the query request, so that the client loads and displays the query result.

And S408, receiving the query result sent by the server and displaying the query result.

In one embodiment, after the server generates the query result, the server sends the query result to the client initiating the query request, and the client loads and displays the query result.

According to the embodiment of the invention, the server can screen the data to be queried through the query authority information of the user and the data identifier of the data to be queried by rewriting the authority query function and the condition query function, then the server searches based on the condition query function after screening the data identifier to generate the query result, so that the client receives and displays the query result sent by the server, the security of the data is effectively ensured, the organization structure of a data warehouse does not need to be adjusted in the data query process, and the efficiency of data authority management is improved.

Based on the data processing methods shown in fig. 2 and fig. 4, an embodiment of the present invention provides a schematic diagram of another data processing method, please refer to fig. 5, where the method includes:

s501, the user clicks and selects data to be inquired.

In one embodiment, the user can complete the input of the data to be queried in the user query interface in a click mode.

And S502, generating a template function with the weight.

In an embodiment, reference may be made to step S202 for a specific embodiment related to step S502, which is not described herein again in the embodiments of the present invention.

And S503, analyzing the template function with the weight into an abstract syntax tree.

In one embodiment, the server may convert the template function with permission into a conditional query function, and then obtain the abstract syntax tree corresponding to the template function with permission based on the conditional query function. The specific embodiment can be found in step S404, and is not described herein again.

And S404, verifying the validity.

In an embodiment, it can be understood from the foregoing embodiment that the validity verification is to verify the first data identifier in the conditional query function, which may be specifically described in step S405, and is not described herein again.

And S505, replacing the template function with the authority with a join cross-department authority table.

In one embodiment, after the server obtains the template function with authority (or called authority query function), the authority query function can be replaced by a join cross-department authority table. In a specific embodiment, the server may first convert the permission query function into the conditional query function, and then implement the above-mentioned "replacing the permission query function with the join cross-department permission table" by converting the conditional query function into the join table. The method for converting the conditional query function into the join table can be described in detail in step S405, and is not described herein again.

And S506, performing cross-department authority conversion.

In one embodiment, after the server obtains the above-mentioned join cross-department permission table, a new conditional query function may be generated based on the data identifier existing in the join cross-department permission table, where the query permission information of the user corresponding to the client identifier has been updated. It can be understood that the queryable data corresponding to the updated query authority information identifies corresponding data for the second data.

S507, generating the rewritten inquiry statement.

In one embodiment, after the server completes the cross-department authority conversion and obtains a new conditional query function, a query statement (e.g., SQL statement) may be generated based on the new conditional query function, so that the server may execute the query statement to perform a data query operation.

And S508, executing query operation in the data warehouse by using the rewritten query statement.

In an embodiment, the specific embodiment of step S508 can be described in step S405 and step S406, which are not described herein again.

Based on the description of the foregoing data processing method embodiment, the embodiment of the present invention also discloses a data processing apparatus, which may be a computer program (including program code) running in the foregoing client. The data processing apparatus may perform the method shown in fig. 2, step S401, step S402, and step S408 in the method shown in fig. 4, and may perform step S502 in the method shown in fig. 5. Referring to fig. 6, the data processing apparatus may include: a first acquiring unit 601, a first processing unit 602, a first transmitting unit 603 and a first receiving unit 604.

A first obtaining unit 601, configured to obtain a data identifier of data to be queried in response to a query operation of a user;

a first processing unit 602, configured to construct a permission query function containing the data identifier, and generate a query request, where the query request includes the permission query function;

a first sending unit 603, configured to send the query request to a server, so that the server converts the permission query function into a conditional query function, where the conditional query function includes the data identifier, the server generates a blank query interface based on the conditional query function, and searches for query data matching the conditional query function in a database of the server based on the data identifier, and the server fills the query data in the blank query interface to obtain a query result;

a first receiving unit 604, configured to receive the query result sent by the server, and display the query result.

According to an embodiment of the present invention, the steps involved in the data processing method shown in steps S401, S402, S403, and S408 shown in fig. 2 and 4, and step S502 shown in fig. 5 may be performed by respective units in the data processing apparatus shown in fig. 6. For example, step S201 shown in fig. 2 may be performed by the first acquiring unit 601 in the data processing apparatus shown in fig. 6, step S202 may be performed by the first processing unit 602 in the data processing apparatus shown in fig. 6, step S203 may be performed by the first sending unit 603 in the data processing apparatus shown in fig. 6, and step S204 may be performed by the first receiving unit 604 in the data processing apparatus shown in fig. 6; as another example, step S401 shown in fig. 4 may be executed by the first acquisition unit 601 in the data processing apparatus shown in fig. 6; step S402 may be performed by the first processing unit 602 in the data processing apparatus shown in fig. 6, step S403 may be performed by the first transmitting unit 603 in the data processing apparatus shown in fig. 6, and step S408 may be performed by the first receiving unit 604 in the data processing apparatus shown in fig. 6; as also shown, step S502 shown in fig. 5 may be executed by the first processing unit 602 in the data processing apparatus shown in fig. 6.

According to another embodiment of the present invention, the units in the data processing apparatus shown in fig. 6 are divided based on logical functions, and the units may be respectively or entirely combined into one or several other units to form the unit, or some unit(s) therein may be further split into multiple units smaller in function to form the unit(s), which may achieve the same operation without affecting the achievement of the technical effect of the embodiment of the present invention. In other embodiments of the present invention, the data processing apparatus may also include other units, and in practical applications, these functions may also be implemented by assistance of other units, and may be implemented by cooperation of multiple units.

According to another embodiment of the present invention, a data processing apparatus as shown in fig. 6 may be configured by running a computer program (including program codes) capable of executing steps involved in a corresponding method as shown in step S401, step S402, step S403, and step S408 shown in fig. 2 or fig. 4, and step S502 shown in fig. 5 on a general-purpose data processing device such as a computer including a processing element and a storage element such as a Central Processing Unit (CPU), a random access storage medium (RAM), a read-only storage medium (ROM), and the like, and a data processing method according to an embodiment of the present invention may be realized. The computer program may be, for example, embodied on a computer storage medium and loaded into and run on the data processing apparatus described above via the computer storage medium.

In the embodiment of the invention, the authority query function containing the data identifier is constructed and the query request is generated through the first processing unit, so that the server can obtain the query authority of the client and the data to be queried, which are sent by the first sending unit, and further, the server can generate the conditional query function containing the data identifier of the data to be queried based on the authority query function, thereby realizing the safety management of the data through the rewriting (or called SQL rewriting) of the query language, effectively ensuring the safety of the data, and enabling the server to search based on the conditional query function and generate the query result, so that the first receiving unit can receive and display the query result sent by the server, and the efficiency of data authority management is improved while the safety of the data is ensured.

Based on the description of the above data processing method embodiment, the embodiment of the present invention also discloses another data processing apparatus, which may be a computer program (including a program code) running in the above mentioned server. The data processing apparatus may perform steps S404 to S407 in the method shown in fig. 4, and may perform steps S503 to S508 in the method shown in fig. 5. Referring to fig. 7, the data processing apparatus may include: a second receiving unit 701, a second processing unit 702, and a second transmitting unit 703.

A second receiving unit 701, configured to receive a query request sent by a client, where the query request includes an authority query function, and the authority query function includes a data identifier of data to be queried;

a second processing unit 702, configured to convert the permission query function into a conditional query function, where the conditional query function includes the data identifier;

the second processing unit 702 is further configured to generate a blank query interface based on the conditional query function;

the second processing unit 702 is further configured to search query data matched with the conditional query function in a database of a server based on the data identifier, and fill the query data in the blank query interface to obtain a query result;

a second sending unit 703 is configured to send the query result to the client, so that the client displays the query result.

In one embodiment, the query request further includes a client identifier of the client, and the permission query function further includes permission information of a user cluster to which the user belongs, the permission information corresponding to the client identifier; the second processing unit 702 converts the permission query function into a conditional query function, where the conditional query function includes the data identifier, and is specifically configured to execute:

obtaining query authority information of a user corresponding to the client identifier based on the client identifier and authority information of a user cluster to which the user corresponding to the client identifier belongs;

screening out a first data identifier matched with the query authority information from the data identifiers;

and converting the authority query function into the conditional query function, wherein the conditional query function comprises the first data identifier.

In another embodiment, after the second processing unit 702 converts the authority query function into the conditional query function, where the conditional query function includes the first data identifier, the second processing unit 702 is further specifically configured to:

analyzing the conditional query function into an abstract syntax tree;

validating the first data identification based on the abstract syntax tree;

and if the verification is passed, triggering and executing the query function based on the condition to generate a blank query interface.

In yet another embodiment, the abstract syntax tree includes a node identification of at least one node of the corresponding query data identified by the first data; the second processing unit 702 performs validity verification on the first data identifier based on the abstract syntax tree, and specifically performs:

verifying the validity of the node identifiers of the nodes of the query data corresponding to the first data identifier to judge whether a second data identifier is screened from the first data identifier, wherein the second data identifier is obtained according to the nodes corresponding to the node identifiers passing the verification;

before the step of triggering and executing the generation of the blank query interface based on the conditional query function if the verification is passed, the method further includes:

and if a second data identifier is screened from the first data identifier, determining that the second data identifier passes verification, and updating the conditional query function comprising the first data identifier into the conditional query function comprising the second data identifier.

In another embodiment, the second processing unit 702 obtains, based on the client identifier and the authority information of the user cluster, query authority information of a user corresponding to the client identifier, and is specifically configured to perform:

acquiring user authorization information of a user corresponding to the client identification;

and acquiring cross-cluster authority information of the user cluster based on the authority information of the user cluster and the user cluster associated with the data to be queried, wherein the query authority information comprises user authorization information of the user and the cross-cluster authority information of the user cluster.

In another embodiment, the blank query interface includes at least one grid to be filled, and one or more grids to be filled in the at least one grid to be filled correspond to one data identifier; the second processing unit 702 fills the query data into the blank query interface to obtain a query result, and specifically executes:

and filling the query data corresponding to each data identifier into the grids to be filled corresponding to each data identifier to obtain the query result.

According to an embodiment of the present invention, steps S404 to S407 in the data processing method shown in fig. 4, and steps S503 to S508 in the data processing method shown in fig. 5 may be performed by respective units in the data processing apparatus shown in fig. 7. For example: steps S404 to S406 of fig. 4 may be executed by the second processing unit 702 of the data processing apparatus shown in fig. 7, and step S407 may be executed by the second sending unit 703 of the data processing apparatus shown in fig. 7.

According to another embodiment of the present invention, the units in the data processing apparatus shown in fig. 7 are divided based on logic functions, and the units may be combined into one or several other units respectively or all, or some unit(s) may be further split into multiple functionally smaller units, which may achieve the same operation without affecting the achievement of the technical effects of the embodiments of the present invention. In other embodiments of the present invention, the data processing apparatus may also include other units, and in practical applications, these functions may also be implemented by assistance of other units, and may be implemented by cooperation of multiple units.

According to another embodiment of the present invention, a data processing apparatus as shown in fig. 7 may be configured by running a computer program (including program codes) capable of executing steps S404 to S407 shown in fig. 4, and steps S503 to S508 shown in fig. 5, which are involved in the method, on a general-purpose data processing device such as a computer including a processing element and a storage element such as a Central Processing Unit (CPU), a random access storage medium (RAM), a read-only storage medium (ROM), and the like, and a data processing method of the embodiment of the present invention may be implemented. The computer program may be, for example, embodied on a computer storage medium and loaded into and run on the data processing apparatus described above via the computer storage medium.

In the embodiment of the invention, the data processing device receives the query authority of the client and the data to be queried, which are sent by the client, through the second receiving unit, and further, the second processing unit can generate a conditional query function containing a data identifier of the data to be queried based on the authority query function, and the second processing unit can search based on the conditional query function to generate a query result, so that the second sending unit can send the query result to the client, thereby realizing the safety management of the data through the rewriting (or called SQL rewriting) of the query language, effectively ensuring the safety of the data, and simultaneously improving the efficiency of data authority management.

Based on the description of the method embodiment and the device embodiment, the embodiment of the invention also provides a terminal. Referring to fig. 8, the terminal includes a processor 801, an input interface 802, an output interface 803, and a computer storage medium 804, and the processor 801, the input interface 802, the output interface 803, and the computer storage medium 804 in the terminal may be connected by a bus or other means.

The computer storage medium 804 is a memory device in the terminal for storing programs and data. It is understood that the computer storage medium 804 here may include a built-in storage medium in the terminal, and may also include an extended storage medium supported by the terminal. The computer storage medium 804 provides a storage space that stores the operating system of the terminal. Also stored in this memory space are one or more computer programs adapted to be loaded and executed by the processor 801. It should be noted that the computer storage medium herein may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk memory; and optionally at least one computer storage medium located remotely from the processor. The processor 801 (or CPU) is a computing core and a control core of the terminal, and is adapted to implement one or more computer programs, and specifically, adapted to load and execute the one or more computer programs so as to implement corresponding method flows or corresponding functions.

In one embodiment, the terminal may perform the steps performed by the client in the above embodiments, that is, the processor 801 may load and execute one or more computer programs stored in the computer storage medium 804 to implement the steps S401, S402, S403, and S408 shown in fig. 2 and fig. 4 and implement the step S502 shown in fig. 5, where in particular, the one or more computer programs in the computer storage medium 804 are loaded and executed by the processor 801:

In the embodiment of the invention, the terminal enables the server to acquire the query authority of the client in the terminal and the data to be queried by constructing the authority query function containing the data identifier and generating the query request, further enables the server to generate the conditional query function containing the data identifier of the data to be queried based on the authority query function, realizes the safety management of the data through the rewriting (or called SQL rewriting) of the query language, effectively ensures the safety of the data, and then enables the server to search based on the conditional query function and generate the query result, so that the client can receive and display the query result sent by the server, and the efficiency of data authority management is improved while the safety of the data is ensured.

Based on the description of the method embodiment and the device embodiment, the embodiment of the invention provides a server. Referring to fig. 9, the server includes a processor 901, an input interface 902, an output interface 903 and a computer storage medium 904, and the processor 901, the input interface 902, the output interface 903 and the computer storage medium 904 in the server may be connected by a bus or other means.

The computer storage media 904 is a memory device in the server for storing programs and data. It is understood that the computer storage media 904 may include built-in storage media in the server, and certainly may also include extended storage media supported by the server. Computer storage media 904 provides storage space that stores the operating system of the server. Also stored in this memory space are one or more computer programs adapted to be loaded and executed by processor 901. The computer storage medium may be a high-speed RAM memory, or may be a non-volatile memory (non-volatile memory), such as at least one disk memory; and optionally at least one computer storage medium located remotely from the processor. The processor 901 (or Central Processing Unit, CPU) is a computing core and a control core of the server, and is adapted to implement one or more computer programs, and in particular, adapted to load and execute the one or more computer programs so as to implement corresponding method flows or corresponding functions.

In one embodiment, the server may perform the steps performed by the server in the above embodiments, i.e., one or more computer programs stored in the computer storage medium 904 may be loaded and executed by the processor 901 to implement the steps S404 to S407 described above with respect to fig. 4, and the steps S503 to S508 described in fig. 5. In particular implementations, one or more computer programs in computer storage media 904 are loaded and executed by processor 901 to:

In one embodiment, the query request further includes a client identifier of the client, and the permission query function further includes permission information of a user cluster to which the user belongs, the permission information corresponding to the client identifier; when the processor 901 performs the conversion of the authority query function into a conditional query function, where the conditional query function includes the data identifier, the following specific steps are performed:

obtaining inquiry authority information of a user corresponding to the client identification based on the client identification and the authority information of a user cluster to which the user corresponding to the client identification belongs;

In another embodiment, the processor 901 is further configured to perform, after converting the permission query function into the conditional query function, the conditional query function including the first data identifier:

analyzing the conditional query function into an abstract syntax tree;

performing validity verification on the first data identification based on the abstract syntax tree;

and if the verification is passed, triggering and executing the condition query function to generate a blank query interface.

In yet another embodiment, the abstract syntax tree includes a node identification of at least one node of the corresponding query data identified by the first data; the processor 901, when performing validity verification of the first data identifier based on the abstract syntax tree, is specifically configured to perform:

verifying the validity of the node identifiers of the nodes of the query data corresponding to the first data identifier to judge whether a second data identifier is screened out from the first data identifier, wherein the second data identifier is obtained according to the nodes corresponding to the node identifiers passing the verification;

and if a second data identifier is screened from the first data identifier, determining that the verification is passed, and updating the conditional query function comprising the first data identifier into the conditional query function comprising the second data identifier.

In another embodiment, when the processor 901 obtains the query right information of the user corresponding to the client identifier based on the client identifier and the right information of the user cluster, specifically performs:

In another embodiment, the blank query interface includes at least one grid to be filled, and one or more grids to be filled in the at least one grid to be filled correspond to one data identifier; the processor 901 fills the query data into the blank query interface to obtain a query result, which specifically includes:

In the embodiment of the invention, the server receives the query request sent by the client to obtain the query authority and the data to be queried, further, the processor of the server generates the conditional query function containing the data identifier of the data to be queried based on the authority query function, so that the data is safely managed by rewriting (or called SQL rewriting) of the query language, the safety of the data is effectively ensured, then the processor searches based on the conditional query function, the query result can be generated and sent, and the efficiency of data authority management is improved while the safety of the data is ensured.

An embodiment of the present invention further provides a computer storage medium, where a computer program of the data processing method is stored in the computer storage medium, and when one or more processors load and execute the computer program, descriptions of the data processing method in the embodiments may be implemented, and are not described herein again. The description of the beneficial effects of the same method is not repeated herein. It will be appreciated that the computer program may be deployed to be executed on one or more devices that are capable of communicating with each other.

It should be noted that according to an aspect of the present invention, a computer program product or a computer program is also provided, the computer program product comprising a computer program, and the computer program is stored in a computer readable storage medium. The processor in the terminal reads the computer program from the computer-readable storage medium, and the processor executes the computer program to cause the terminal to execute:

It should be noted that according to another aspect of the present invention, a computer program product or a computer program is also provided, and the computer program product includes a computer program, and the computer program is stored in a computer readable storage medium. A processor in the server reads the computer program from the computer-readable storage medium, and the processor executes the computer program to cause the server to execute:

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above may be implemented by hardware associated with a computer program, and the computer program may be stored in a computer storage medium, and when executed, may include the processes of the embodiments of the methods described above. The computer storage medium may be a magnetic disk, an optical disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), or the like.

While the invention has been described with reference to a particular embodiment, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

Claims

1. A data processing method is applied to a client and comprises the following steps:

2. A data processing method is applied to a server and comprises the following steps:

generating a blank query interface based on the conditional query function;

searching query data matched with the conditional query function in a database of a server based on the data identification, and filling the query data into the blank query interface to obtain a query result;

3. The method according to claim 2, wherein the query request further includes a client identifier of the client, and the permission query function further includes permission information of a user cluster to which the user corresponding to the client identifier belongs; the converting the authority query function into a conditional query function, where the conditional query function includes the data identifier, includes:

4. The method of claim 3, wherein after converting the permission query function to the conditional query function, the conditional query function including the first data identification, the method further comprises:

analyzing the conditional query function into an abstract syntax tree;

validating the first data identification based on the abstract syntax tree;

5. The method of claim 4, wherein the abstract syntax tree includes a node identification of at least one node of the first data identification corresponding query data; the validating the first data identifier based on the abstract syntax tree comprises:

6. The method according to claim 3, wherein obtaining query right information of a user corresponding to the client identifier based on the client identifier and the right information of the user cluster comprises:

and obtaining cross-cluster authority information of the user cluster based on the authority information of the user cluster and the user cluster associated with the data to be queried, wherein the query authority information comprises user authorization information of the user and the cross-cluster authority information of the user cluster.

7. The method of claim 2, wherein the blank query interface comprises at least one grid to be filled, and one or more grids to be filled in the at least one grid to be filled correspond to one data identifier; the step of filling the query data into the blank query interface to obtain a query result comprises the following steps:

8. A data processing apparatus, applied to a client, comprising:

9. A data processing apparatus, wherein the apparatus is applied to a server, and comprises:

10. A computer storage medium, characterized in that it stores one or more computer programs adapted to be loaded by said processor and to perform the data processing method of claim 1 or any of claims 2-7.