KR102182573B1 - Apparatus for Setting Access Permission in Large-Scale Data Environment and Computer-Readable Recording Medium with Program therefor - Google Patents

Abstract

A query receiving unit for receiving an integrity check query for checking the integrity of the authority level of each table column; A column access permission check unit for checking a column permission level corresponding to a column of each table according to the integrity check query; A condition storage unit for storing a preset permission condition corresponding to the column of the table; A preset condition check unit that checks a preset authority condition corresponding to a column of the table and compares the preset authority condition with a column authority level; And an access authority reset unit configured to set the authority level to the authority level corresponding to the preset authority condition for a column whose column authority level does not match the preset authority condition, and read by a computer therefor. Provide a recording medium that can be used.

Description

Apparatus for Setting Access Permission in Large-Scale Data Environment and Computer-Readable Recording Medium with Program therefor}

The present embodiment relates to an access authority authentication apparatus and a computer-readable recording medium therefor in a large-capacity data environment.

The content described in this section merely provides background information on the present embodiment and does not constitute the prior art.

Relational databases are created by defining various structures in which data is defined in advance as a schema and normalized. Due to this, it takes a lot of cost and time to design the database, and once the schema is determined, if the database structure is changed due to the addition or deletion of columns in the table, and if the entire schema is changed, it will cost a lot and affect performance. Can give.

In the case of data storage and query processing using a database developed suitable for distributed processing of a large amount of data in a batch format, such as Hadoop, the data is determined whether or not a value is defined as a key value in the stored data. Since it is common to perform a task that gives meaning at the time of data processing execution, it is necessary to provide a method different from that of a general relational database in the case of a database for mass data processing such as Hadoop.

In addition, when setting access rights, it is necessary to provide a method different from that of a general relational database in the case of a database for processing large amounts of data such as Hadoop.

The main object of the present embodiment is to provide a method for authenticating access rights in a large data environment.

In the case of setting a combination schema using individual table schemas, the purpose is to improve security by setting the authorization level of the combination schema according to the authorization level of each individual schema attribute.

According to an aspect of the present embodiment, there is provided a query receiving unit configured to receive an integrity check query for checking the integrity of a privilege level of a column for each table; A column access permission check unit for checking a column permission level corresponding to a column of each table according to the integrity check query; A condition storage unit for storing a preset permission condition corresponding to the column of the table; A preset condition check unit that checks a preset authority condition corresponding to a column of the table and compares the preset authority condition with a column authority level; And an access permission reset unit for setting a permission level to a permission level corresponding to the pre-set permission condition for a column whose column permission level does not match the pre-set permission condition. do.

According to another aspect of the present embodiment, the process of receiving an integrity check query for checking the integrity of an authority level of a column for each table, to a computer; Checking a column authority level corresponding to a column of each table according to the integrity check query; Checking a preset authority condition corresponding to a column of the table and comparing the preset authority condition with a column authority level; And a computer-readable recording medium in which a program for executing a process of setting an authority level to a level corresponding to the preset authority condition for a column whose column authority level does not match the preset authority condition. to provide.

As described above, according to the present embodiment, when a combination schema is set using an individual table schema in dynamically generating a schema to process data, the authorization of the combination schema according to the permission level of each individual schema attribute There is an effect of improving security by setting the level.

1 is a block diagram showing a query processing system architecture 10 for processing user queries in a large data environment.
2 is a block diagram showing an access right authentication apparatus 13 according to an embodiment of the present invention.
3 is a diagram illustrating a schema for storing any one test result and stored test result data.
4 is a diagram illustrating a schema for storing test results different from the case of FIG. 3 and stored test result data.
5 is a diagram illustrating a combination table schema and data stored in correspondence therewith by analyzing an input query.
6 is a flowchart illustrating a method of authenticating access rights according to another embodiment of the present invention.

Hereinafter, some embodiments of the present invention will be described in detail through exemplary drawings. In describing an embodiment of the present invention, when it is determined that a detailed description of a related known configuration or function may obscure the subject matter of the present invention, a detailed description thereof will be omitted.

1 is a block diagram showing a query processing system architecture 10 for processing user queries in a large data environment.

As shown in FIG. 1, the query processing system architecture 10 includes a user client 11, a user authentication server 12, an access authority authentication device 13, and an HDFS 14.

The user client 11 receives a query from a user or an application and transmits the received query to the server side. Here, the server stage includes a user authentication server 12, an access authority authentication device 13, and an HDFS 14.

At the server side, the user authentication server 12 authenticates the user by receiving a query and user information from the user client 11.

The user authentication server 12 checks whether the user is a legitimate right holder who can use the system using the user identification information received from the user. After it is confirmed whether the right holder is a valid right holder, the user authentication server 12 transmits the query to the access authority authentication device 13.

The access right authentication device 13 analyzes the query received from the user authentication server 12 to check whether the user has the right to access the data included in the query, and information for query processing according to the access right verification result. Is transmitted to HDFS (14). The access authority authentication device 13 may receive a user query from the user authentication server 12, but may directly receive a query from the user client 11 when user authentication is omitted.

The HDFS 14 processes the query according to the query processing information received from the access authority authentication device 13 and transmits the query processing result to the user client 11.

2 is a block diagram showing an access right authentication apparatus 13 according to an embodiment of the present invention.

The apparatus 13 for authenticating access rights according to an embodiment of the present invention includes a query receiving unit 210, a column access authority checking unit 220, a condition storage unit 230, a preset condition checking unit 240, and access authority reset. It may be implemented by including the government 250, the combination schema generation unit 260, and the schema authority setting unit 270. According to an embodiment, the access right authentication device 13 includes a query receiving unit 210, a column access authority checking unit 220, a condition storage unit 230, a preset condition checking unit 240, an access authority resetting unit 250 , Some of the components of the combination schema generation unit 260 and the schema permission setting unit 270 may be omitted or implemented by additionally including other components.

The query receiving unit 210 receives an integrity check query that checks the integrity of the privilege level of each table column. Here, the input query may be written in SQL (Structured Query Language), but the present invention is not limited thereto, and various languages may be used.

For example, tables used in the Hadoop system may be tables collected and stored in different systems. Usually, the attributes of these tables and their level of access rights should be set identically, but the property names or levels of access rights may be set differently for each system to be collected. For example, when the second attribute of each table is set to store the social security number, the resident registration information is generally set to an authority level (for example, a first authority level) that only limited operators with special access rights can access. In the present embodiment, terms such as authority level, access authority level, or access level may be used interchangeably, but it should be noted that these are all used with the same concept.

Accordingly, when all of these conditions are not satisfied, an integrity check query for confirming whether the authority level of each table satisfies a preset condition is input to the query receiving unit 210 by a user or an application.

The column access permission check unit 220 checks the column access permission level corresponding to the column of each table according to the input integrity check query.

The condition storage unit 230 stores a preset authority condition corresponding to a column of each table as an authority condition DB.

The preset condition check unit 240 checks a preset authority condition corresponding to a column of the table and compares the stored preset authority condition with the access authority level of the column stored in each table.

If a preset permission condition is stored so that the resident registration number attribute is set to the first permission level, it is necessary to check whether the access permission level of the resident registration number attribute of all tables is set to the first permission level. This is because, as described above, the access rights may be set differently for each system that collects any one table and collected.

The access right resetting unit 250 sets the access right level to a column that does not match a preset permission condition in which the column access permission level of each table is stored as a permission level corresponding to the predetermined permission condition.

In the authorization condition DB in which the preset authorization condition is set, each column can be identified by the attribute name of the corresponding table schema. However, in a system that collects tables, there may be cases in which attribute names are accidentally entered incorrectly. For example, if the attribute name is'Resident Registration Number', the pre-set condition is saved so that the column's authority level is set according to the saved pre-set condition, but when the attribute name is named'Resident Number', this attribute name is used. Therefore, it becomes difficult to check the preset condition of the corresponding property.

In this way, when the attribute name corresponding to the preset permission condition does not match the attribute name of the table schema for each table, the corresponding column may be identified using the position of the column. For example, in the privilege condition DB, the access privilege level of the second column of each table is the first level, the access authority level of the third column is the second level, the access authority level of the fourth column is the fourth level, etc. It can be set to be the level of access authority for each column in mine In this case, when the attribute is identified by the position of the column, identification is possible even if the attribute name is incorrectly described in the table schema.

When the query receiving unit 110 receives an access query that accesses a plurality of tables before receiving the integrity check query, the combination schema generation unit 260 analyzes the access query and accesses it from the schema of the plurality of tables to be used for the access query. A combination table schema is created by combining the schema corresponding to the query.

The schema permission setting unit 270 sets the access permission corresponding to the combination table schema according to the access permission corresponding to the schema of a plurality of tables.

The HDFS 14 stores a plurality of table schemas and table data corresponding thereto.

The HDFS 14 receives data to be stored and stores it as a table.

For example, in a chip production process using a semiconductor wafer (Wafer), there are usually dozens of wafers in one wafer lot, and hundreds to thousands of chips are usually produced with one wafer. In general, there are hundreds or more test items for one chip, and in this case, test result data is generated every time a test item is tested.

When receiving data by inputting the test result data as input, the HDFS 14 creates an individual table schema corresponding to each of the received data groups and stores the received data corresponding to the generated individual table schema. Save by group. For example, a separate table schema is created for each test result of one test item for a chip, and data is stored correspondingly.

3 is a diagram illustrating a schema for storing a test result and stored test result data, and FIG. 4 is a diagram illustrating a schema for storing test results different from the case of FIG. 3 and stored test result data to be.

As illustrated in FIG. 3, when any one of the test results is received, the data processing unit 120 combines the wafer number attribute and the chip number attribute as a data schema of Table A to store the data (Wafer No. , Chip No) is the key, and (test item a, test item b), which is an attribute corresponding to the test result, becomes a non-key attribute, so (Wafer No, Chip No, test item a, test item Create a first schema that forms one record in the form of b). In addition, the HDFS 14 stores a data group consisting of test results corresponding to each chip for all wafers in a wafer rat to be tested in a table storage space of Table A having a first schema.

The schema can be set by a user using a separate input device to set parameters such as a key attribute, a name of a non-key attribute, and a data size.

Meanwhile, a case of forming one key as a plurality of attributes has been exemplified, but depending on embodiments, a key may be formed with one attribute.

In the case of FIG. 4, when a test result different from that of FIG. 3 is input, the HDFS 14 is a table B data schema for storing the wafer number attribute and the chip number attribute. , Chip No) is the key, and the properties corresponding to the test result (test item c, test item d, test item e) become the non-key property, and (Wafer No, Chip No, test item Create a second schema that forms one record in the form of c, test item d, and test item e). In addition, the HDFS 14 stores a data group consisting of test results corresponding to each chip for all the wafers to be tested in the wafer rat in a table storage space of Table B having a second schema.

In the case of FIGS. 3 and 4, a plurality of individual table schemas are stored in the HDFS 14 so that the key attributes of the plurality of individual table schemas are the same, and in this case, a query using a key common to each other is input. If so, it can be used to process this query.

When the query receiving unit 110 receives an access query that accesses a plurality of tables before receiving the integrity check query, the combination schema generation unit 260 analyzes the access query and accesses it from the schema of the plurality of tables to be used for the access query. A combination table schema is created by combining the schema corresponding to the query.

In the combined table schema, a key common to a plurality of individual table schemas used for schema combination can be set as the key of the combined table schema, and the attribute of the combined table schema is at least one attribute in each of the plurality of individual table schemas used for schema combination. Includes.

5 is a diagram illustrating a combination table schema and data stored in correspondence therewith by analyzing an input query.

The content of the entered query is "Use (Wafer No, Chip No) as a key to create test item a and test item b of Table A, and test item c and test item d of Table B in a table called Table AB." The case of query 1 will be described as an example.

The combination schema generation unit 260 checks the schema for Table A and Table B, which are the table names included in Query 1 above, and checks whether (Wafer No, Chip No) is set as a key, and A combination table schema for Table AB as shown in Fig. 4 is created by setting parameters such as the data format and size of attributes including test items a and b and test items c and d in Table B. do.

Since databases for processing large amounts of data such as Hadoop are based on sequential access, when creating a combination table such as Table AB, set a storage area corresponding to the combination table schema of Table AB to reduce the generation time of the combination table. After that, data of individual tables with individual table schemas are stored sequentially.

In other words, among a plurality of individual table schemas used to form the combination table schema of Table AB, data corresponding to the first individual table schema (e.g., Table A key, test item a, test item b data) can be sequentially accessed. After mapping to the storage area of Table AB corresponding to the combined table schema, data corresponding to the remaining individual table schemas (i.e., the key of Table B, test item c, test item d data) are sequentially stored in the corresponding storage area of Table AB. The combination data table corresponding to the combination table schema is created by mapping to.

If the input query is a query that creates a new combined table using Table A, Table B, and Table C (hereinafter referred to as Query 2), the storage area for the combined table created by processing Query 2 After allocation, the data of Table A is mapped and stored by sequential access to the area of the combination table, and the data of Table B is mapped and stored by sequential access to the area of the combination table, and the data of Table C is sequentially stored in the area of the combination table. By mapping and storing by access, the data of each table is processed sequentially.

In this way, it becomes possible to build an environment in which the schema of the data to be output is defined (lazy binding) at the time of processing the query that creates the data. In addition, when meta-information such as a schema of data is dynamically managed and information is extracted with a single query for various types of data, the same effect can be obtained with performance similar to that of a database formed of a single table.

Such a dynamic binding structure is very useful when various types of data are output from a single process line, such as a wafer manufacturing process, according to products, and stored and utilized.

The schema permission setting unit 270 sets the access permission corresponding to the combination table schema according to the access permission corresponding to the schema of a plurality of tables.

The schema permission setting unit 270 is an attribute group in which the first attribute of the schema of the table representing one data group and the second attribute of the schema of the table representing another data group are the same in the schema of a plurality of data groups. Make sure it is set. Whether or not two properties of two different tables are set to the same property group is checked with a preset authorization condition corresponding to the column of each table stored in the authorization condition DB. For example, it is checked whether the third column of each table (corresponding to the test item a of Table A and the test item c attribute of Table B) is set to have the same preset access level.

Schema authority setting unit 270, according to the result of checking in the authority condition DB, when the authority level of the first attribute (test item a) of Table A is greater than the authority level of the second attribute (test item c), the combination schema The authority level of the second attribute included in is set to a preset access authority level identical to the authority level of the first attribute. For example, although the third column of each table contains sensitive contents and the access authority level is set to the highest level, the access level of test item a of Table A is the first level, and test item c of Table B is In this case, assuming that the access right level is the second level, it can be seen that the access right of the corresponding attribute is incorrectly set due to an error in the creation of tables A and B having similar properties. Therefore, even a user with a second level of authority lower than the first level does not allow access to the test item c attribute of Table B.

In the case of a column at a location where the access right is not set, the schema permission setting unit 270 sets the access right level of the attribute having a lower access right level to set two access rights for safe access right setting when different access rights are set for each table. The accessibility is determined by assuming the higher level of access rights among the levels. Even in this case, it is also possible to set the level of the attribute with the low access level to the same level as the level with the high access level by the user's selection. In order to set the access level in this way, the access level of the user who created the query must be equal to or higher than the access level of Table A and Table B.

In the schema of a plurality of tables, the schema authority setting unit 270 sets the first attribute of the schema of one table and the second attribute of the schema of another data group to the same group, and the authority of the user who generated the query When the level is lower than at least one of the authority level of the first attribute and the authority level of the second attribute, access to both the first attribute and the second attribute is denied even if it is higher than or equal to the other authority level. In this case, when different access authority levels are set for the same group attribute having the same characteristics, the access authority is also set for other attributes of the same group based on the attribute having a higher access authority level among them.

6 is a flowchart illustrating a method of authenticating access rights according to another embodiment of the present invention.

A dynamic schema query processing method according to another embodiment of the present invention includes a query reception process (S610), a column access permission confirmation process (S620), a condition storage process (S630), a preset condition confirmation process (S640), and an access permission reset process. (S650), a combination schema generation process (S660), and a schema authority setting process (S670).

In the query receiving process (S610), an integrity check query for verifying the integrity of the privilege level of each table column is received.

In the column access authority checking process (S620), the column authority level corresponding to the column of each table is checked according to the integrity check query.

In the condition storage process (S630), a preset permission condition corresponding to a column of a table is stored.

In the preset condition checking process (S640), a preset authority condition corresponding to a column of the table is checked, and the preset authority condition and the column authority level are compared.

In the process of resetting the access authority (S650), the authority level for the column whose column authority level does not match the preset authority condition is set to the authority level corresponding to the preset authority condition.

In the combination schema generation process (S660), when the query receiving unit 110 receives an access query that accesses a plurality of tables before receiving the integrity check query, the access query is analyzed and accessed from the schema of the plurality of tables to be used for the access query. A combination table schema is created by combining the schema corresponding to the query.

In the schema authority setting process (S670), access rights corresponding to the combination table schema are set according to access rights corresponding to the schemas of a plurality of tables.

Query reception process (S610), column access permission confirmation process (S620), condition storage process (S630), preset condition confirmation process (S640), access permission reset process (S650), combination schema creation process (S660) and schema authorization The setting process (S670) includes a query receiving unit 210, a column access authority checking unit 220, a condition storage unit 230, a preset condition checking unit 240, an access authority resetting unit 250, a combination schema generation unit ( 260) and the schema permission setting unit 270, respectively, so a detailed description thereof will be omitted.

In FIG. 6, steps S610 to S670 are described as sequentially executing, but this is merely illustrative of the technical idea of an embodiment of the present invention. In other words, if one of ordinary skill in the technical field to which an embodiment of the present invention belongs, changes the order shown in FIG. 6 and executes one of the processes S610 to S670 without departing from the essential characteristics of the embodiment of the present invention. Since the above processes are executed in parallel, various modifications and variations may be applied, and thus FIG. 6 is not limited to a time series order.

The access authority authentication device 13 according to an embodiment of the present invention is a communication device such as a communication modem for performing communication with various devices or wired/wireless communication networks, a memory for storing data for executing a program, and an operation by executing a program. And it may refer to various devices including a microprocessor for controlling. According to at least one embodiment, the memory is a computer such as a random access memory (RAM), a read only memory (ROM), a flash memory, an optical disk, a magnetic disk, or a solid state disk (SSD). It may be a readable recording/storing medium. According to at least one embodiment, the microprocessor may be programmed to selectively perform one or more operations and functions described in the specification. According to at least one embodiment, the microprocessor may be implemented entirely or partially as hardware such as an Application Specific Integrated Circuit (ASIC) having a specific configuration.

As described above, the method for authenticating access rights described in FIG. 6 may be implemented as a program and recorded on a computer-readable recording medium. A computer-readable recording medium in which a program for implementing the access authority authentication method according to the present embodiment is recorded includes all types of recording devices that store data that can be read by a computer system. Examples of such computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, etc., and also implemented in the form of a carrier wave (for example, transmission through the Internet). Includes being. In addition, the computer-readable recording medium may be distributed over a computer system connected through a network, and computer-readable codes may be stored and executed in a distributed manner. In addition, functional programs, codes, and code segments for implementing the present embodiment may be easily inferred by programmers in the technical field to which the present embodiment belongs.

The above description is merely illustrative of the technical idea of the present embodiment, and those of ordinary skill in the technical field to which the present embodiment belongs will be able to make various modifications and variations without departing from the essential characteristics of the present embodiment. Accordingly, the present exemplary embodiments are not intended to limit the technical idea of the present exemplary embodiment, but are illustrative, and the scope of the technical idea of the present exemplary embodiment is not limited by these exemplary embodiments. The scope of protection of this embodiment should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present embodiment.

10: Query processing system architecture
11: User Client
12: User authentication server
13: access authority authentication device
14: HDFS
210: query receiver
220: column access permission check unit
230: condition storage unit
240: preset condition check unit
250: access authority reset unit
260: combination schema generation unit
270: Schema authority setting unit

Claims (8)

A query receiving unit configured to receive an integrity check query for checking the integrity of each column access permission level for a plurality of tables having a table schema composed of the same column group;
A column access permission check unit for checking the access permission level for each column of the table according to the integrity check query;
A condition storage unit for storing preset authority conditions for each column;
A preset condition check unit that checks the preset authority condition for each column and compares the preset authority condition for each column with the access authority level for each column of the table; And
When the access permission level for each column of each table does not match the pre-set permission condition for each column, the access permission level for each column of each table is set to the access permission level for each column corresponding to the pre-set permission condition for each column. Access permission reset section
Access authority authentication device comprising a. The method of claim 1,
The apparatus for authenticating access rights, characterized in that the column of each table corresponding to a predetermined permission condition for each column is identified by an attribute name of a corresponding table schema. The method of claim 2,
When the attribute name of the column of each table corresponding to the preset permission condition for each column does not match the attribute name of the corresponding column of the table schema of each table, the corresponding column is identified according to the position of the corresponding column. Access authority authentication device, characterized in that. The method of claim 1, wherein the access right authentication device,
When the query receiver receives an access query that accesses a plurality of tables before receiving the integrity check query, the access query is analyzed and the schema corresponding to the access query is combined from the schema of the plurality of tables to be used for the access query. A combination schema generation unit for generating a combination table schema; And
Schema permission setting unit that sets access rights corresponding to the combination table schema according to access rights corresponding to the schemas of the plurality of tables
Access authority authentication device comprising a. The method of claim 4, wherein the schema authority setting unit,
Among the schemas of the plurality of tables, a first attribute of a schema of one table and a second attribute of a schema of another table are the same, and the access permission level of the first attribute is greater than the access permission level of the second attribute. In this case, the access right authentication device, characterized in that the access right level of the second attribute included in the combination schema is set equal to the access right level of the first attribute. The method of claim 5,
The access right authentication device, wherein the access right level of the user who generated the access query is equal to or higher than the access right level of the first attribute. The method of claim 4, wherein the schema authority setting unit,
Among the schemas of the plurality of tables, the first attribute of the schema of one table and the second attribute of the schema of another table are the same, and the access right level of the user who generated the access query is the access right of the first attribute When lower than at least one of the one level and the access right level of the second property, the access right authentication device, characterized in that to reject the access to the first property and the second property. On the computer,
Receiving an integrity check query for checking the integrity of the access permission level for each column of each table for a plurality of tables having a table schema composed of the same column group;
Checking an access permission level for each column of each table according to the integrity check query;
Checking a pre-set permission condition for each column and comparing the pre-set permission condition for each column with an access permission level for each column of the table; And
When the access permission level for each column of each table does not match the pre-set permission condition for each column, the access permission level for each column of each table is set to the access permission level for each column corresponding to the pre-set permission condition for each column. process
A computer-readable recording medium that records a computer program for running.

Images