KR20160051164A - Apparatus for Setting Access Permission in Large-Scale Data Environment and Computer-Readable Recording Medium with Program therefor - Google Patents

Abstract

The present invention provides an apparatus for authenticating an access authority in a large-scale data environment and a computer-readable recording medium therefor. The apparatus for authenticating an access authority comprises a request reception part, a column access authority checking part, a condition storage part, a preset condition check part and an access authority reset part. The request reception part receives an integrity check request for checking the integrity of the authority level of a column of each table. The column access authority check part checks a column authority level corresponding to the column of each table in accordance with the integrity check request. The condition storage part stores a preset authority condition corresponding to the column of the table. The preset condition check part checks the preset authority condition corresponding to the column of the table to compare the preset authority condition with the column authority level. The access authority reset part sets an authority level regarding a column, in which the column authority level does not meet the preset authority condition, as an authority level corresponding to the preset authority condition.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication apparatus and a computer-readable recording medium for use in a large-

The present embodiment relates to an authentication apparatus for accessing in a large-capacity data environment and a computer-readable recording medium therefor.

The contents described in this section merely provide background information on the present embodiment and do not constitute the prior art.

A relational database is created by defining a variety of predefined structures of data as schemas and normalizing them. Designing a database is costly and time-consuming, and after a schema is determined once, the database structure changes due to the addition or deletion of a column in the table, causing a change in the overall schema. You can give.

In the case of data storage and query processing using a database developed for distributing a large amount of data in a batch format like Hadoop, it is necessary to store data such as whether to define a value in the stored data as a key value Since it is common to make meaningful operations at the time of data processing, it is necessary to provide a method for mass data processing such as Hadoop differently from a general relational database.

Also, in setting the access authority, it is necessary to provide a method different from the case of a general relational database in the case of a database for mass data processing such as Hadoop.

The main purpose of this embodiment is to provide an access authority authentication method in a large-capacity data environment.

The object of the present invention is to improve the security by setting the authority level of the combination schema according to the authority level of the attribute of each individual schema when the combination schema is set using the individual table schema.

According to an aspect of the present invention, there is provided an information processing apparatus including: a query receiving unit that receives an integrity check query that verifies the integrity of an authority level of a column for each table; A column access right verifying unit for verifying a column privilege level corresponding to a column of each table according to the integrity verification query; A condition storage unit for storing a preset permission condition corresponding to a column of the table; A pre-set condition checking unit for checking a pre-set permission condition corresponding to a column of the table and comparing the pre-set permission condition with a column privilege level; And an access reauthentication unit for setting an authority level for a column whose column authority level does not match the preset authority condition to an authority level corresponding to the preset authority condition do.

According to another aspect of the present invention, there is provided a computer-readable recording medium storing a program for causing a computer to execute: an integrity confirmation query for confirming integrity of an authority level of a column for each table; Confirming a column privilege level corresponding to a column of each table according to the integrity confirmation query; Checking a default permission condition corresponding to a column of the table and comparing the previously set permission condition with a column permission level; And setting a privilege level for a column for which the column privilege level does not match the preset privilege condition to a privilege level corresponding to the preset privilege condition. to provide.

As described above, according to the present embodiment, when generating a schema dynamically and processing data, when a combination schema is set using an individual table schema, the authority of the combination schema is set according to the authority level of the attribute of each individual schema The level is set to improve the security.

1 is a block diagram of a query processing system architecture 10 for processing user queries in a large data environment.
FIG. 2 is a block diagram of an access right authentication apparatus 13 according to an embodiment of the present invention.
3 is a diagram illustrating a schema for storing one test result and stored test result data.
FIG. 4 is a diagram illustrating a schema for storing test results different from those of FIG. 3 and stored test result data.
5 is a diagram illustrating a combination table schema and corresponding stored data by analyzing the input query.
6 is a flowchart illustrating an access right authentication method according to another embodiment of the present invention.

Hereinafter, some embodiments of the present invention will be described in detail with reference to exemplary drawings. In the following description of the embodiments of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

1 is a block diagram of a query processing system architecture 10 for processing user queries in a large data environment.

As shown in FIG. 1, the query processing system architecture 10 includes a user client 11, a user authentication server 12, an authorized authentication device 13, and an HDFS 14.

The user client 11 receives the query from the user or application and transmits the received query to the server terminal. Here, the server terminal includes a user authentication server 12, an authorized authentication apparatus 13, and an HDFS 14.

At the server end, the user authentication server 12 receives the inquiry and user information from the user client 11 and authenticates the user.

The user authentication server 12 uses the user identification information received from the user to confirm whether the user is a rightful owner who can use the system. After confirming whether or not the user is a rightful owner, the user authentication server 12 transmits the query to the authentication device 13 that has been granted access.

The access right authenticating device 13 analyzes the query received from the user authentication server 12 to check whether or not the data included in the query has a right to access by the user, and according to the result of the access right check, To the HDFS (14). The access right authentication apparatus 13 may receive the user query from the user authentication server 12 but may receive the query directly from the user client 11 when the user authentication is omitted.

The HDFS 14 processes the query according to the information for query processing received from the access right authentication device 13 and transmits the query processing result to the user client 11. [

FIG. 2 is a block diagram of an access right authentication apparatus 13 according to an embodiment of the present invention.

The access right authentication apparatus 13 according to an embodiment of the present invention includes a query receiving unit 210, a column access right confirmation unit 220, a condition storage unit 230, a pre-set condition checking unit 240, A schema 250, a combination schema generator 260, and a schema authority setter 270. According to the embodiment, the access right authentication apparatus 13 includes a query receiving unit 210, a column access right confirmation unit 220, a condition storage unit 230, a pre-set condition checking unit 240, an access right resetting unit 250, , The combination schema generation unit 260 and the schema authority setting unit 270 may be omitted or may be implemented by further including other components.

The query receiving unit 210 receives the integrity confirmation query for confirming the integrity of the authority level of the table-specific column. The query entered here may be written in SQL (Structured Query Language), but the present invention is not limited thereto and various languages can be used.

For example, the tables used in the Hadoop system may be tables collected and stored in different systems. Normally, the attributes of the tables and the level of access rights should be set the same, but the attribute name or the level of access may be set differently for each system to be collected. For example, when the second attribute of each table is set to store a resident registration number, the resident registration information is generally set to a permission level (e.g., a first permission level) accessible only by a limited operator having a special access authority. In this embodiment, terms such as authority levels, access rights levels or access levels can be used in combination, but they are all used in the same concept.

Therefore, when all of these conditions are not satisfied, an integrity confirmation query for confirming whether or not the privilege level of each table satisfies the preset condition is input to the query receiving unit 210 by the user or the application.

The column access right verification unit 220 confirms one level of column access right corresponding to each column of the table according to the inputted integrity check query.

The condition storage unit 230 stores a default permission condition corresponding to a column of each table as an authorization condition DB.

The pre-set condition checking unit 240 checks a pre-set permission condition corresponding to a column of the table, and compares the pre-stored right condition with a level of access of the column stored in each table.

If the default permission condition is set to be set to the first permission level with respect to the resident registration number attribute, it is necessary to check whether one access right level of the resident registration number attribute of all the tables is set to the first permission level. As described above, access rights may be set differently for each system that collects one table.

The access right resetting unit 250 sets a level of access right for a column that does not match the preset permission condition in which one level of column access right of each table is stored as an authority level corresponding to the corresponding preset permission condition.

In the privilege condition DB with the default permission condition set, each column can be identified by the attribute name of the corresponding table schema. However, there may be cases where a system that collects tables mistakenly names attribute names incorrectly. For example, if the attribute name is 'resident registration number', the default setting condition is stored, and the authority level of the column is set according to the stored preset condition. If the attribute name is collected as 'resident number', the attribute name is used It is difficult to confirm the initial condition of the attribute.

In this manner, if the attribute name corresponding to the default permission condition does not match the attribute name of the table schema for each table, the column can be identified using the column position. For example, in the authority condition DB, as a default permission condition, one level of access right of the second column of each table is set to the first level, one level of access to the third column is set to the second level, one level of access to the fourth column is set to the fourth level, You can set it to be one level of access for each of my columns. When the attribute is identified by the position of the column in this way, it is possible to identify even if the attribute name is misrepresented in the table schema.

When the query receiving unit 260 receives an access query for accessing a plurality of tables before receiving the integrity confirmation query, the combination schema generating unit 260 analyzes the corresponding access query and accesses from the schema of the plurality of tables to be used for the access query And generates a combination table schema by combining the schema corresponding to the query.

The schema authority setting unit 270 sets an access right corresponding to the combination table schema according to an access right corresponding to a schema of a plurality of tables.

The HDFS 14 stores a plurality of table schemas and corresponding table data.

The HDFS 14 receives the data to be stored and stores it as a table.

For example, in a chip manufacturing process using semiconductor wafers, there are usually dozens of wafers in one wafer lot, and usually hundreds to thousands of chips are produced as one wafer. Generally, there are several hundred test items for one chip. In this case, test result data is generated for each test item.

When the HDFS 14 receives the test result data and receives the data, the HDFS 14 generates a corresponding individual table schema for each received data group and stores the received data corresponding to the generated individual table schema Save by group. For example, an individual table schema is generated for each test result for one test item for the chip, and data is stored correspondingly.

FIG. 3 is a diagram illustrating a schema for storing one test result and stored test result data, FIG. 4 is a diagram illustrating a schema for storing a test result different from that of FIG. 3, and stored test result data to be.

3, when a test result is input, the data processor 120 combines the wafer number attribute and the chip number attribute as a data schema of Table A for storing the wafer number attribute (Wafer No (Test item a, test item b) becomes a non-key attribute (Wafer No, Chip No, test item a, test item a) b) to generate a first schema that forms one record. Then, the HDFS 14 stores the data group consisting of the test results corresponding to each chip in the table storage space of Table A having the first schema for all the wafers in the wafer to be tested.

The schema can be set by setting parameters such as a key attribute, a name of a non-key attribute, and a data size using a separate input device.

On the other hand, the case where one key is formed as a plurality of attributes has been described as an example, but in some embodiments, a key may be formed with one attribute.

In the case of FIG. 4, when a test result different from the case of FIG. 3 is inputted, the HDFS 14 bundles the wafer number attribute and the chip number attribute as a data schema of Table B for storing the wafer number attribute (Wafer No (Test item c, test item d, test item e) becomes a non-key property (Wafer No, Chip No, Test Item) c, test item d, test item e). Then, the HDFS 14 stores the data group consisting of the test results corresponding to each chip in the table storage space of the table B having the second schema for all the wafers to be tested in the wafer rack.

3 and 4, a plurality of individual table schemas are stored in the HDFS 14 such that the key attributes of a plurality of individual table schemas are equal to each other. In this case, a query using two keys common to each other is input It can be used to process this query.

When the query receiving unit 260 receives an access query for accessing a plurality of tables before receiving the integrity confirmation query, the combination schema generating unit 260 analyzes the corresponding access query and accesses from the schema of the plurality of tables to be used for the access query And generates a combination table schema by combining the schema corresponding to the query.

The combination table schema can set a key that is common to a plurality of individual table schemas used in a combination of a schema to a key of a combination table schema. The attributes of the combination table schema include at least one attribute .

5 is a diagram illustrating a combination table schema and corresponding stored data by analyzing the input query.

Create a table named table AB with test item a and test item b in Table A, test item c in table B, and test item d using "Wafer No, Chip No" as the key. The query 1 is described as an example.

The combination schema generation unit 260 checks the schema for Table A and Table B, which are table names included in Query 1 above, and confirms that the (Wafer No, Chip No) is set to a key. A combination table schema for Table AB as shown in FIG. 4 is created by setting parameters such as the data type and size of the attribute including the test item a and the test item b, the test item c of Table B, and the test item d do.

Since the database for mass data processing such as Hadoop is based on sequential access, in order to reduce the generation time of the combination table in generating a combination table such as Table AB, a storage area corresponding to the combination table schema of Table AB is set And then sequentially stores the data of the individual tables having the individual table schema.

That is, the data corresponding to the first individual table schema (for example, the key of Table A, the test item a, and the test item b data) among the plurality of individual table schemas used to form the combination table schema of Table AB are sequentially accessed And then mapping the data corresponding to the remaining individual table schema (i.e., the key of Table B, the test item c, and the test item d data) to the corresponding storage area of Table AB, And generates a combination data table corresponding to the combination table schema.

If the input query is a query (hereinafter referred to as query 2) that generates a new combination table using Table A, Table B, and Table C, the storage area for the combination table generated by processing Query 2 After the allocation, the data of Table A is mapped by sequential access to the area of the combination table, the data of Table B is mapped by sequential access to the area of the combination table, and the data of Table C is sequentially stored in the area of the combination table And accesses the data of each corresponding table sequentially.

In this way, it is possible to construct an environment in which the schema of the data that is desired to be output is defined (Lazy binding) at the time of the processing of generating the corresponding data. In addition, by managing meta information such as a schema of data dynamically, extracting information with a single query on various kinds of data can exhibit the same effect with similar performance to a database formed of a single table.

Such a dynamic binding structure is very useful when various types of data are output depending on products in a single process line, such as a wafer manufacturing process, in order to store and utilize the data.

The schema authority setting unit 270 sets an access right corresponding to the combination table schema according to an access right corresponding to a schema of a plurality of tables.

The schema authority setting unit 270 sets the first attribute of the schema of the table indicating one data group in the schema of the plurality of data groups and the second attribute of the schema of the table representing the other data group as the same attribute group Make sure it is set. Checking whether two attributes of two different tables are set to the same property group is confirmed as a default permission condition corresponding to the column of each table stored in the authorization condition DB. For example, it is checked whether the third column of each table (corresponding to the test item a in Table A and the test item c attribute in Table B) is set to have the same predetermined level of access.

If the privilege level of the first attribute (test item a) of Table A is larger than the privilege level of the second attribute (the test item c) according to the result of checking in the privilege condition DB, the schema privilege setting unit 270 sets the combination schema The level of authority of the second attribute included in the second attribute is set to one level of the predetermined level of access that is the same as the level of authority of the first attribute. For example, even though the third column of each table contains sensitive contents and the access level is set to the first highest level, the access level of the test item a of Table A is the first level and the test item c of Table B Assuming that the level of access rights is the second level, it can be seen that tables A and B having similar properties are erroneously set in the access right of the corresponding attribute due to an error in the generation thereof. Therefore, even if the user has the second level authority lower than the first level, the test item c attribute of Table B can not be accessed.

If a different access right is set for each table in the column where the access right is not set, the schema right setting unit 270 sets one access right level of the attribute having a low access right level to the two access right It is assumed that one level of access is higher than the other level. Even in this case, it is possible to set the level of the attribute having the lower level of access by the user's selection to be equal to the level of the higher level of the level of access that has the higher level of access. In order to set the access level in this way, the level of access of the user who created the query should be equal to or higher than the level of access in Table A and Table B.

The schema authority setting unit 270 sets the first attribute of the schema of one of the tables and the second attribute of the schema of the other data group to the same group in the schema of the plurality of tables, If the level is lower than at least one of the authority level of the first attribute and the authority level of the second attribute, access to both the first attribute and the second attribute is rejected, even if the level is equal to or higher than the other authority level. If another access level is set for the attributes of the same group having the same characteristics, the access authority is also set for the attributes of other same groups based on the attribute having the higher level of access.

6 is a flowchart illustrating an access right authentication method according to another embodiment of the present invention.

The dynamic schema query processing method according to another embodiment of the present invention includes a query receiving process S610, a column access right checking process S620, a condition storing process S630, an initialization condition checking process S640, (S650), a combination schema generation process (S660), and a schema privilege setting process (S670).

In the query receiving process (S610), integrity confirmation query for confirming the integrity of the privilege level of the table-specific column is received.

In the column access right validation process (S620), the column right level corresponding to the column of each table is checked according to the integrity validation query.

In the condition storage process (S630), the default permission condition corresponding to the column of the table is stored.

In the initialization condition checking process (S640), the initial permission condition corresponding to the column of the table is checked, and the initial permission condition and the column permission level are compared.

In the process of resetting the access right (S650), the authority level is set to the authority level corresponding to the preset authority condition for the column whose column authority level does not match the preset authority condition.

In the combining schema generation process (S660), when the query receiving unit 110 receives an access query for accessing a plurality of tables before receiving the integrity confirmation query, it analyzes the access query and accesses from the schema of the plurality of tables to be used for the access query And generates a combination table schema by combining the schema corresponding to the query.

In the schema authority setting process (S670), an access right corresponding to a combination table schema is set according to an access right corresponding to a schema of a plurality of tables.

(S620), a condition storage process (S630), an initial condition check process (S640), an access right reset process (S650), a combination schema creation process (S660), and a schema right The setting process S670 includes a query receiving unit 210, a column access right verifying unit 220, a condition storing unit 230, a pre-set condition verifying unit 240, an access right resetting unit 250, 260 and the schema authority setting unit 270, respectively, so that detailed description is omitted.

Although it is described in FIG. 6 that the processes S610 to S670 are sequentially executed, this is merely an illustration of the technical idea of the embodiment of the present invention. In other words, those skilled in the art will appreciate that the steps described in FIG. 6 may be modified and executed without departing from the essential characteristics of an embodiment of the present invention, or the steps S610 to S670 6 is not limited to the time-series order because it can be variously modified and modified by being executed in parallel.

The access right authenticating device 13 according to the embodiment of the present invention includes a communication device such as a communication modem for performing communication with various devices or wired / wireless communication networks, a memory for storing data for executing a program, And a microprocessor for controlling and controlling the operation of the apparatus. According to at least one embodiment, the memory may be a computer such as a random access memory (RAM), a read only memory (ROM), a flash memory, an optical disk, a magnetic disk, or a solid state disk Readable recording / storage medium. According to at least one embodiment, a microprocessor can be programmed to selectively perform one or more of the operations and functions described in the specification. In accordance with at least one embodiment, the microprocessor may be implemented in hardware, such as an Application Specific Integrated Circuit (ASIC), in wholly or partially of a particular configuration.

As described above, the access right authentication method described in Fig. 6 can be implemented by a program and recorded in a computer-readable recording medium. A program for implementing the access right authentication method according to the present embodiment is recorded, and a computer-readable recording medium includes all kinds of recording devices for storing data that can be read by a computer system. Examples of such computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, etc., and also implemented in the form of a carrier wave (e.g., transmission over the Internet) . The computer readable recording medium may also be distributed over a networked computer system so that computer readable code is stored and executed in a distributed manner. In addition, functional programs, codes, and code segments for implementing the present embodiment can be easily inferred by programmers in the technical field to which the present embodiment belongs.

The foregoing description is merely illustrative of the technical idea of the present embodiment, and various modifications and changes may be made to those skilled in the art without departing from the essential characteristics of the embodiments. Therefore, the present embodiments are to be construed as illustrative rather than restrictive, and the scope of the technical idea of the present embodiment is not limited by these embodiments. The scope of protection of the present embodiment should be construed according to the following claims, and all technical ideas within the scope of equivalents thereof should be construed as being included in the scope of the present invention.

10: Query processing system architecture
11: User Client
12: User authentication server
13: Authorized authentication device
14: HDFS
210:
220: Checking column access authority
230: Condition storage unit
240: Pre-set condition confirmation unit
250: Restricted Access Government
260: Combination schema generation unit
270: Schema authority setting unit

Claims (8)

A query receiving unit for receiving an integrity confirmation query for confirming the integrity of the authority level of the column for each table;
A column access right verifying unit for verifying a column privilege level corresponding to a column of each table according to the integrity verification query;
A condition storage unit for storing a preset permission condition corresponding to a column of the table;
A pre-set condition checking unit for checking a pre-set permission condition corresponding to a column of the table and comparing the pre-set permission condition with a column privilege level; And
Setting an authority level for a column whose column authority level does not match the preset authority condition to an authority level corresponding to the preset authority condition,
And an access right authenticating device for authenticating the access right authenticating device. The method according to claim 1,
And the column of the table corresponding to the default permission condition is identified by an attribute name of the corresponding table schema. 3. The method of claim 2,
If the attribute name corresponding to the default permission condition does not match the attribute name of the table schema for each table, identifies the attribute as a column position. 2. The authentication apparatus according to claim 1,
When the query receiver receives an access query for accessing a plurality of tables before receiving the integrity confirmation query, analyzes the access query to combine the schema corresponding to the access query from the schema of the plurality of tables to be used for the access query A combination schema generation unit for generating a combination table schema; And
A schema authority setting unit for setting an access authority corresponding to the combination table schema according to an access right corresponding to a schema of the plurality of tables,
And an access right authenticating device for authenticating the access right authenticating device. 5. The apparatus of claim 4,
If the first attribute of the schema of one of the tables of the plurality of tables is the same as the second attribute of the schema of the other table and the authority level of the first attribute is greater than the authority level of the second attribute, Wherein the authority level of the second attribute included in the combination schema is set equal to the authority level of the first attribute. 6. The method of claim 5,
Wherein the authority level of the user who generated the access query is equal to or higher than the authority level of the first attribute. 5. The apparatus of claim 4,
Wherein a first attribute of a schema of one of the tables of the plurality of tables is the same as a second attribute of a schema of another table and the authority level of the user who generated the access query is equal to the authority level of the first attribute And the authority level of the second attribute is lower than at least one of the authority level of the first attribute and the authority level of the second attribute. On the computer,
Receiving an integrity confirmation query that verifies the integrity of the authority level of the table-specific column;
Confirming a column privilege level corresponding to a column of each table according to the integrity confirmation query;
Checking a default permission condition corresponding to a column of the table and comparing the previously set permission condition with a column permission level; And
Setting a rights level for a column whose column privilege level does not match the preset privilege condition to a privilege level corresponding to the preset privilege condition
Readable recording medium having recorded thereon a program for executing the program.

Images