CN117633837A

CN117633837A - Data access processing method, device, system and storage medium

Info

Publication number: CN117633837A
Application number: CN202311661693.4A
Authority: CN
Inventors: 褚仁杰; 温艳如
Original assignee: Agricultural Bank of China
Current assignee: Agricultural Bank of China
Priority date: 2023-12-05
Filing date: 2023-12-05
Publication date: 2024-03-01

Abstract

The application provides a data access processing method, device and system and a storage medium, and relates to the technical field of data management. In the scheme, based on a data viewing request carrying a user identifier and a target data identifier sent by a terminal device, a data access processing system determines whether a corresponding data viewing authority exists or not according to a plurality of set components. If the corresponding authority is not provided, a corresponding authority application request can be provided. After the authority application requests are authorized, the target data can be obtained from the database provided by the data access processing system, and the target data is returned to the terminal equipment. According to the technical scheme, whether the user has the viewing authority of the corresponding data or not is determined through the setting of the data authority, so that the private data of the user can be practically protected, and the data safety is improved.

Description

Data access processing method, device, system and storage medium

Technical Field

The present disclosure relates to the field of data management technologies, and in particular, to a data access processing method, device, system, and storage medium.

Background

With the development of intelligent analysis of data, data correlation analysis can maximize the value of mining data. Therefore, the demand for data correlation analysis for clients is gradually increasing with clients as main bodies. However, due to the consideration of privacy protection of client data information, client related data information needs to be included in the authority management category, so that users can use the data in a way and under control.

In the prior art, a Role-based access control (RBAC) model is generally adopted to limit the authority of the user of the client-related data. Specifically, the RBAC model is an authorization model that associates users, roles, and rights, one user having multiple roles and one role having multiple rights, i.e., constituting a user-role-right. In this model, the user and roles may be one-to-many or many-to-many relationships, where the current user's rights are the union of multiple roles. Meanwhile, the model introduces a user group concept, controls the role authority by using the user group, introduces a role inheritance architecture in a role system with an organization structure, and is compatible in a management mode, and an upper role inherits all the authorities of a lower role.

However, when the RBAC model supports a system with a data analysis requirement as a main body function, the authority can correspond to a main body of data analysis, such as a client data main body, and when a role is set to correspond to the data analysis function, the role has viewing and using authority for all client data, which does not meet the hierarchical management requirement of a management mechanism on the data, so that leakage of private data of the client is easily caused, and the problem of data security is caused.

Disclosure of Invention

The application provides a data access processing method, a device, a system and a storage medium, which are used for solving the technical problem of low data privacy in the existing data access process.

In a first aspect, the present application provides a data access processing system comprising: rights management system and database;

wherein the rights management system comprises:

the user management component is used for managing all user data in the system and carrying out basic authority configuration on the user;

the role management component is used for managing the role attributes, the role names, the role levels and inheritance relations among the roles in the system;

the authority management component is used for managing all page authorities, operation authorities and data authorities in the system;

the user role management component is used for managing the mapping relation between the user and the roles in the system;

the role authority management component is used for managing the mapping relation between roles and authorities in the system;

the business data management component is used for managing business data in the system;

and the data main body mapping management component is used for managing the mapping relation between the service data and the service main body.

In one possible design of the first aspect, the service data management component is specifically configured to implement hierarchical, staged, and categorized management on service data;

The data main body mapping management component is specifically configured to determine authority of a service main body associated with service data according to a mapping relationship between the service data and the service main body.

In a second aspect, the present application provides a data access processing method, which is applied to the data access processing system in the first aspect, and the method further includes:

receiving a data viewing request sent by first terminal equipment, wherein the data viewing request carries a first user identifier and a target data identifier for application viewing;

determining whether a first user corresponding to the first user identifier has permission to view target data corresponding to the target data identifier, wherein the data access processing system is configured with basic permission of each user, a mapping relationship between the user and a role, a mapping relationship between the role and the permission, and a mapping relationship between service data and a service main body;

if the first user does not have the authority to view the target data, returning an unauthorized notification message to the first terminal equipment;

after receiving a data viewing authority application request sent by the first terminal equipment, forwarding the data viewing authority application request to a second terminal equipment, wherein the data viewing authority application request carries the first user identifier and the target data identifier;

Receiving an audit authorization message sent by the second terminal device, wherein the audit authorization message comprises an authorization result of a second user on target data corresponding to the target data identifier applied by the first user;

determining whether the first user can view the target data according to the audit grant message;

if the first user is determined to be capable of viewing the target data, acquiring the target data from the database according to the target data identifier and the authorization result;

and returning the target data to the first terminal equipment.

In one possible design of the second aspect, the determining whether the first user corresponding to the first user identifier has authority to view the target data corresponding to the target data identifier includes:

determining the authority of the role of the first user according to the mapping relation between the user and the role in the authority management system and the mapping relation between the role and the authority;

determining a service main body corresponding to the target data according to the mapping relation between the service data and the service main body according to the target data identifier;

And determining whether the first user has the authority for checking the target data or not according to the basic authority corresponding to the first user identifier, the authority possessed by the role of the first user and the service body corresponding to the target data.

In one possible design of the second aspect, the authorization result includes desensitizing the data, and the obtaining the target data from a database according to the target data identifier and the authorization result includes:

according to the target data identification, searching the target data corresponding to the target data identification from the database;

performing desensitization processing on the target data in the database according to a preset desensitization processing rule to obtain target data after the desensitization processing;

correspondingly, the returning the target data to the first terminal device includes:

and returning the target data subjected to the desensitization treatment to the first terminal equipment.

In one possible design of the second aspect, the method further comprises:

if the first user has the authority to view the target data, the target data corresponding to the target data identification is searched from the database;

And returning the target data to the first terminal equipment according to the authority of the first user for checking the target data.

In one possible design of the second aspect, the method further comprises:

and adding an access record of the first user to the target data in a log record, wherein the access record comprises the first user identification and access description annotation of the target data.

In a third aspect, the present application provides a data access processing apparatus, including:

the first receiving module is used for receiving a data viewing request sent by first terminal equipment, wherein the data viewing request carries a first user identifier and a target data identifier for applying for viewing;

the right management module is used for determining whether a first user corresponding to the first user identifier has the right to view target data corresponding to the target data identifier, wherein the data access processing system is configured with basic right of each user, mapping relation between the user and roles, mapping relation between the roles and the right, and mapping relation between service data and a service main body;

the first sending module is used for returning a non-authority notification message to the first terminal equipment if the first user does not have the authority to view the target data;

The second sending module is used for forwarding the data viewing authority application request to the second terminal equipment after the first receiving module receives the data viewing authority application request sent by the first terminal equipment, wherein the data viewing authority application request carries the first user identifier and the target data identifier;

the second receiving module is used for receiving an audit authorization message sent by the second terminal device, wherein the audit authorization message comprises an authorization result of a second user on target data corresponding to the target data identifier applied by the first user;

the right management module is further used for determining whether the first user can view the target data according to the auditing authorization message;

the request processing module is used for acquiring the target data from the database according to the target data identifier and the authorization result if the first user can view the target data;

the first sending module is further configured to return the target data to the first terminal device.

In a fourth aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively coupled to the processor;

The memory stores computer-executable instructions;

the processor executes computer-executable instructions stored in the memory to implement the data access processing method according to any one of the second aspects.

In a fifth aspect, the present application provides a computer-readable storage medium having stored therein computer-executable instructions for implementing the data access processing method according to any of the second aspects when executed by a processor.

In a sixth aspect, the present application provides a computer program product comprising a computer program for implementing the data access processing method according to any one of the second aspects when the computer program is executed by a processor.

The data access processing method, device, system and storage medium can be used in the technical field of data management. Based on a data viewing request sent by a user through a terminal device, the data access processing system determines whether the user has the authority to view target data according to a first user identifier and a target data identifier carried in the data viewing request. The process is automatically judged by a right management system arranged in the data access processing system, so that the office efficiency is effectively improved. After the data viewing request of the user is refused, the user can submit a data viewing authority application request to the data access processing system, and at the moment, a special auditor feeds back an audit result according to the actual situation. After the verification is passed, the data access processing system transmits the target data after the desensitization processing to the terminal equipment for the user to check and operate. The authority checking process is subjected to more strict verification, and desensitization treatment is carried out when target data are transmitted, so that private data of a customer is effectively protected to a certain extent, the data security is improved, and the risk of data leakage is reduced.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and together with the description, serve to explain the principles of the application;

fig. 1 is an application scenario schematic diagram of a data access processing method provided in the present application;

FIG. 2 is a block diagram of a data access processing system provided herein;

FIG. 3 is a flowchart illustrating a first embodiment of a data access processing method provided in the present application;

fig. 4 is a schematic flow chart of a second embodiment of a data access processing method provided in the present application;

fig. 5 is a schematic flow chart of a third embodiment of a data access processing method provided in the present application;

fig. 6 is a schematic flow chart of a fourth embodiment of a data access processing method provided in the present application;

fig. 7 is a schematic flow chart of a fifth embodiment of a data access processing method provided in the present application;

FIG. 8 is a flow chart of a configurable business data analysis type authority control method provided by the application;

FIG. 9 is a schematic structural diagram of a first embodiment of a data access processing apparatus provided in the present application;

fig. 10 is a schematic structural diagram of an electronic device provided in the present application.

Specific embodiments thereof have been shown by way of example in the drawings and will herein be described in more detail. These drawings and the written description are not intended to limit the scope of the inventive concepts in any way, but to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments.

Detailed Description

For the purposes of making the objects, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions of the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is apparent that the described embodiments are some embodiments of the present application, but not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art based on the embodiments herein without making any inventive effort, are intended to be within the scope of the present application.

The terms referred to in this application are explained first:

data analysis: based on checking limited data or full data, the data value is mined by utilizing service processing experience and combining data chart display, adopting means such as manual autonomous analysis, automatic rule setting analysis, intelligent rule model training and the like, and combining the service process to produce the service value.

Private data: personal related data and operational data submitted by the user during use of the I-go service, such as, for example, a document number, contact address, asset information, credit rating, etc.

Role rights framework: by giving the roles to the users, the roles are associated with specific rights, so that the rights of the user for viewing interfaces, operational flows, analyzable data and the like are controlled by the roles.

Collocation: when a system developer develops, global identification card identifiers (Identity Document, ID for short) of various authorities are configured, and role access authorities are configured in a refining manner through an administrator role user.

Atomization: generally refers to things which cannot be split any more, and various subdivision rights, such as operation rights, display rights and data type rights (such as a mechanism to which data belongs, a client to which data belongs, a category to which data belongs and the like), are subdivided, and are flexibly and dynamically adjusted in real time by combining role rights configuration.

In recent years, along with the digitalized transformation of various industries, technological enabling services such as on-line flow and intelligence are created, and the industry technology is integrated to promote the service development, so that the method is a requirement and expected for related scientific departments. The data analysis guidance is a more common construction requirement, the on-line flow type integrated data analysis requirement is gradually vigorous, and the means of data analysis is gradually changed from manual small-quantity collection and analysis to automatic batch collection, on-line processing analysis, intelligent characteristic analysis and the like, so that the mining of the data value is gradually deepened. The data rights management is particularly important when the relevant data needs to be acquired before the data analysis is performed.

In the existing technical scheme, the complete data authority management system comprises a plurality of business processes, and general users only need to use part of functions in the system, for example, the system management functions only need to be opened by an administrator. In the conventional role authority framework, a role and a function need to be hooked, and when a user is given a specific role, a corresponding function can be used. When a user needs to analyze the data of the related functions, such as the business processing history of the same client in different functions, the system can only select to give the user a role, and the user can operate the functions at the moment. However, this exceeds the needs of the user and does not meet the management requirements of the service manager. Therefore, the RBAC model is proposed, which can support the establishment of the relationship between users, roles and rights, what the specific corresponding relationship of the rights is in the system, the general function composition of the system comprises pages, operations and data, the rights correspond to the specific page display in the function, whether specific operation flow can be carried out by users, whether specific data viewing and modification can be achieved through user operation, and the data range in the user viewable function. Specifically, the RBAC model is an authorization model in which users are associated through roles and rights to form a user-role-rights, in which the user and roles can be in one-to-many or many-to-many relationship, and when the user role is many-to-many, the rights of the current user are the union of multiple roles. Meanwhile, a user group concept is introduced based on the method, namely, the users of the same type belong to the same group, and role authority control is performed based on the group. And endowing the user group with attributes when the user is newly established, and omitting the user role configuration process. Meanwhile, in the role system of the organized architecture, a role inheritance architecture is introduced, the management mode is downward compatible, and the upper layer role inherits all the rights of the lower layer role and can be endowed with additional rights.

However, in the above RBAC model for data rights management, in actual situations, when a user-role is configured, part of roles may need to be isolated, role mutual exclusion needs to exist, and when a role is granted, the role cannot be processed by and audited by the user, and finally, the role is processed by the user and audited by the user. This breaks the privacy of the customer data to some extent, which is prone to data security problems.

In view of the above problems, the inventors have found during the course of research on data access processing schemes that existing user character rights models can correspond to a body of data analysis, such as a customer data body, when supporting a system that has data analysis requirements as a body of functionality. Meanwhile, when the role is set to correspond to the data analysis function, the role has the viewing and using rights for all client data, and the requirement of the management mechanism on layered management of the data is not met. In addition, when setting role inheritance to realize hierarchical management, a problem that the role inheritance is limited due to association analysis requirements between clients can occur. Therefore, the conventional RBAC model cannot be adapted to the intelligent data analysis type function, which easily causes leakage of private data of clients, thus creating a data security problem. Accordingly, the inventor considers whether the authority system can be configured on the basis of meeting the supervision requirements and protecting the private data of the clients. Specifically, when a user wants to acquire certain target data, it can be determined whether or not there is a right to access the target data by the functions provided by the plurality of components provided in the data access processing system. And when the corresponding rights are not available, the target data access rights can be applied to the data access processing system. After the result of the data access processing system passing the audit is obtained, corresponding target data can be obtained from a database provided by the data access processing system. The data access processing method decomposes the data authority design, realizes componentization and configuration development, establishes a data authority expansion mechanism, meets the integrated and intelligent requirements of a data analysis line, can realize the protection of maximized customer privacy data and improves the data safety.

Fig. 1 is an application scenario schematic diagram of a data access processing method provided in the present application. As shown in fig. 1, an application scenario of the solution provided in the present application includes a terminal device 101 and a server 102. Wherein server 102 is configured to deploy data access processing system 1021. The server 102 is a high-performance computer having functions of calculating, storing, and processing data. The data access processing system 1021 disposed in the terminal device 101 and the server 102 is connected through a communication network.

The main function of the terminal apparatus 101 is a function of providing a user with a data access request to the data access processing system 1021. Although only one terminal device 101 is shown in fig. 1, it should be understood that there may be two or more terminal devices 101.

Server 102 is primarily used to deploy data access processing system 1021. The data access processing system 1021 is mainly configured to receive a data access request sent by the terminal device 101 and to feed back a result of data access. Although only one server 102 is shown in fig. 1, it should be understood that there may be two or more servers 102.

After a user logs in to a front page provided by the data access processing system 1021 through the terminal device 101, the user inputs relevant information such as target request data at a corresponding function request position. After the user submits, the data access processing system 1021 determines whether the user has the right to acquire the target data based on the information such as the target request filled by the user, and feeds back the determination result to the user through the communication network. If the user does not have the right to access the target data, a request for acquiring the related target data may be made to the data access processing system 1021 through the terminal device 101. After the data access processing system 1021 passes the audit, the corresponding target data can be returned to the terminal device.

The following describes the technical scheme of the present application in detail through specific embodiments. It should be noted that the following embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

FIG. 2 is a block diagram of a data access processing system provided herein. As shown in fig. 2, the data access processing system 201 includes a rights management system 2011 and a database 2012. The rights management system 2011 includes a user management component 20111, a role management component 20112, a rights management component 20113, a user role management component 20114, a role rights management component 20115, a service data management component 20116, and a data body mapping management component 20117.

In particular, the specific meaning of each component is as follows:

the user management component 20111 is used for managing all user data in the system and performing basic authority configuration on the user.

In the user management component 20111, the method is mainly used for managing all user data in the system and performing basic authority configuration on the user.

Wherein a component is an object, which is a simple encapsulation of data and methods. The components typically include three types of composite components, extension components, and custom components. The user management component 20111 is configured based on all user data and user basic rights, so that a user can have basic operation rights after logging in the data access processing system. Such as organization hierarchy, sensitive data rights, user base information, etc. The user data generally comprises a user name of a user logging in the data access processing system, an organization level to which the user belongs, related operation records of the user in the data access processing system and the like. The user basic authority is simply understood to be the right of the user, namely after the user logs in the data access processing system, some functions can be used, some functions cannot be used, the authority set by a system administrator is only the user conforming to the authority can use the corresponding functions.

For example, after the a user successfully logs into the data access processing system 201, the a user may access a front page menu item provided by the data access processing system 201, and the a user may use related functions under the menu. For another example, the data access processing system 201 gives the user a basic button rights, and the user a can click a corresponding button, jump to a different page, and so on.

The role management component 20112 is configured to manage role attributes, role names, role hierarchies, and inheritance relationships among roles of all roles in the system.

In the role management component 20112, the role management component is mainly used for managing the role attributes, the role names, the role hierarchies and inheritance relationships among the roles of all roles in the system.

The character attribute is divided into a common character and a system administrator, and the character name is set based on the post type set in the enterprise, for example, in a financial institution, the character name may be a hall manager, a client manager, a line length, a technology developer, a data analyzer, and the like.

The role tiers are set based on post levels set in the enterprise, such as internets, primary staff, intermediate staff, advanced staff, and management layers, respectively corresponding to different role tiers.

Inheritance relationships between roles are obtained after the role hierarchy is established. For example, if the role hierarchy of role 1, role 2 and role 3 is gradually decreasing, role 1 inherits role 2 and role 3, and role 2 inherits role 3.

The authority management component 20113 is configured to manage all page authorities, operation authorities and data authorities in the system.

In the rights management component 20113, the primary user manages all page rights, operation rights, and data rights in the system. For example, all pages, operations, data rights in the system are managed, and pages viewable, operations usable, and data ranges viewable for use in the system are listed, for example, managed by menus, buttons, service data types, and the like, respectively.

The page authority and the operation authority may be referred to as function authority, where the function authority specifically indicates which rights the user has, such as adding, deleting, modifying, checking, approving, and anti-approving specific documents. Generally divided by the work content of a person within an organization. For example, a document often has an input person and an approver, the input person has the authority to add, delete, check and check, and the approver has the authority to approve, inverse approve and inquire.

The data authority refers to which ranges of main data can be seen by the user, such as divided by departments or business lines, user C sees team a data, and user D can only see team B data.

The user role management component 201144 is configured to manage a mapping relationship between users and roles in the system.

The user role management component 20114 is mainly used for managing the mapping relationship between the user and the roles in the system, so that the user has roles in the system to use the system.

The mapping relationship between the users and the roles may be one-to-one, that is, one user corresponds to one role, or one-to-many, that is, one user corresponds to a plurality of roles, or many-to-many, that is, a plurality of users correspond to a plurality of roles, or many-to-one, that is, a plurality of users correspond to one role. For example, since user E is a manager of a project department of a company, the role of user E is a manager of a project department. Meanwhile, the user E is also an employee of the company, so the role of the user E is also an employee.

And a role authority management component 20115, configured to manage a mapping relationship between roles and authorities in the system.

The role management component 20115 is mainly used for managing the mapping relationship between roles and rights in the system. Meanwhile, the role management component 20115 has specific authorization information for different service data. For example, the authority of the role to view the page, the authority of the role using operation, the authority of the role to view the specific type and the specific level of business data are given.

The mapping relationship between roles and rights may be one-to-one, that is, one role corresponds to one right, or one-to-many, that is, one role corresponds to multiple rights, or many-to-many, that is, multiple roles correspond to multiple rights, or many-to-one, that is, multiple roles correspond to one right. For example, the system administrator has the authority to add, delete, change and check the relevant information of the user, the personnel manager has the authority to manage the employee, and the employee has the authority to check the personal information.

The service data management component 20116 is configured to manage service data in the system.

In this service data management component 20116, the primary user manages service data in the system. Meanwhile, the service data management component 20116 also has specific authorization information for different service data.

The business data is mainly used for supporting business system application data, and is core data in enterprises, such as commodity information, article information, transaction order data, member data and the like.

In one possible implementation, the service data management component 20116 is specifically configured to implement hierarchical, staged, and categorized management on service data.

Specifically, the service data management component 20116 is specifically configured to implement hierarchical, staged, and classified management on service data. The business data hierarchical management is one of important links of data management, groups the business data according to certain rules and conditions, and performs hierarchical management on the classified data according to different importance degrees so as to better meet the requirements of business data processing and use. In hierarchical management, it is generally necessary to determine the principle of classification of service data first, then determine the level of data hierarchy, and finally determine the standard of service data hierarchy.

The implementation of staged management of traffic data refers to traffic data generated at different processing stages. For example, a customer handles a mobile phone card in a business hall, and then sets contents such as a flow package and the like on the basis of the contents, and binds a main card business and a sub card business, and business data generated in the stages are managed in stages by taking business process handling nodes as standards.

The service data realization type management refers to the realization of the classification type management of the service data according to the service characteristics and the data characteristics. For example, business data is classified into different types of customer data, financial data, product data, and the like.

The data body mapping management component 20117 is configured to manage a mapping relationship between service data and a service body.

The data body mapping management component 20117 is mainly used for managing the mapping relationship between service data and service bodies.

The business data is an important basis for enterprise operation, and through analysis of the business data, the operation condition, market demand, competitors and the like of the enterprise can be known, so that support is provided for enterprise decision making. Business entities are defined from a business perspective, for example, within an enterprise, and may be divided into a finance department, a business department, a personnel department, etc., where these departments respectively manage different data businesses and also generate different business data. Therefore, a certain mapping relationship exists between the service data and the service body.

In one possible implementation, the data body mapping management component 20117 is specifically configured to determine, according to a mapping relationship between service data and a service body, a right of the service body associated with the service data.

Specifically, the data body mapping management component 20117 is specifically configured to determine, according to a mapping relationship between service data and a service body, a right of the service body associated with the service data.

The data body mapping management component 20117 is mainly used for managing a mapping relationship between service data and a service body, determining that the service data can be associated with the service body, and obtaining the associated service body authority together when the service body has one type of service data processing authority.

The Database 2012 is mainly used for storing user information, service data and the like, and can be a common relational Database such as an Oracle Database (Oracle for short), an SQL Server Database (Microsoft SQL Server for short), a MySQL Database (MySQL Relational Database Management System for short, mySQL) and the like, and the Database is specifically required to be determined according to the actual service data type and the like.

The data access processing system mainly describes functions of a right management system and a database contained in the system. The components arranged in the authority management system have the relevant functions of data management, can realize hierarchical, staged and classified management of service data, and provide mapping relations among users, roles and authorities, so that a certain customer privacy data protection is provided for the subsequent data access processing process, and the security of the service data is improved. The database may store the necessary business data, etc., to provide a data source for subsequent data access. Meanwhile, each function developer does not need to pay attention to data authority after realizing necessary components of the framework.

Fig. 3 is a flowchart of a first embodiment of a data access processing method provided in the present application. As shown in fig. 3, the scheme is applied to the data access processing system in the foregoing embodiment, and the flow of the data access processing method may include:

s301: receiving a data viewing request sent by a first terminal device, wherein the data viewing request carries a first user identifier and a target data identifier for application viewing.

In this step, if the user has a data analysis requirement for mining the data value, the user may log in to a front page provided by the data access processing system through the first terminal device, input a corresponding data acquisition requirement, and click to submit. At this time, the data access processing system will respond to the submitting request of the user and receive the data viewing request sent by the first terminal device. The data viewing request carries a first user identifier and a target data identifier for application viewing.

Specifically, the first user identification is a name for identifying the user identity when the user logs in on the internet. For example, a user a inputs an account number and a password through a first terminal device to log in a front page provided by a data access processing system, wherein the account number can be used as a first user identifier. The application viewing target data identification is used to uniquely identify the data that the user is viewing. For example, the data that user B wants to view is related financial data inside the enterprise, which has a corresponding data identifier a. Thus, the target data for which the application is viewing is identified as a.

S302: determining whether a first user corresponding to the first user identifier has permission to view target data corresponding to the target data identifier, wherein a basic permission of each user, a mapping relationship between the user and a role, a mapping relationship between the role and the permission and a mapping relationship between service data and a service main body are configured in the data access processing system.

In this step, based on the first user identifier and the target data identifier received by the data access processing system in step S301, the data access processing system determines whether the first user corresponding to the first user identifier has the authority to view the target data corresponding to the target data identifier based on the configured basic authority of each user, the mapping relationship between the user and the role, the mapping relationship between the role and the authority, and the mapping relationship between the service data and the service body.

Specifically, based on the obtained first user identifier, the data access processing system can automatically determine whether the first user corresponding to the first user identifier has the authority to view the target data. The data access processing system determines based on the first user identification and in combination with a plurality of groups of mapping relations set in the system. For example, the first user identifier is E, the target data identifier is E, the role of the user identified as E is determined to be accounting based on the mapping relationship between the user and the role and the authority in the data access processing system, and the authority corresponding to the accounting is related data of the view data identifiers a, E and c. And determining the business body corresponding to the business data with the target data mark of e as a financial department based on the mapping relation between the business data of the data access processing system and the business body. Based on the data access processing system according to the multiple groups of mapping relations and the user identifications, the first user identified as E can be determined to have the target data with the view target data as E. If the business body corresponding to the business data with the target data being E is a personnel department, the first user with the first user identifier being E can be determined to not have the target data with the target data being E.

S303: and if the first user does not have the authority to view the target data, returning an unauthorized notification message to the first terminal equipment.

In this step, after determining whether the first user corresponding to the first user identifier has the authority to view the target data corresponding to the target data identifier based on step S302, if the first user does not have the authority to view the target data, a message of no authority notification is returned to the first terminal device.

The data access processing system feeds back the notification message without authority to the first terminal equipment through the communication network connection, at this time, the user can obtain a feedback result of the data check request, the subsequent user can submit the data check authority application request to the data access processing system, and after the data check request passes the verification success, the data check request is submitted again, so that the corresponding target data can be obtained.

S304: after receiving a data viewing authority application request sent by a first terminal device, forwarding the data viewing authority application request to a second terminal device, wherein the data viewing authority application request carries a first user identifier and a target data identifier.

In this step, based on step S304, after receiving the no-authority notification message fed back by the data access processing system, the user may submit a data viewing authority application request through the first terminal device, and after the data access processing system receives the data viewing authority application request sent by the first terminal device, the data access processing system forwards the data viewing authority application request to the second terminal device.

The second terminal device is mainly used for receiving a data viewing authority application request sent by the data access processing system, and the data viewing authority application request carries a first user identifier and a target data identifier.

S305: and receiving an audit authorization message sent by the second terminal equipment, wherein the audit authorization message comprises an authorization result of the second user on target data corresponding to the target data identifier applied by the first user.

In this step, after the data access processing system forwards the data viewing authority application request to the second terminal device based on step S304, the second terminal device receives the corresponding data viewing authority application request, and based on the first user identifier and the target data identifier, the second user can obtain an authorization result, that is, whether the first user has the authority to view the target data.

The second user refers to a manager of the related data authority, that is, when the user does not have the viewing authority of the related data, the manager can be authorized by special technicians according to actual conditions, and the manager can perform operations such as adding, deleting, checking and the like on the related authority of the user. Therefore, based on the data received by the second terminal device to view the permission application request, the second user can determine a final authorization result according to actual conditions. The authorization result will be included in the audit authorization message. And the second terminal equipment returns the auditing authorization message to the data access processing system, wherein the auditing authorization message comprises an authorization result of the second user on the target data corresponding to the target data identifier applied by the first user.

S306: and determining whether the first user can view the target data according to the auditing authorization message.

In this step, after the data access processing system receives the audit grant message sent by the second terminal device based on step S305, the data access processing system determines whether the first user can view the target data according to the audit grant message.

The auditing and authorizing message comprises an authorizing result of the second user on the target data corresponding to the target data identifier applied by the first user, wherein the authorizing result indicates two conditions, namely that the first user can not view the target data and that the first user can view the target data.

S307: if the first user is determined to be capable of viewing the target data, the target data is obtained from the database according to the target data identification and the authorization result.

In this step, based on the step S306, the data access processing system determines whether the first user can view the target data according to the audit authorization message, and if it is determined that the first user can view the target data, the target data is obtained from the database according to the target data identifier and the authorization result.

If the first user is determined to be unable to view the target data, the data access processing system does not need to be connected with a database to acquire the target data.

S308: and returning the target data to the first terminal equipment.

In this step, based on the step 307, the data access processing system obtains the target data from the database according to the target data identifier and the authorization result, and returns the target data to the first terminal device.

After the target data is returned to the first device, the first user can perform data analysis and other works on the acquired data, so that the value of the related data is mined. If the first user can not view the target data, the data access processing system sends a notification message that the auditing authorization is not passed to the first terminal device, so that the user obtains feedback of the data viewing authority application request.

The data access processing method mainly describes a process how a first user obtains target data through a first terminal device. Based on the data viewing request sent by the first terminal device, the data access processing system can determine whether the data access processing system has the right to view the corresponding target data. And under the condition that the user does not have the data, the user can send a data viewing authority application request, the second terminal equipment feeds back the data viewing authority application request according to the actual condition, and the data access processing system can send the target data to the first terminal equipment after the data access processing system is authorized. In the process, the acquisition of the target data needs to be subjected to multiple verification steps, so that the protection of the private data of the client can be obviously improved. Meanwhile, when the data viewing rights are not provided, the user can apply the rights of the data analysis main body on line in real time, so that flexible data rights configuration is provided.

Fig. 4 is a schematic flow chart of a second embodiment of a data access processing method provided in the present application. As shown in fig. 4, on the basis of the above embodiment, it is determined whether the first user corresponding to the first user identifier has the right to view the target data corresponding to the target data identifier, and the flow of the data access processing method may include:

s401: and determining the authority of the role of the first user according to the mapping relation between the user and the role in the authority management system and the mapping relation between the role and the authority.

In this step, after the data access processing system receives the data viewing request carrying the first user identifier and the target data identifier, the data access processing system may determine whether the first user corresponding to the first user identifier has authority to view the target data corresponding to the target data identifier. In the determining process, the data access processing system firstly needs to execute the operation of determining the authority of the role of the first user according to the first user identification, the mapping relation between the user and the role in the authority management system and the mapping relation between the role and the authority.

Based on the first user identification in the data viewing request, the authority of the role of the first user can be determined according to the mapping relation between the role and the user provided by the authority management system in the data access processing system.

For example, the first user identifier is u, and based on the mapping relationship between the user and the roles, the roles of the user corresponding to the user identifier u are role 1 and role 2. Based on the mapping relation between the roles and the rights, the rights of the role 1 are the rights 1, and the rights of the role 2 are the rights 2 and the rights 3. Based on the determined mapping, it may be determined that the role identified as u by the first user has rights 1, 2 and 3.

S402: and determining the service main body corresponding to the target data according to the mapping relation between the service data and the service main body.

In this step, after determining, based on the rights management system in step S401, that the role of the first user has rights, the data access processing system then needs to perform an operation of determining, according to the target data identifier carried in the data viewing request and the mapping relationship between the service data and the service entity, the service entity corresponding to the target data.

Wherein, the mapping relation between the business data and the business main body is provided by the authority management system. For example, the target data is identified as w, the service data corresponding to the target data w is personnel data, and on the basis, the mapping relationship between the service data and the service main body is used as a basis, and the service main body corresponding to the personnel data is a personnel department. Therefore, based on the determined mapping relationship, the business entity corresponding to the target data with the target data mark w can be determined to be a personnel department.

S403: and determining whether the first user has the authority for checking the target data or not according to the basic authority corresponding to the first user identifier, the authority possessed by the role of the first user and the service main body corresponding to the target data.

In this step, based on the authority of the role of the first user determined in step S401 and the service body corresponding to the target data determined in step S402, the data access processing system may determine whether the first user has the authority to view the target data by combining with the basic authority corresponding to the first user identifier.

The basic authority corresponding to the first user identification is provided by a user management component in the authority management system. For example, the authority of the role of the first user is to add, delete and examine personnel data, the business body corresponding to the target data is personnel department, the basic authority corresponding to the first user identification is to view and modify personal data information of the first user, and by integrating the result, the user can be judged to have the authority to view the target personnel data.

The data access processing method mainly illustrates how the data access processing system determines whether a first user has permission to view target data according to the first user identification and the target data identification. And determining the authority of the role of the first user based on the first user identification and the mapping relation between the user and the role and the mapping relation between the role and the authority. And determining the service body corresponding to the target data based on the target data identification and the mapping relation between the service data and the service body. On the basis, whether the user has the authority to view the target data is determined by combining the basic authority corresponding to the first user identifier. And through application of various mapping relations, the authority result is accurately determined, and the privacy of the client data is effectively protected. Meanwhile, the data access processing system applied by the method is developed in a parameterized and configured form, and is simple and easy to use to realize dynamic real-time adjustment of role authority management and control.

Fig. 5 is a schematic flow chart of a third embodiment of a data access processing method provided in the present application. As shown in fig. 5, on the basis of any one of the foregoing embodiments, the authorization result includes desensitizing the data, and according to the target data identifier and the authorization result, the target data is obtained from the database, and correspondingly, the target data is returned to the first terminal device, where the flow of the data access processing method may include:

s501: if the first user can view the target data, the target data corresponding to the target data identification is searched from the database according to the target data identification.

In this step, after the second terminal device examines the data viewing authority application request sent by the data access processing system, the data access processing system searches the target data corresponding to the target data identifier from the database according to the target data identifier.

The database is embedded in the data access processing system and is mainly used for storing various business data, user information and the like in enterprises. Based on the target data identification, the position of the target data can be quickly positioned in the database. The target data identification may be regarded as an index to the database, with which specific information in the data table may be accessed quickly.

For example, the target data is identified as n, and the database table with the name n is recorded in the database at the position where the target data identified as n is recorded. According to the table, the target data corresponding to the target data identification can be found.

S502: and performing desensitization processing on the target data in the database according to a pre-configured desensitization processing rule to obtain target data after the desensitization processing.

In this step, based on the step S501, after the data access processing system searches the target data corresponding to the target data identifier from the database, the target data in the database needs to be subjected to desensitization processing according to a preset desensitization processing rule, so as to obtain target data after the desensitization processing.

The desensitization processing is a technology for protecting personal privacy, and the sensitive data is encrypted or deformed so that the original data cannot be identified or restored.

The desensitization processing rule is to protect personal privacy to the greatest extent on the basis of keeping the consistency and availability of data. Among them, the common desensitization treatment methods are encryption desensitization, deletion desensitization, anonymous desensitization, confusion desensitization, etc. Encryption desensitization refers to the encryption processing of target data using cryptographic algorithms. Deleting desensitization refers to deleting sensitive information in the target data or replacing sensitive information with specific symbols or analog data. Anonymous desensitization refers to desensitizing personal identity information such that it cannot be directly associated with a personal identity. Confusion desensitization refers to the process of confusion over certain fields in the data such that they are no longer discernable. Which desensitization treatment method is specifically set needs to be determined according to actual conditions.

Based on a pre-configured desensitization processing rule, the target data acquired from the database can be subjected to desensitization processing, so that the target data after the desensitization processing is obtained.

S503: and returning the target data subjected to the desensitization treatment to the first terminal equipment.

In this step, the data access processing system performs desensitization processing on the target data acquired from the database based on step S502, and returns the target data after the desensitization processing to the first terminal device after the target data after the desensitization is obtained.

The data access processing system is connected with the first terminal equipment through a communication network, after the data access processing system returns the target data subjected to desensitization processing to the first terminal equipment, the first terminal equipment can receive corresponding information, and a first user can check the fed-back target data on a front-end page displayed by the first terminal equipment and continue subsequent corresponding processing.

The data access processing method mainly describes a process of obtaining target data after a data viewing authority application request of a first user passes. The data access processing system feeds back target data to the first user after desensitizing the target data based on a preset desensitizing processing rule, and the operation can strengthen the protection of the private data of the client, improve the security of the private data of the client and reduce the leakage risk of the private data of the client.

Fig. 6 is a flowchart of a fourth embodiment of a data access processing method provided in the present application. As shown in fig. 6, on the basis of any one of the above embodiments, the flow of the data access processing method may include:

s601: if the first user has the authority to view the target data, the target data corresponding to the target data identification is searched from the database.

In the step, after a first user sends a data viewing request to a data access processing system through a first terminal device, the data access processing determines whether the first user has the authority to view target data or not based on a first user identifier and a target number data identifier carried in the data viewing request. If the first user has the authority to view the target data, the target data corresponding to the target data is searched from the database.

According to the multiple groups of mapping relations set in the data access processing system, whether the first user corresponding to the first user identifier in the data viewing request has the authority to view the target data or not can be determined. After verification, the first user does have the authority to view the target data, and the data access processing system searches the target data corresponding to the target data identifier from the embedded database based on the target data identifier.

S602: and returning the target data to the first terminal equipment according to the authority of the first user for checking the target data.

In this step, after the data access processing system obtains the target data corresponding to the target data identifier from the database based on step S601, the target data is returned to the first terminal device according to the authority of the first user to view the target data.

The data access processing system receives a data viewing request carrying the first user identifier and the target data identifier, and then obtains corresponding target data from a database directly based on the target data identifier, and transmits the obtained target data to the first terminal device through a communication network connection according to the authority of the first user for viewing the target data, and the first user can view corresponding target data on a front-end page provided by the first terminal device for subsequent operation and processing.

The data access processing method mainly describes a process of acquiring target data when a first user has the viewing right of the target data. The acquisition position of the target data is a database in the data access processing system, and the acquisition of the target data is based on the target data identification. Through the acquisition process of the target data, the privacy of the client data can be effectively protected, and the client data outside the authority is prevented from being sent to the user by mistake.

Fig. 7 is a schematic flow chart of a fifth embodiment of a data access processing method provided in the present application. As shown in fig. 7, on the basis of any one of the above embodiments, the flow of the data access processing method may include:

s701: and adding an access record of the first user to the target data in the log record, wherein the access record comprises the first user identification and access description annotation to the target data.

In this step, after the first user sends the data viewing request through the first terminal device, the operations that can be performed subsequently are classified into various types, such as viewing the target data, sending the data authority viewing request, and the like. This entire process needs to be recorded. Therefore, based on the logging function provided by the data access processing system, when the user accesses the target data, the access record of the first user to the target data is added in the logging.

The access record mainly comprises two parts of content, wherein the first part of content is a first user identifier which can be obtained through a data viewing request, and the second part of content is an access description annotation for target data, and the access description annotation is mainly used for describing basic information of the target data, operations performed on the target data by a user and the like. For example, the first user identified as q performs an operation of viewing the target data identified as r, and then the user identified as q and the operation of viewing the target data identified as r are recorded in the log.

The data access processing method mainly describes the function of providing log records by a data access processing system. The log is mainly used for recording access records of the first user to the target data. The access record includes a first user identification and an access specification annotation to the target data. Through providing the function of log record, can make things convenient for the technician to follow-up to turn over, provide the data foundation for data authority management.

Based on any one of the foregoing embodiments, in one possible implementation manner, fig. 8 is a flowchart of a configurable service data analysis type authority control method provided in the present application. As shown in fig. 8, the process of authority control is mainly embodied, namely hierarchical, configurable and multi-aspect authority control, the front-end page is loaded according to the authority configuration, the operable button configuration is loaded to the operation authority verification of the back-end service configurable page, the data is returned to the interception type configuration authority control, and the following control process is formed after unified assembly:

s801: and (5) loading pages.

S802: the automatic query may expose the content unit.

S803: and (5) page operation.

S804: and the service request sends the service end.

S805: unified authentication mechanism.

S806: and uniformly checking the request operation authority.

S807: request execution.

S808: and uniformly checking the data authority.

S809: structured query language (Structured Query Language, abbreviated as SQL) execution.

S8010: and uniformly checking whether the detail is desensitized.

S8011: and unifying log records.

S8012: the page displays the content.

S8013: if the user needs to check the unauthorized data, entering an application authorization mechanism page.

Specifically, the user logs in the terminal device and enters a page loading state, and in the page, the presentable content units, such as character menu configuration, character button configuration and the like, can be automatically queried. Based on the data viewing requirement, the user executes page operation and sends a service request to the server. After receiving a data viewing request of a user, a server starts to execute a unified authentication mechanism, such as Java security framework (Shrio) request authentication, front-end and back-end separation token authentication, then executes unified check request operation permission, namely a user mechanism, role information, request required role configuration notes and request required mechanism level configuration, and then the server starts to request execution, and then the server executes unified check data permission, namely data and user association and data and mechanism association. If the authority is met, the server starts to execute SQL sentences, uniformly checks whether details are desensitized or not, namely whether user authority configuration is desensitized or not, the rule according to the rule is a desensitization implementation process rule, then executes uniform log record, namely user mechanism, role information and request log description configuration annotation, and finally displays the checked data on a page of the terminal equipment. If the user needs to check the unauthorized data, a data check permission request is required to be sent, an authorization mechanism page is applied, and an operator is provided with permission outside data check, application authorization application, application data check and the like. Based on the audit, it is determined whether the user can view the unauthorized data. Through the cooperation of the above processes, a set of configurable business data analysis type authority control method can be built. The method uses a request service calling execution mechanism, performs unified check and unified record in a section cutting process, performs unified data query, detail display desensitization and other control in a request, and flexibly and newly increases rights for data outside the rights range by adopting a rights application authorization mechanism based on a principle of minimizing authorization and maximizing privacy protection so as to realize fine management and control.

Fig. 9 is a schematic structural diagram of a first embodiment of a data access processing apparatus provided in the present application. As shown in fig. 9, the data access processing apparatus 900 includes:

the first receiving module 901 is configured to receive a data viewing request sent by a first terminal device, where the data viewing request carries a first user identifier and a target data identifier for application for viewing;

the rights management module 902 is configured to determine whether a first user corresponding to the first user identifier has a right to view target data corresponding to the target data identifier, where a basic right of each user, a mapping relationship between a user and a role, a mapping relationship between a role and a right, and a mapping relationship between service data and a service body are configured in the data access processing system;

the first sending module 903 is configured to return a no-authority notification message to the first terminal device if the first user does not have authority to view the target data;

the second sending module 904 is configured to forward a data viewing authority application request to the second terminal device after the first receiving module receives the data viewing authority application request sent by the first terminal device, where the data viewing authority application request carries a first user identifier and a target data identifier;

The second receiving module 905 is configured to receive an audit authorization message sent by the second terminal device, where the audit authorization message includes an authorization result of the second user on target data corresponding to the target data identifier applied by the first user;

the rights management module 902 is further configured to determine, according to the audit grant message, whether the first user can view the target data;

a request processing module 906, configured to obtain, if it is determined that the first user can view the target data, the target data from the database according to the target data identifier and the authorization result;

the first sending module 903 is further configured to return the target data to the first terminal device.

Optionally, the rights management module 902 is further configured to:

determining the authority of a role of a first user according to a mapping relation between the user and the role in the authority management system and a mapping relation between the role and the authority;

according to the target data identification, determining a service main body corresponding to the target data according to the mapping relation between the service data and the service main body;

and determining whether the first user has the authority for checking the target data or not according to the basic authority corresponding to the first user identifier, the authority possessed by the role of the first user and the service main body corresponding to the target data.

Optionally, the request processing module 906 is further configured to:

according to the target data identification, target data corresponding to the target data identification is searched from a database;

and performing desensitization processing on the target data in the database according to a pre-configured desensitization processing rule to obtain target data after the desensitization processing.

Optionally, the first sending module 903 is further configured to:

Optionally, the request processing module 906 is further configured to:

if the first user has the authority to view the target data, the target data corresponding to the target data identification is searched from the database.

Optionally, the first sending module 903 is further configured to:

Optionally, the request processing module 906 is further configured to:

and adding an access record of the first user to the target data in the log record, wherein the access record comprises the first user identification and access description annotation to the target data.

The device provided in the embodiment of the present application may be used to execute the data access processing method in the above-described embodiment, and its implementation principle and technical effects are similar, and are not described herein again.

It should be noted that, it should be understood that the division of the modules of the above apparatus is merely a division of a logic function, and may be fully or partially integrated into a physical entity or may be physically separated. And these modules may all be implemented in software in the form of calls by the processing element; or can be realized in hardware; the method can also be realized in a form of calling software by a processing element, and the method can be realized in a form of hardware by a part of modules. For example, the address acquisition module may be a processing element that is set up separately, may be implemented in a chip of the above apparatus, or may be stored in a memory of the above apparatus in the form of program codes, and the functions of the address acquisition module may be called and executed by a processing element of the above apparatus. The implementation of the other modules is similar. In addition, all or part of the modules can be integrated together or can be independently implemented. The processing element here may be an integrated circuit with signal processing capabilities. In implementation, each step of the above method or each module above may be implemented by an integrated logic circuit of hardware in a processor element or an instruction in a software form.

Fig. 10 is a schematic structural diagram of an electronic device provided in the present application. As shown in fig. 10, the electronic device may include a receiver 1000, a transmitter 1001, a processor 1002, and a memory 1003. Wherein the receiver 1000 and the transmitter 1001 are used for realizing data transmission between the terminal device and the data access processing system, and the memory 1003 stores computer-executable instructions; the processor 1002 executes computer-executable instructions stored in the memory 1003 to implement the data access processing method in the above embodiment.

The present embodiment provides a computer-readable storage medium in which computer-executable instructions are stored, which when executed by a processor are configured to implement the data access processing method in the above embodiment.

The embodiment of the application also provides a computer program product, which comprises a computer program, and the computer program realizes the data access processing method provided by any one of the embodiments when being executed by a processor.

In the present application, "at least one" means one or more, and "a plurality" means two or more. "and/or", describes an association relationship of an association object, and indicates that there may be three relationships, for example, a and/or B, and may indicate: a alone, a and B together, and B alone, wherein a, B may be singular or plural. The character "/" generally indicates that the front and rear associated objects are an "or" relationship; in the formula, the character "/" indicates that the front and rear associated objects are a "division" relationship. "at least one of" or the like means any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (one) of a, b, or c may represent: a, b, c, a-b, a-c, b-c, or a-b-c, wherein a, b, c may be single or plural.

It will be appreciated that the various numerical numbers referred to in the embodiments of the present application are merely for ease of description and are not intended to limit the scope of the embodiments of the present application. In the embodiments of the present application, the sequence number of each process does not mean the sequence of execution sequence, and the execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present application, and not for limiting the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some or all of the technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data access processing system, comprising: rights management system and database;

wherein the rights management system comprises:

2. The system according to claim 1, wherein the service data management component is specifically configured to implement hierarchical, staged, and categorized management of service data;

3. A data access processing method, characterized by being applied to the data access processing system of claim 1 or 2, the method further comprising:

and returning the target data to the first terminal equipment.

4. The method of claim 3, wherein the determining whether the first user corresponding to the first user identification has permission to view the target data corresponding to the target data identification comprises:

5. The method according to claim 3 or 4, wherein the authorization result includes desensitizing the data, and the obtaining the target data from a database according to the target data identifier and the authorization result includes:

6. The method according to claim 3 or 4, characterized in that the method further comprises:

7. The method according to claim 3 or 4, characterized in that the method further comprises:

8. A data access processing apparatus, comprising:

9. An electronic device, comprising: a processor, and a memory communicatively coupled to the processor;

the memory stores computer-executable instructions;

the processor executes computer-executable instructions stored in the memory to implement the data access processing method of any one of claims 3 to 7.

10. A computer-readable storage medium, wherein computer-executable instructions are stored in the computer-readable storage medium, which when executed by a processor, are configured to implement the data access processing method according to any one of claims 3 to 7.