WO2019201082A1 - 一种数据访问的控制方法及数据库访问装置 - Google Patents

一种数据访问的控制方法及数据库访问装置 Download PDF

Info

Publication number
WO2019201082A1
WO2019201082A1 PCT/CN2019/080813 CN2019080813W WO2019201082A1 WO 2019201082 A1 WO2019201082 A1 WO 2019201082A1 CN 2019080813 W CN2019080813 W CN 2019080813W WO 2019201082 A1 WO2019201082 A1 WO 2019201082A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
user
target
operation instruction
operate
Prior art date
Application number
PCT/CN2019/080813
Other languages
English (en)
French (fr)
Inventor
谢启刚
李超华
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19788730.0A priority Critical patent/EP3779721A4/en
Publication of WO2019201082A1 publication Critical patent/WO2019201082A1/zh
Priority to US17/072,794 priority patent/US11947700B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2455—Query execution
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/21—Design, administration or maintenance of databases
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/22—Indexing; Data structures therefor; Storage structures
    • G06F16/221—Column-oriented storage; Management thereof
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the embodiment of the present invention relates to the field of data storage, and in particular, to a data access control method and a database access device.
  • Database is a warehouse that organizes, stores, and manages data according to the data structure. Users can add, intercept, update, and delete data in the Database.
  • SQL Structured Query Language
  • DBA Database Administrator
  • Table 1 The prior art does not restrict the user's specific operations on data in a certain table. In this way, the user A may be able to view all the data except Table 1. For some high-tech, information, financial and other industries, it is easy to cause great information security risks.
  • the embodiment of the present application provides a data access control method and a database access device, which can provide security for data access and avoid the risk of information leakage to a certain extent.
  • a data access control method including: a database access device can acquire a first data operation instruction, wherein the first data operation instruction carries an identifier of a target data body, and the first data operation instruction is first The user-triggered, that is, the target data body is the data body that the user wants to operate through the first data manipulation instruction.
  • the database access device also pre-stores the rights setting information, including the identifier of the at least one data body and the rights of the at least one user to operate the at least one data body.
  • the at least one data volume described herein includes a target data volume, and at least one user includes a first user.
  • the database accessing device may further determine the authority of the first user to operate the target data body according to the identifier query permission setting information of the target data body; and then the database accessing device may further operate the target data volume according to the first user and the first data.
  • the operation instruction generates a second data operation instruction.
  • the database access device executes the second data operation instruction to operate the data in the target data body within the target range; the target range is a range allowed by the first user to operate the target data body.
  • the data access control method provided by the embodiment of the present invention can automatically modify the SQL statement input by the user in combination with the permission setting information, and increase the execution condition of the SQL statement (that is, the permission of the user to access the data body, such as row permission or column permission), and then Execute the modified SQL statement to implement the permission control on the user table, row, and column.
  • the execution condition of the SQL statement that is, the permission of the user to access the data body, such as row permission or column permission
  • the permission of the target data body and the generating of the second data operation instruction by the first data instruction specifically include: the database access device adding an execution condition to the first data operation instruction to obtain the second data operation instruction; in the execution condition, the first user operates The value corresponding to the target field is null.
  • the embodiment of the present invention can implement the control of the column authority by modifying the SQL statement and setting the value corresponding to the target field to a null value.
  • the second data operation instruction is executed, and the data in the target data range of the operation target data body specifically includes: database access
  • the N column data under the other fields except the target field in the device operation target data body prohibits the operation of the M column data under the target field in the target data volume; N is an integer greater than or equal to 1, and M is an integer greater than or equal to 1.
  • the permission is to allow the first user to operate the data in the target data body when the target field meets the preset condition
  • the target field satisfies the preset condition.
  • the second data operation instruction is used to indicate that the first user is allowed to operate the target data body when the target field satisfies the preset condition.
  • the embodiment of the present invention can implement the control of the column permission by modifying the SQL statement and increasing the condition that the target field needs to be satisfied.
  • the second data operation instruction is executed, and the data in the target data range of the operation target data body specifically includes: a database The Q line data of the target field in the device operation target data body that meets the preset condition is accessed; Q is an integer greater than or equal to 1.
  • a data access device including:
  • An obtaining unit configured to acquire a first data operation instruction, where the first data operation instruction carries an identifier of the target data body, the first data operation instruction is triggered by the first user, and the query unit is configured to query the permission according to the identifier of the target data body Setting the information, determining the authority of the first user to operate the target data body; the rights setting information includes the identifier of the at least one data body and the at least one user operating the at least one data body, the at least one data body includes the target data body, and the at least one user includes the first a user; a generating unit, configured to generate a second data operation instruction according to the permission of the first user operation target data body and the first data operation instruction; the operation unit executes the second data operation instruction, and the operation target data body is within the target range Data; the target range is the range allowed by the first user to operate the target data body.
  • the database access device provided by the embodiment of the present invention can automatically modify the SQL statement input by the user in combination with the permission setting information, and increase the execution condition of the SQL statement (that is, the permission of the user to access the data body, such as the row permission or the column permission), and then perform the modification.
  • the execution condition of the SQL statement that is, the permission of the user to access the data body, such as the row permission or the column permission
  • the access control of the user table, row, column is implemented. In this way, sensitive columns or sensitive rows in the table can be protected, which can provide security for data access and avoid the risk of leakage of information to a certain extent.
  • the generating unit is specifically configured to: And adding an execution condition to the first data operation instruction to obtain a second data operation instruction; in the execution condition, the target field corresponding to the first user operation is a null value.
  • the operating unit is specifically configured to: operate the N columns of data in other fields except the target field in the target data volume. Forbidden to operate the M column data under the target field in the target data volume; N is an integer greater than or equal to 1, and M is an integer greater than or equal to 1.
  • the generating unit is specifically configured to: add an execution condition to obtain a second data operation instruction in the first data operation instruction; in the execution condition, the target field satisfies a preset condition, and the second data operation instruction is used to indicate that the first user is allowed to be in the target field
  • the target data body is operated when the preset condition is met.
  • the operation unit is specifically configured to: operate, in the target data body, the Q field data of the target field that meets the preset condition; Is an integer greater than or equal to 1.
  • a data access device including:
  • a transceiver configured to acquire a first data operation instruction, where the first data operation instruction carries an identifier of the target data body, the first data operation instruction is triggered by the first user, and the processor is configured to query the permission according to the identifier of the target data body Setting the information, determining the authority of the first user to operate the target data body; the rights setting information includes the identifier of the at least one data body and the at least one user operating the at least one data body, the at least one data body includes the target data body, and the at least one user includes the first a user; the processor is further configured to: generate a second data operation instruction according to the permission of the first user operation target data body and the first data operation instruction; execute the second data operation instruction to operate the data in the target range in the target data body
  • the target range is the range allowed by the first user to operate the target data body.
  • the database access device provided by the embodiment of the present invention can automatically modify the SQL statement input by the user in combination with the permission setting information, and increase the execution condition of the SQL statement (that is, the permission of the user to access the data body, such as the row permission or the column permission), and then perform the modification.
  • the execution condition of the SQL statement that is, the permission of the user to access the data body, such as the row permission or the column permission
  • the access control of the user table, row, column is implemented. In this way, sensitive columns or sensitive rows in the table can be protected, which can provide security for data access, and to some extent avoid the risk of information leakage.
  • the processor is specifically configured to: And adding an execution condition to the first data operation instruction to obtain a second data operation instruction; in the execution condition, the target field corresponding to the first user operation is a null value.
  • the processor is specifically configured to: operate the N data in the target data body in other fields except the target field. Forbidden to operate the M column data under the target field in the target data volume; N is an integer greater than or equal to 1, and M is an integer greater than or equal to 1.
  • the processor is specifically configured to: add an execution condition to obtain a second data operation instruction in the first data operation instruction; the target field satisfies a preset condition in the execution condition, and the second data operation instruction is used to indicate that the first user is allowed to be in the target field
  • the target data body is operated when the preset condition is met.
  • the processor is specifically configured to: operate, in the target data volume, the Q field data of the target field that meets the preset condition; Is an integer greater than or equal to 1.
  • FIG. 1 is a structural diagram of a data access system according to an embodiment of the present application
  • FIG. 2 is a structural block diagram of a database access apparatus according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of a method for controlling data access according to an embodiment of the present disclosure
  • FIG. 4 is another schematic flowchart of a method for controlling data access according to an embodiment of the present invention.
  • FIG. 5 is a block diagram showing another structure of a database access apparatus according to an embodiment of the present invention.
  • FIG. 6 is a block diagram of another structure of a database access apparatus according to an embodiment of the present invention.
  • Database can be considered as a warehouse for organizing and storing data according to data structure. Users can manage data in the database, such as query data, delete data, add data, and update data. There are many types of databases, such as: oracle, MySQL, PostgreSQL, DB2, IQ, etc.
  • the data body can be considered as a specific data structure for storing data in the database, such as: table, attempt, and so on. Among them, there are rows and columns in the table, which can store data.
  • a view is a virtual table. Like a real table, a view contains columns and rows.
  • a field which can be considered as an attribute value in a table, used to describe the attributes of the data.
  • "name”, "income”, “age” are all the fields in Table 1.
  • “A, B, C, D” is the data under the “name” field
  • "8K, 12K, 5K, 15K” is the data under the "revenue” field
  • "25, 28, 27, 30” is the "age” The data under the field. Record the "Name” field as "C1", the "Revenue” field as “C2”, and the "Age” field as "C3".
  • FIG. 1 is a structural diagram of a data access system according to an embodiment of the present invention.
  • a user in a database access device can log in to a terminal device by using an account name and a password. Further, the user can also write an SQL statement on the terminal device.
  • the terminal device can query data in each database connected to the database access device by using a SQL statement input by the user.
  • the database can include data bodies that store data, such as tables and views. For example, the SQL statement input by the user in the terminal device is “select*from T1”, that is, the data in Table 1 is queried.
  • the terminal device transmits the SQL statement input by the user to the database access device, and the database access device can determine whether the user has the permission of querying the table 1 after receiving the SQL statement transmitted by the terminal device, and if the user has the permission of the query table 1, Allows the user to query all the data in Table 1. For example, the data of Table 1 is sent to the terminal device for the user to view.
  • the pre-authorization setting information includes the authority for the user to operate the data body, for example, allowing the viewing of the information of the person whose age is greater than 50 years old.
  • the database accessing device first acquires the first data operation instruction input by the user at the terminal device, and further determines the authority for determining the user operation target data body according to the data body identification query permission setting information carried by the first data operation instruction.
  • the database access device may further generate a second data operation instruction according to the authority of the user operation target data body and the first data operation instruction.
  • the database access device executes the second data operation instruction to operate the data in the target data body within the target range; wherein the target range is a range allowed by the user's authority to operate the target data body.
  • the method provided by the embodiment of the present invention can automatically modify the SQL statement input by the user in combination with the permission setting information, and increase the execution condition of the SQL statement (that is, the permission of the user to access the data body, such as the row permission or the column permission), and then perform the modification.
  • the SQL statement implements permission control on user tables, rows, and columns. In this way, sensitive columns or sensitive rows in the table can be protected, which can provide security for data access, and to some extent avoid the risk of information leakage.
  • the data access control method provided by the embodiment of the present invention can be applied to a database access device, and the database access device can be the database access device in FIG. As shown in FIG. 2, the database access device can include at least one processor 11, memory 12, transceiver 13, and communication bus 14.
  • the processor 11 is a control center of the database access device, and may be a processor or a collective name of a plurality of processing elements.
  • the processor 11 is a central processing unit (CPU), may be an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.
  • CPU central processing unit
  • ASIC Application Specific Integrated Circuit
  • DSPs digital signal processors
  • FPGAs Field Programmable Gate Arrays
  • the processor 11 can perform various functions of the database access device by running or executing a software program stored in the memory 12 and calling data stored in the memory 12.
  • processor 11 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG.
  • the database access device can include multiple processors, such as processor 11 and processor 15 shown in FIG.
  • processors can be a single core processor (CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more database access devices, circuits, and/or processing cores for processing data (e.g., computer program instructions).
  • the memory 12 can be a read-only memory (ROM) or other type of static storage database access device that can store static information and instructions, a random access memory (RAM) or can store information and instructions.
  • Other types of dynamic storage database access devices may also be Electrically Erasable Programmable Read-Only Memory (EEPROM), Compact Disc Read-Only Memory (CD-ROM) or other optical discs.
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • CD-ROM Compact Disc Read-Only Memory
  • Storage optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage database access devices, or can be used to carry or store the desired form of instructions or data structures Program code and any other medium that can be accessed by a computer, but is not limited thereto.
  • the memory 12 can be stand-alone and connected to the processor 11 via a communication bus 14.
  • the memory 12 can also be integrated with the processor 11.
  • the memory 12 is used to store a software program that executes the solution of the present invention, and is controlled by the processor 11.
  • the transceiver 13 uses a device such as any transceiver for communication between other devices, such as communication with the terminal device shown in FIG.
  • the transceiver 13 can also be used to communicate with a communication network, such as an Ethernet, a radio access network (RAN), a Wireless Local Area Networks (WLAN), and the like.
  • the transceiver 13 may include a receiving unit to implement a receiving function, and a transmitting unit to implement a transmitting function.
  • the communication bus 14 may be an Industry Standard Architecture (ISA) bus, an external database access device (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus.
  • ISA Industry Standard Architecture
  • PCI external database access device
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 2, but it does not mean that there is only one bus or one type of bus.
  • the database access device structure illustrated in FIG. 2 does not constitute a limitation to the database access device, and may include more or fewer components than those illustrated, or some components may be combined, or different component arrangements.
  • the database administrator generates the permission setting information according to the identity of each user in advance, and writes the permission setting information into the memory 12 of the database access device.
  • the transceiver 13 can acquire the terminal device connected to the database access device.
  • the first data operation instruction is transmitted, and the processor 11 can further parse the first data operation instruction, determine all data bodies that the user wants to operate (ie, the target data body), and then determine the user according to the permission setting information in the memory 12. Is there permission to operate the data body? If there is no permission to operate, the user is prompted to have no permissions.
  • the processor 11 further determines whether the data body that the user wants to operate is set with the row authority (ie, the user operates the row of the data body), and if there is the row authority control, the first data operation instruction is modified to increase the execution condition. , generating a second data operation instruction.
  • the processor 11 determines whether the data body that the user wants to operate is set with column permissions (ie, the user operates the column of the data body). If there is column permission control, the first data operation instruction needs to be modified to increase the execution condition to hide Related columns.
  • the processor 11 executes the modified data operation instruction, that is, the second data operation instruction, to operate the data in the target data body within the target range; the target range is that the first user operates the target data body Permissions allowed by the scope.
  • An embodiment of the present invention provides a data access control method. As shown in FIG. 3, the method includes the following steps:
  • the database access device acquires a first data operation instruction, where the first data operation instruction carries an identifier of the target data body, where the first data operation instruction is triggered by the first user.
  • the user inputs an account name and a password to log in at the terminal device.
  • the user may input a first data operation instruction in the terminal device, and the terminal device may The first data operation instruction input by the user is transmitted to the database access device, so the database access device can acquire the first data operation instruction triggered by the first user.
  • the target data body can be regarded as a data body that the user wants to operate by the first data operation instruction, as shown in Table 1.
  • the identifier of the data body can be the name of the data body. Taking the target data as an example, the identifier of the data body may be the name of the table, such as "T1".
  • the data operation instruction in the embodiment of the present invention may be an SQL language.
  • the first data operation instruction acquired by the database access device is “select*from T1”, and represents that the user wants to query data in Table 1 (the table named T1 is Table 1).
  • the functions of the SQL language include querying data, deleting data, adding data, updating data, etc.
  • the functions of the data operation instruction include querying data, deleting data, adding data, updating data, and the like.
  • the database access device determines the authority of the first user to operate the target data body according to the identifier query permission setting information of the target data body.
  • the rights setting information includes an identifier of the at least one data body and at least one user operating the at least one data body, the at least one data body includes the target data body, and the at least one user includes the first user .
  • the administrator of the database of the database access device can determine whether the data body can be operated by a certain user according to the functions of each user, the service authority, and the like. Further, it is also necessary to determine whether the data body includes sensitive columns. If the data body includes sensitive columns, column permissions are also required to prevent the user from operating sensitive column data. Of course, if the data body includes sensitive rows, you also need to set row permissions to prevent users from manipulating sensitive rows of data. In some embodiments, the row permission may be set by setting a value range of the field.
  • the permission of the user A to operate the table 1 may be set to: only allow the operation of the related data of the person whose age is less than 30, then User A operates the row permission of Table 1 as: C1 ⁇ 30, that is, user A can operate the first three rows of data of Table 1.
  • you can set the user A to operate Table 1 with the following permissions: Only allow the operation of the age-related data of the person 25, then User A The row permission of the operation table 1 is: C1 25, that is, the user A can operate the first row of data of the table 1.
  • the permission of the user A operation table 1 may be set as follows: the related data of the person who is aged 25 is not allowed to be operated, and the row permission of the user A operation table 1 is: C1 ⁇ 25, that is, the user A may not operate the table 1.
  • the first row of data can only operate the rest of the data in Table 1, such as the second row of data, the third row of data, and so on.
  • the column permissions can be set by setting the value of the field corresponding to the sensitive column to a null value (null).
  • the database access device may also write the permission setting information into the memory of the database access device, so that the subsequent search permission setting information determines what specific authority of a certain user to operate a certain data body.
  • the permission setting information may be stored in the memory in the form of a table. Table 2 below is a possible implementation manner of the permission setting information.
  • C2, C3, C5, and C4 in Table 2 are fields in the data body, such as "age”, “income”, and the like.
  • Table 2 is only an example of the privilege setting information, and the privilege setting information in the embodiment of the present invention may have other possible implementation manners, which is not limited by the embodiment of the present invention.
  • the user identifier may be an account name.
  • the account name of the user A is “A”, and the identifier of the user A may also be “A”.
  • the “sensitive column” in the embodiment of the present invention refers to a column of data that needs to be kept secret for a certain user, such as “revenue”, “cost price”, and the like.
  • “Sensitive line” refers to a row of data that needs to be kept confidential for a user, such as data for employees aged 30 or older.
  • the database access device may parse the first data operation instruction triggered by the first user, and determine the data body that the first user wants to operate, that is, the target data body. Since the user logs in to the terminal device by using the account name and password, the terminal device can transmit the user identifier to the database access device, such as the account name, while transmitting the first data operation instruction to the terminal device. Therefore, the database access device can also determine the user ID of the user. Further, the database access device may determine the authority of the first user to operate the target data body by using the identifier of the target data body and the user identifier query authority setting information of the first user. For example, user A's account name is "A", that is, user A's user ID is "A".
  • the first data operation instruction input by the user A is "select*from T1", and the instruction instruction "select*from T1" can be determined, and the identifier of the target data body can be determined as "T1".
  • the user A's authority to operate T1 is determined according to the user ID "A" of the user A and the identification "T1" of the target data body.
  • the permission setting information is taken as an example. According to the user ID "A" of the user A and the identifier "T1" of the target data body, the permission of the user A to operate T1 is C5>1000, that is, the user A can operate. All data in the "C5 field is greater than 1000" is satisfied in T1.
  • the rights of the data body may be set for all users, then the user identification may not be included in the rights setting information, and Table 3 is another possible implementation of the rights setting information.
  • the database access device only needs to query the permission setting information according to the identifier of the data body to determine the specific authority of the user to operate a certain data body. For example, the identifier of the target data body in the first data operation instruction input by the first user is “T2”, and then the authority of the first user to operate the data body “T2” is: prohibiting the C2 field in the operation data body “T2”.
  • the database access device generates a second data operation instruction according to the permission of the first user to operate the target data body and the first data operation instruction.
  • the database access device may modify the first data operation instruction according to the permission of the first user to operate the target data body, increase the execution condition, and generate a new data operation instruction (ie, the second data operation instruction), the new The data manipulation instruction may indicate the authority of the first user to operate the target data volume.
  • restrictions on the authority of the user to operate the data body include row permissions and column permissions.
  • column permissions can be considered as restricting the permissions of the user to manipulate certain columns of the data body, such as: prohibiting users from operating sensitive columns in the data body.
  • the database The access device may then add an execution condition to the first data operation instruction to obtain the second data operation instruction.
  • the value corresponding to the target field of the first user operation is a null value.
  • the first data operation instruction input by the first user is “select*from T1(select*from T1where C2 in(10,20,30))”, that is, the user wants to query the table T1 that the C2 field is equal to 10, 20, 30 of all data.
  • the database access device query authority setting information determines the first user operation target data body (taking T1 as an example, assuming that the T1 table has three fields of C1, C2, and C3): forbidding access to the C2 field in T1, that is, C2 Is set to sensitive columns.
  • the database access device can modify the first data manipulation instruction to prevent the first user from operating the data under the C2 field. For example, modify "select*from T1(select*from T1where C2 in(10,20,30))" to:
  • the user queries that the column data is always empty, thus ensuring that the data under the C2 field will not be viewed by the user, and the special data is kept secret.
  • the row permission can be considered as limiting the permissions of the user to manipulate certain rows of the data body, such as: prohibiting the user from operating sensitive rows in the data body.
  • the permission is: allowing the first user to operate the data in the target data body when the target field meets a preset condition, that is, only the user is allowed.
  • the data in the target data field of the operation data body satisfies the preset condition, for example, only the user is allowed to view the information of the person who is older than 30 years old.
  • the database access device adds an execution condition to the first data operation instruction to obtain the second data operation instruction; in the execution condition, the target field satisfies the preset condition, and the second data operation instruction uses The instruction is allowed to operate the target data body when the target field satisfies a preset condition.
  • the first data operation instruction input by the first user is “select*from T1”, that is, the user wants to query all the data in the table T1.
  • the database access device query authority setting information determines that the first user operates the target data body (taking T1 as an example, assuming that the T1 table has three fields of C1, C2, and C3): accessing only C1>10000 data, that is, N rows of data whose field C1 is greater than 10000 are set as sensitive rows.
  • the database access device may modify the first data manipulation instruction to prevent the first user from operating the data in which the field C1 is less than 10,000. For example, modify "select*from T1" to:
  • the “row permission” is not limited to “only allowing access to a data whose field is larger than a certain value”, or “only allowing access to a certain field equal to a certain value”.
  • "Forbidden to access data of a certain field equal to some data” the above-mentioned "only allow access to the data of C1>10000" is only an example of the line authority, which is not limited by the embodiment of the present invention.
  • the "forbidden access to the C2 field in T1" is only an example of the column permission.
  • the embodiment of the present invention also does not limit the specific implementation of the column permission.
  • the database access device executes the second data operation instruction, and operates data in the target data body within a target range; the target range is a range allowed by the first user to operate the target data body. .
  • the database access device may generate a second data operation instruction by adding an execution condition to the first data operation instruction input by the user, and the finally executed second data operation instruction can indicate the authority of the user to operate the data body. Executing the second data operation instruction may prohibit the user from operating sensitive rows or sensitive columns to protect sensitive data.
  • the permission of the first user to operate the target data is: prohibiting the first user from operating at least one target field in the target data body, the database access device executing the second data operation instruction, the user may Manipulating the N columns of data in the target data body other than the target field, the M column data under the target field in the target data volume cannot be operated.
  • the N is an integer greater than or equal to 1
  • the M is an integer greater than or equal to 1.
  • the first user operates the target data body with permission: the first user is allowed to operate the data in the target data body when the target field meets the preset condition, and the database access device executes the second data operation instruction,
  • the user may operate the Q line data in the target data body that the target field meets the preset condition; the Q is an integer greater than or equal to 1.
  • the smallest unit of the data manipulation instruction can be parsed to determine the identity of the data volume that the user wants to access, ie, the identity of the target data volume.
  • the keyword may be a keyword in the SQL language such as select, from, where, and, order by sum, substr; the identifier may include a table name, a field name, and the like.
  • the database access device can put the parsed table name into an array, that is, determine the identity of the target data body.
  • the embodiment of the invention further provides a data access control method. As shown in FIG. 4, the method includes the following steps:
  • the database access device acquires a SQL statement input by the user.
  • the SQL statement input by the user carries the identifier “T1” of the data body that the user wants to access.
  • the database access device determines, according to the “T1” query permission setting information, the permission of the user to operate T1.
  • the database access device determines whether the user has the right to operate T1.
  • the specific prompting method may be: displaying a prompt box, prompting the user through the text in the prompt box, such as: displaying the text "You do not have access table 1 Permissions, please contact the administrator to modify the permissions.”
  • step 404 is performed.
  • the database access device determines whether T1 sets a row permission.
  • step 405 is executed to modify the SQL statement input by the user according to the row permission set by T1, and the execution condition is increased to prevent the user from operating the sensitive row data.
  • step 406 is executed to continue to determine whether T1 sets the column permission.
  • the database access device modifies the SQL statement.
  • the database access device determines whether T1 sets column permissions.
  • step 405 is executed to modify the SQL statement input by the user according to the column permission set by T1, and the execution condition is increased to prevent the user from operating the data of the sensitive column.
  • step 407 is performed.
  • the database access device executes the modified SQL statement.
  • step 406 determines that column permissions are set by T1
  • step 405 is executed again, the SQL statement is modified, and then step 407 is performed.
  • step 406 determines that the column permission is not set by T1
  • step 405 is not required to be executed again to modify the SQL statement, and step 407 is directly executed.
  • the embodiment of the present invention provides a database access device, which may be a database access device according to an embodiment of the present invention, such as the database access device shown in FIG.
  • a database access device which may be a database access device according to an embodiment of the present invention, such as the database access device shown in FIG.
  • FIG. 5 shows a possible structural diagram of the above communication device.
  • the database access device includes an obtaining unit 501, a query unit 502, a generating unit 503, and an operating unit 504.
  • the obtaining unit 501 is configured to support the database access device to perform step 301, step 401, and/or other processes for the techniques described herein in the above embodiments.
  • the query unit 502 is configured to support the database access device to perform step 302, step 402 in the above embodiment, and/or other processes for the techniques described herein;
  • a generating unit 503 configured to support the database access device to perform step 303, step 405, and/or other processes for the techniques described herein in the foregoing embodiments;
  • An operation unit 504 configured to support the database access device to perform step 304, step 407, and/or other processes for the techniques described herein in the foregoing embodiments;
  • the database access device includes a processing module 601 and a communication module 602.
  • the processing module 601 is configured to control and manage the actions of the database access device, for example, to perform the steps performed by the query unit 502, the generating unit 503, and the operating unit 504, and/or other processes for performing the techniques described herein.
  • the communication module 602 is configured to support interaction between the database access device and other devices, for example, performing the steps performed by the obtaining unit 501 described above.
  • the database access device may further include a storage module 603 for storing program codes and data of the database access device.
  • the database access device may be the database access device shown in FIG. 2.
  • the disclosed database access apparatus and method may be implemented in other manners.
  • the database access device embodiments described above are merely illustrative.
  • the division of the modules or units is only a logical function division, and may be implemented in another manner, such as multiple units or Components may be combined or integrated into another device, or some features may be omitted or not performed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, database access device or unit, and may be in electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may be one physical unit or multiple physical units, that is, may be located in one place, or may be distributed to multiple different places. . Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a readable storage medium.
  • the technical solution of the embodiments of the present application may be embodied in the form of a software product in the form of a software product in essence or in the form of a contribution to the prior art, and the software product is stored in a storage medium.
  • a number of instructions are included to cause a device (which may be a microcontroller, chip, etc.) or processor to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Computational Linguistics (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请实施例公开了一种数据访问的控制方法及数据库访问装置，涉及数据存储领域，能够为数据访问提供安全保障，在一定程度上避免了信息外漏的风险。包括：获取第一数据操作指令(携带目标数据体的标识)，该指令是由第一用户触发的；根据目标数据体的标识查询权限设置信息，确定第一用户操作目标数据体的权限；权限设置信息包括至少一个数据体的标识以及至少一个用户操作(包括目标数据体)至少一个数据体(包括第一用户)的权限；根据第一用户操作目标数据体的权限以及第一数据操作指令生成第二数据操作指令；执行第二数据操作指令，操作目标数据体中在目标范围内的数据；目标范围为第一用户操作目标数据体的权限所允许的范围。

Description

一种数据访问的控制方法及数据库访问装置
本申请要求于2018年04月19日提交中国专利局、申请号为201810354338.5、发明名称为“一种数据访问的控制方法及数据库访问装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及数据存储领域，尤其涉及一种数据访问的控制方法及数据库访问装置。
背景技术
数据库(Database)是按照数据结构来组织、存储和管理数据的仓库，用户可以对Database中的数据进行新增、截取、更新、删除等操作。
通常，用户可以编写结构化查询语言(Structured Query Language，SQL)代码查询Database，从中导出报表数据等。数据库管理员(Database Administrator，DBA)往往只能针对用户进行权限设置，如：禁止用户A访问表1，现有技术并不能限制用户对某个表中数据的具体操作。如此，可能该用户A可以查看到除表1外的所有数据，对于一些高科技、信息、金融等行业，很容易造成极大的信息安全风险。
发明内容
本申请实施例提供一种数据访问的控制方法及数据库访问装置，能够为数据访问提供安全保障，在一定程度上避免了信息外漏的风险。
为达到上述目的，本申请实施例采用如下技术方案：
第一方面，公开了一种数据访问的控制方法，包括：数据库访问装置可以获取第一数据操作指令，其中，第一数据操作指令携带目标数据体的标识，第一数据操作指令是由第一用户触发的，也就是说，目标数据体即用户想要通过第一数据操作指令操作的数据体。数据库访问装置还预先存储了权限设置信息，包括至少一个数据体的标识以及至少一个用户操作至少一个数据体的权限。这里所述的至少一个数据体包括目标数据体，至少一个用户包括第一用户。进一步，数据库访问装置还可以根据目标数据体的标识查询权限设置信息，确定第一用户操作目标数据体的权限；接着，数据库访问装置还可以根据第一用户操作目标数据体的权限以及第一数据操作指令生成第二数据操作指令。最后，数据库访问装置执行第二数据操作指令，操作目标数据体中在目标范围内的数据；目标范围为第一用户操作目标数据体的权限所允许的范围。
本发明实施例提供的数据访问的控制方法，可以结合权限设置信息，自动修改用户输入的SQL语句，增加SQL语句的执行条件(即用户访问数据体的权限，如行权限或列权限)，然后执行修改后的SQL语句，实现对用户表，行，列的权限控制。如此，可以对表中的敏感列或敏感行进行保护，能够为数据访问提供安全保障，在一定程度上避免了信息外漏的风险。
结合第一方面，在第一方面的第一种可能的实现方式中，若第一用户操作目标数据的权限为禁止第一用户操作目标数据体中的至少一个目标字段，则根据第一用户操作目标数据体的权限以及第一数据指令生成第二数据操作指令具体包括：数据库访问装置在第一数据操作指令中增加执行条件获得第二数据操作指令；在该执行条件中，第一用户操作的目标字段对应的值为空值。
也就是说，本发明实施例可以通过修改SQL语句，将目标字段对应的值置为空值来实现列权限的控制。
结合第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，执行第二数据操作指令，操作目标数据体中在目标范围内的数据具体包括：数据库访问装置操作目标数据体中除目标字段外的其他字段下的N列数据，禁止操作目标数据体中目标字段下的M列数据；N为大于等于1的整数，M为大于等于1的整数。
也就是说，当SQL语句的执行条件中目标字段的值为空值(null)，禁止用户操作该字段下的一列数据，因此用户查询到的此列数据永远为空，从而实现了对敏感列数据的保护。
结合第一方面，在第一方面的第三种可能的实现方式中，若第一用户操作目标数据体的权限为允许第一用户在目标字段满足预设条件时操作目标数据体中的数据，则根据第一用户操作目标数据体的权限以及第一数据指令生成第二数据操作指令具体包括：数据库访问装置在第一数据操作指令中增加执行条件获得第二数据操作指令；在该执行条件中目标字段满足预设条件，另外，第二数据操作指令用于指示允许第一用户在目标字段满足预设条件时操作目标数据体。
也就是说，本发明实施例可以通过修改SQL语句，增加目标字段需要满足的条件来实现列权限的控制。
结合第一方面的第三种可能的实现方式中，在第一方面的第四种可能的实现方式中，执行第二数据操作指令，操作目标数据体中在目标范围内的数据具体包括：数据库访问装置操作目标数据体中目标字段符合预设条件的Q行数据；Q为大于等于1的整数。
也就是说，当SQL语句的执行条件中目标字段的值需要满足预设条件，仅仅允许用户操作该字段下，在预设条件允许范围内的数据，从而实现了对敏感行数据的保护。
第二方面，公开了一种数据访问装置，包括：
获取单元，用于获取第一数据操作指令，第一数据操作指令携带目标数据体的标识，第一数据操作指令是由第一用户触发的；查询单元，用于根据目标数据体的标识查询权限设置信息，确定第一用户操作目标数据体的权限；权限设置信息包括至少一个数据体的标识以及至少一个用户操作至少一个数据体的权限，至少一个数据体包括目标数据体，至少一个用户包括第一用户；生成单元，用于根据第一用户操作目标数据体的权限以及第一数据操作指令生成第二数据操作指令；操作单元，执行第二数据操作指令，操作目标数据体中在目标范围内的数据；目标范围为第一用户操作目标数据体的权限所允许的范围。
本发明实施例提供的数据库访问装置，可以结合权限设置信息，自动修改用户输入的SQL语句，增加SQL语句的执行条件(即用户访问数据体的权限，如行权限或列权限)，然后执行修改后的SQL语句，实现对用户表，行，列的权限控制。如此，可以对表中的 敏感列或敏感行进行保护，能够为数据访问提供安全保障，在一定程度上避免了信息外漏的风险。
结合第二方面，在第二方面的第一种可能的实现方式中，若第一用户操作目标数据的权限为禁止第一用户操作目标数据体中的至少一个目标字段，则生成单元具体用于，在第一数据操作指令中增加执行条件获得第二数据操作指令；在执行条件中，第一用户操作的目标字段对应的值为空值。
结合第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，操作单元具体用于，操作目标数据体中除目标字段外的其他字段下的N列数据，禁止操作目标数据体中目标字段下的M列数据；N为大于等于1的整数，M为大于等于1的整数。
结合第二方面，在第二方面的第三种可能的实现方式中，若第一用户操作目标数据体的权限为允许第一用户在目标字段满足预设条件时操作目标数据体中的数据，则生成单元具体用于，在第一数据操作指令中增加执行条件获得第二数据操作指令；在执行条件中目标字段满足预设条件，第二数据操作指令用于指示允许第一用户在目标字段满足预设条件时操作目标数据体。
结合第二方面的第三种可能的实现方式，在第二方面的第四种可能的实现方式中，操作单元具体用于，操作目标数据体中目标字段符合预设条件的Q行数据；Q为大于等于1的整数。
第三方面，公开了一种数据访问装置，包括：
收发器，用于获取第一数据操作指令，第一数据操作指令携带目标数据体的标识，第一数据操作指令是由第一用户触发的；处理器，用于根据目标数据体的标识查询权限设置信息，确定第一用户操作目标数据体的权限；权限设置信息包括至少一个数据体的标识以及至少一个用户操作至少一个数据体的权限，至少一个数据体包括目标数据体，至少一个用户包括第一用户；处理器还用于，根据第一用户操作目标数据体的权限以及第一数据操作指令生成第二数据操作指令；执行第二数据操作指令，操作目标数据体中在目标范围内的数据；目标范围为第一用户操作目标数据体的权限所允许的范围。
本发明实施例提供的数据库访问装置，可以结合权限设置信息，自动修改用户输入的SQL语句，增加SQL语句的执行条件(即用户访问数据体的权限，如行权限或列权限)，然后执行修改后的SQL语句，实现对用户表，行，列的权限控制。如此，可以对表中的敏感列或敏感行进行保护，能够为数据访问提供安全保障，在一定程度上避免了信息外漏的风险。
结合第三方面，在第三方面的第一种可能的实现方式中，若第一用户操作目标数据的权限为禁止第一用户操作目标数据体中的至少一个目标字段，则处理器具体用于，在第一数据操作指令中增加执行条件获得第二数据操作指令；在执行条件中，第一用户操作的目标字段对应的值为空值。
结合第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，处理器具体用于，操作目标数据体中除目标字段外的其他字段下的N列数据，禁止操作目标数据体中目标字段下的M列数据；N为大于等于1的整数，M为大于等于1的整数。
结合第三方面，在第三方面的第三种可能的实现方式中，若第一用户操作目标数据 体的权限为允许第一用户在目标字段满足预设条件时操作目标数据体中的数据，则处理器具体用于，在第一数据操作指令中增加执行条件获得第二数据操作指令；在执行条件中目标字段满足预设条件，第二数据操作指令用于指示允许第一用户在目标字段满足预设条件时操作目标数据体。
结合第三方面的第三种可能的实现方式，在第三方面的第四种可能的实现方式中，处理器具体用于，操作目标数据体中目标字段符合预设条件的Q行数据；Q为大于等于1的整数。
附图说明
图1为本申请实施例提供的数据访问系统的架构图；
图2为本发明实施例提供的数据库访问装置的结构框图；
图3为本发明实施例提供的数据访问的控制方法的流程示意图；
图4为本发明实施例提供的数据访问的控制方法的另一流程示意图；
图5为本发明实施例提供的数据库访问装置的另一结构框图；
图6为本发明实施例提供的数据库访问装置的另一结构框图。
具体实施方式
首先，本发明实施例中的第一、第二仅仅是为了区别不同的对象，并不代表先后顺序。另外，对本发明实施例涉及的术语进行解释说明，具体地：
(1)数据库(Database)可以认为是按照数据结构来组织、存储数据的仓库，用户可以管理数据库中的数据，如：查询数据、删除数据、增加数据以及更新数据等。数据库有很多种类型，如：oracle、MySQL、PostgreSQL、DB2、IQ等。
(2)数据体，可以认为是数据库中用于存储数据的特定数据结构，如：表、试图等。其中，表中有行和列，均可以存储数据。视图是一个虚拟表，同真实的表一样，视图包含列和行。
(3)字段，可以认为是表中的一个属性值，用来说明数据的属性。如：参考以下表1，“姓名”、“收入”、“年龄”都是表1中的字段。其中，“A、B、C、D”是“姓名”字段下的数据，“8K、12K、5K、15K”是“收入”字段下的数据，“25、28、27、30”是“年龄”字段下的数据。将“姓名”字段记为“C1”，将“收入”字段记为“C2”，将“年龄”字段记为“C3”。
表1
姓名(C1) 收入(C2) 年龄(C3)
A 8K 25
B 12K 28
C 5K 27
D 15K 30
图1是本发明实施例提供的数据访问系统的架构图。参考图1，数据库访问装置中用户可以通过账户名、密码登录终端设备，进一步，用户还可以在终端设备上编写SQL 语句。终端设备可以通过用户输入的SQL语句查询与数据库访问装置相连的各个数据库中的数据。数据库中可以包括表、视图等存储数据的数据体。示例的，用户在终端设备输入的SQL语句为“select*from T1”，即查询表1中的数据。具体地，终端设备将用户输入的SQL语句传输给数据库访问装置，数据库访问装置接收终端设备传输的SQL语句后可以判断该用户是否有查询表1的权限，如果用户有查询表1的权限，则允许用户查询表1的全部数据。如：将表1的数据发送给终端设备以供用户查看。
但是，现有技术中只能做到用户为粒度的权限控制，一旦允许用户查看某个表，用户就可以操作该表中的所有数据。实际上，对于高科技、信息、金融等行业，某个表中的某个敏感列(如单价，成本等)或某些敏感行(如一个省的数据)为敏感数据，是需要进行权限控制的。如果不对用户进行权限控制，用户可以查看到表中的所有数据，包括敏感数据，极易造成极大的信息安全风险和管理漏洞。
本发明实施例提供的数据访问的控制方法中，预先权限设置信息，包括用户操作数据体的权限，如：允许查看年龄大于50岁的人员信息。数据库访问装置首先获取用户在终端设备输入的第一数据操作指令，进一步还可以根据第一数据操作指令携带的数据体标识查询权限设置信息确定确定该用户操作目标数据体的权限。数据库访问装置还可以根据该用户操作目标数据体的权限以及第一数据操作指令生成第二数据操作指令。最后，数据库访问装置执行第二数据操作指令，操作目标数据体中在目标范围内的数据；其中，目标范围为该用户操作目标数据体的权限所允许的范围。可见，本发明实施例提供的方法可以结合权限设置信息，自动修改用户输入的SQL语句，增加SQL语句的执行条件(即用户访问数据体的权限，如行权限或列权限)，然后执行修改后的SQL语句，实现对用户表，行，列的权限控制。如此，可以对表中的敏感列或敏感行进行保护，能够为数据访问提供安全保障，在一定程度上避免了信息外漏的风险。
本发明实施例提供的数据访问的控制方法可应用于数据库访问装置，所述数据库访问装置可以是图1中的数据库访问装置。如图2所示，该数据库访问装置可以包括至少一个处理器11，存储器12、收发器13以及通信总线14。
下面结合图2对该数据库访问装置的各个构成部件进行具体的介绍：
处理器11是数据库访问装置的控制中心，可以是一个处理器，也可以是多个处理元件的统称。例如，处理器11是一个中央处理器(central processing unit，CPU)，也可以是特定集成电路(Application Specific Integrated Circuit，ASIC)，或者是被配置成实施本发明实施例的一个或多个集成电路，例如：一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，FPGA)。
其中，处理器11可以通过运行或执行存储在存储器12内的软件程序，以及调用存储在存储器12内的数据，执行数据库访问装置的各种功能。
在具体的实现中，作为一种实施例，处理器11可以包括一个或多个CPU，例如图2中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，数据库访问装置可以包括多个处理器，例如图2中所示的处理器11和处理器15。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或 多个数据库访问装置、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
存储器12可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储数据库访问装置，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储数据库访问装置，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储数据库访问装置、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器12可以是独立存在，通过通信总线14与处理器11相连接。存储器12也可以和处理器11集成在一起。
其中，所述存储器12用于存储执行本发明方案的软件程序，并由处理器11来控制执行。
收发器13，使用任何收发器一类的装置，用于其他装置之间的通信，如：与图1所示终端设备之间的通信。当然，收发器13还可以用于与通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(Wireless Local Area Networks，WLAN)等。收发器13可以包括接收单元实现接收功能，以及发送单元实现发送功能。
通信总线14，可以是工业标准体系结构(Industry Standard Architecture，ISA)总线、外部数据库访问装置互连(Peripheral Component，PCI)总线或扩展工业标准体系结构(Extended Industry Standard Architecture，EISA)总线等。该总线可以分为地址总线、数据总线、控制总线等。为便于表示，图2中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
图2中示出的数据库访问装置结构并不构成对数据库访问装置的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
本发明实施例中，数据库管理员预先根据各个用户的身份生成权限设置信息，并将权限设置信息写入数据库访问装置的存储器12中，进一步，收发器13可以获取与数据库访问装置连接的终端设备传输的第一数据操作指令，处理器11还可以对第一数据操作指令进行解析，确定出用户想要操作的所有数据体(即目标数据体)，然后根据存储器12中的权限设置信息判断用户是否有操作该数据体的权限。如果没有操作权限，则提示用户没有权限。如果有权限，处理器11还进一步判断用户想要操作的数据体是否设置有行权限(即用户操作数据体的行的权限)，如果有行权限控，则修改第一数据操作指令增加执行条件，生成第二数据操作指令。当然，还要判断用户想要操作的数据体是否是否设置有列权限(即用户操作数据体的列的权限)，如果有列权限控，也需要修改第一数据操作指令增加执行条件，以隐藏相关列。
最后，处理器11执行修改后的数据操作指令，即第二数据操作指令，操作所述目标数据体中在目标范围内的数据；所述目标范围为所述第一用户操作所述目标数据体的权限所允许的范围。通过修改数据操作指令对用户的数据访问进行控制，对表中的敏感列或敏感行进行保护，能够为数据访问提供安全保障，在一定程度上避免了信息外漏的风险。
本发明实施例提供一种数据访问的控制方法，如图3所示，所述方法包括以下步骤：
301、数据库访问装置获取第一数据操作指令，所述第一数据操作指令携带目标数据体的标识，所述第一数据操作指令是由第一用户触发的。
具体实现中，用户在终端设备输入账户名、密码登录，进一步，用户想要访问与数据库访问装置相连的各个数据库中的数据时，用户可以在终端设备输入第一数据操作指令，终端设备可以将用户输入的第一数据操作指令传输给数据库访问装置，因此数据库访问装置可以获取到第一用户触发的第一数据操作指令。本发明实施例中，目标数据体可以认为是用户想要通过第一数据操作指令操作的数据体，如表1。数据体的标识可以是数据体的名称。以目标数据为表作为示例，数据体的标识可以是表的名称，如“T1”。
另外，本发明实施例中的数据操作指令可以是SQL语言。示例的，数据库访问装置获取到的第一数据操作指令为“select*from T1”，代表用户想要查询表1(名称为T1的表记为表1)中的数据。
需要说明的是，SQL语言的功能包括查询数据、删除数据、增加数据、更新数据等，也就是说，数据操作指令的功能包括查询数据、删除数据、增加数据、更新数据等。
302、数据库访问装置根据所述目标数据体的标识查询权限设置信息，确定所述第一用户操作所述目标数据体的权限。所述权限设置信息包括至少一个数据体的标识以及至少一个用户操作所述至少一个数据体的权限，所述至少一个数据体包括所述目标数据体，所述至少一个用户包括所述第一用户。
具体实现中，数据库访问装置的数据库的管理员可以根据各个用户的职能、业务权限等信息确定数据体能否被某用户操作。进一步，还需要判断数据体是否包括敏感列，如果数据体包括敏感列还需要设置列权限以防止用户操作敏感列的数据。当然，如果数据体包括敏感行，也需要设置行权限以防止用户操作敏感行的数据。在一些实施例中，可以通过设置字段的取值范围来设置行权限，示例的，参考表1，可以设置用户A操作表1的权限为：仅允许操作年龄小于30的人员的相关数据，那么用户A操作表1的行权限为：C1<30，即用户A可以操作表1的前三行数据。当然，也可以通过设置字段的取值来限制用户的行权限，示例的，参考表1，可以设置用户A操作表1的权限为：仅允许操作年龄为25的人员的相关数据，那么用户A操作表1的行权限为：C1＝25，即用户A可以操作表1的第一行数据。又如，可以设置用户A操作表1的权限为：不允许操作年龄为25的人员的相关数据，那么用户A操作表1的行权限为：C1≠25，即用户A可以不可以操作表1的第一行数据，仅仅可以操作表1中其余的数据，如：第二行数据、第三行数据等。
在一些实施例中，可以将敏感列对应的字段的值置为空值(null)来设置列权限。同样，参考表1，可以设置用户A操作表1的权限为：不允许用户A访问人员的收入信息，即禁止用户A操作“收入”字段下的数据，那么用户A操作表1的列权限为：C1＝null，即用户A不可以操作表1的第二列数据。
进一步，数据库访问装置还可以将权限设置信息写入数据库访问装置的存储器中，以便后续查找权限设置信息确定某个用户操作某个数据体的具体权限是什么。在本发明实施例中，可以通过表的形式将权限设置信息存储在存储器中，以下表2是权限设置信息的一种可能的实现方式。
表2
Figure PCTCN2019080813-appb-000001
需要说明的是，表2中的C2、C3、C5、C4是数据体中的字段，如“年龄”、“收入”等。表2仅仅是权限设置信息的一种示例，本发明实施例中的权限设置信息还可以有其他可能的实现方式，本发明实施例对此不做限制。本发明实施例中，用户标识可以是账户名，如：用户A的账户名为“A”，那么用户A的标识也可以是“A”。
另外，本发明实施例中的“敏感列”指的是对某个用户需要保密的一列数据，如：“收入”、“成本价”等。“敏感行”指的是对某个用户需要保密的一行数据，如：年龄为30岁的员工的数据。
具体实现中，数据库访问装置可以解析第一用户触发的第一数据操作指令，确定第一用户想要操作的数据体，即目标数据体。由于用户是通过账户名、密码登录终端设备，终端设备向终端设备传输第一数据操作指令的同时，还可以向数据库访问装置传递用户标识，如：账户名。因此数据库访问装置也可以确定用户的用户标识。进一步，数据库访问装置可以目标数据体的标识、第一用户的用户标识查询权限设置信息确定第一用户操作目标数据体的权限。示例的，用户A的账户名为“A”，即用户A的用户标识为“A”。假设用户A输入的第一数据操作指令为“select*from T1”，解析指令“select*from T1”，可以确定目标数据体的标识为“T1”。进一步，根据用户A的用户标识“A”以及目标数据体的标识“T1”查询权限设置信息确定用户A操作T1的权限。以权限设置信息为表2为例，根据用户A的用户标识“A”以及目标数据体的标识“T1”查询表2，确定用户A操作T1的权限为：C5>1000，即用户A可以操作T1中满足“C5字段大于1000”的所有数据。
在一些实施例中，数据体的权限可以是针对所有用户设置的，那么权限设置信息中可以不包括用户标识，表3是权限设置信息的另一种可能的实现方式。此时数据库访问装置只需要根据数据体的标识查询权限设置信息就可以确定用户操作某数据体的具体权限。示例的，第一用户输入的第一数据操作指令中目标数据体的标识为“T2”，那么第一用户操作数据体“T2”的权限为：禁止操作数据体“T2”中的C2字段。
表3
T1 T2 T3 ……
C5>1000 C2＝null C3＝20 ……
303、数据库访问装置根据所述第一用户操作所述目标数据体的权限以及所述第一数据操作指令生成第二数据操作指令。
具体实现中，数据库访问装置可以根据所述第一用户操作所述目标数据体的权限修改第一数据操作指令，增加执行条件，生成新的数据操作指令(即第二数据操作指令)，新的数据操作指令可以指示第一用户操作所述目标数据体的权限。
本发明实施例中，对用户操作数据体的权限进行的限制包括行权限和列权限。
其中，列权限可以认为是对用户操作数据体的某些列的权限进行限制，如：禁止用户操作数据体中的敏感列。在一些实施例中，若所述第一用户操作所述目标数据的权限为：禁止所述第一用户操作所述目标数据体中的至少一个目标字段(如：“成本价”字段)，数据库访问装置则可以在所述第一数据操作指令中增加执行条件获得所述第二数据操作指令。在所述执行条件中，所述第一用户操作的目标字段对应的值为空值。
示例的，第一用户输入的第一数据操作指令为“select*from T1(select*from T1where C2 in(10，20，30))”，即用户想要查询表T1中满足C2字段等于10、20、30的所有数据。进一步，数据库访问装置查询权限设置信息确定第一用户操作目标数据体(以T1为例，假设T1表有C1、C2、C3三个字段)的权限为：禁止访问T1中的C2字段，即C2被设置成敏感列。数据库访问装置可以修改第一数据操作指令以防止第一用户操作C2字段下的数据。示例的，将“select*from T1(select*from T1where C2 in(10，20，30))”修改为：
select T1.C1,
T1.C2,
T1.C3
from(select C1，null C2，C3 from T1where C2 in(10，20，30))T1
因为C2这一列已被置为nul l，所以用户查询到此列数据永远为空，从而保证C2字段下的数据不会被用户查看到，实现了对特殊数据的保密。
另外，行权限可以认为是对用户操作数据体的某些行的权限进行限制，如：禁止用户操作数据体中的敏感行。在一些实施例中，若所述第一用户操作所述目标数据体的权限为：允许所述第一用户在目标字段满足预设条件时操作所述目标数据体中的数据，即仅允许用户操作数据体中目标字段满足预设条件的数据，如：仅允许用户查看年龄大于30岁的人员的信息。数据库访问装置则在所述第一数据操作指令中增加执行条件获得所述第二数据操作指令；在所述执行条件中所述目标字段满足所述预设条件，所述第二数据操作指令用于指示允许所述第一用户在目标字段满足预设条件时操作所述目标数据体。
示例的，第一用户输入的第一数据操作指令为“select*from T1”，即用户想要查询表T1中的所有数据。进一步，数据库访问装置查询权限设置信息确定第一用户操作目标数据体(以T1为例，假设T1表有C1、C2、C3三个字段)的权限为：只允许访问C1>10000的数据，即字段C1大于10000的N行数据被设置成敏感行。数据库访问装置可以修改第一数据操作指令以防止第一用户操作字段C1小于10000的数据。示例的，将“select*from T1”修改为：
“select*from(“select*from T1”where(C1>10000))T1”。
由此不管用户输入什么样的SQL语句，用户都不能操作T1中C1>10000的数据，可以做到对数据体的行权限的管控。
需要说明的是，本发明实施例中“行权限”不仅仅局限于“只允许访问某个字段大于某个数值的数据”，也可以是“只允许访问某个字段等于某些数值的数据”或者“禁止访问某个字段等于某些数据的数据”，上述“只允许访问C1>10000的数据”仅仅是行 权限的一种示例，本发明实施例对此不作限制。当然，“禁止访问T1中的C2字段”也仅仅是列权限的一种示例，本发明实施例同样对列权限的具体实现不作限制。
304、数据库访问装置执行所述第二数据操作指令，操作所述目标数据体中在目标范围内的数据；所述目标范围为所述第一用户操作所述目标数据体的权限所允许的范围。
也就是说，数据库访问装置可以通过在用户输入的第一数据操作指令中增加执行条件生成第二数据操作指令，最终执行的第二数据操作指令能够指示用户操作数据体的权限。执行第二数据操作指令可以禁止用户操作敏感行或敏感列，实现对敏感数据的保护。
具体实现中，如果所述第一用户操作所述目标数据的权限为：禁止所述第一用户操作所述目标数据体中的至少一个目标字段，数据库访问装置执行第二数据操作指令，用户可以操作所述目标数据体中除所述目标字段外的其他字段下的N列数据，无法操作所述目标数据体中所述目标字段下的M列数据。其中，所述N为大于等于1的整数，所述M为大于等于1的整数。
若所述第一用户操作所述目标数据体的权限为：允许所述第一用户在目标字段满足预设条件时操作所述目标数据体中的数据，数据库访问装置执行第二数据操作指令，用户可以操作所述目标数据体中所述目标字段符合所述预设条件的Q行数据；所述Q为大于等于1的整数。
在一些实施例中，可以解析出数据操作指令的最小单元来确定用户想要访问的数据体的标识，即目标数据体的标识。示例的，解析出的最小单元可以是关键字(key Word，KW)、空格或换行符(SP)、标识符(NAME)、数字(NUM)，也可以是SQL语言中的一些符号，如：“等号”(＝)、“逗号”(，)等。
其中，关键字可以是select,from,where,and,order by sum,substr等SQL语言中的关键字；标识符可以是包括表名，字段名等。
数据库访问装置可以把解析出的表名放到一个数组中，即确定了目标数据体的标识。
本发明实施例还提供一种数据访问的控制方法，如图4所示，所述方法包括以下步骤：
401、数据库访问装置获取用户输入的SQL语句。
其中，用户输入的SQL语句携带用户想要访问的数据体的标识“T1”。
402、数据库访问装置根据“T1”查询权限设置信息确定用户操作T1的权限。
403、数据库访问装置判断用户是否有操作T1的权限。
如果用户没有操作T1的权限，则提示用户不具备操作T1的权限，具体的提示方式可以是：显示提示框，通过该提示框中的文字提示用户，如：显示文字“您不具备访问表1的权限，请联系管理员修改权限”。
如果用户有操作T1的权限，则执行步骤404。
404、数据库访问装置判断T1是否设置行权限。
如果T1设置有行权限，则执行步骤405，根据T1设置的行权限修改用户输入的SQL语句，增加执行条件，避免用户操作敏感行的数据。
如果T1未设置行权限，则执行步骤406，继续判断T1是否设置列权限。
405、数据库访问装置修改SQL语句。
406、数据库访问装置判断T1是否设置列权限。
如果T1设置有列权限，则执行步骤405，根据T1设置的列权限修改用户输入的SQL语句，增加执行条件，避免用户操作敏感列的数据。
如果T1未设置行权限，则执行步骤407。
407、数据库访问装置执行修改后的SQL语句。
需要说明的是，如果数据库访问装置判断T1设置行权限以及列权限，那么在此数据库访问装置需要执行的是两次修改后的SQL语句，两次修改分别来增加T1的列权限以及行权限。最终，将汇总全部修改的SQL语句发到到后台Database去执行，允许用户访问权限访问以内的数据，从而对用户的数据访问进行控制，避免敏感数据被泄露，能够为数据访问提供安全保障，在一定程度上避免了信息外漏的风险。也就是说，步骤406确定T1设置了列权限之后，再次执行步骤405，修改SQL语句，之后再执行步骤407。
当然，如果步骤406确定T1未设置列权限，则无需再次执行步骤405修改SQL语句，直接执行步骤407。
本发明实施例提供一种数据库访问装置，所述数据库访问装置可以是本发明实施例涉及的数据库访问装置，如图1中所示的数据库访问装置。在采用对应各个功能划分各个功能模块的情况下，图5示出了上述通信设备的一种可能的结构示意图。如图5所示，所述数据库访问装置包括获取单元501、查询单元502、生成单元503以及操作单元504。
获取单元501，用于支持所述数据库访问装置执行上述实施例中的步骤301、步骤401，和/或用于本文所描述的技术的其它过程。
查询单元502，用于支持所述数据库访问装置执行上述实施例中的步骤302、步骤402，和/或用于本文所描述的技术的其它过程；
生成单元503，用于支持所述数据库访问装置执行上述实施例中的步骤303、步骤405，和/或用于本文所描述的技术的其它过程；
操作单元504，用于支持所述数据库访问装置执行上述实施例中的步骤304、步骤407，和/或用于本文所描述的技术的其它过程；
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
示例性的，在采用集成的单元的情况下，本申请实施例提供的数据库访问装置的结构示意图如图6所示。在图6中，该数据库访问装置包括：处理模块601和通信模块602。处理模块601用于对数据库访问装置的动作进行控制管理，例如，执行上述查询单元502、生成单元503以及操作单元504执行的步骤，和/或用于执行本文所描述的技术的其它过程。通信模块602用于支持数据库访问装置与其他设备之间的交互，例如，执行上述获取单元501执行的步骤。如图6所示，数据库访问装置还可以包括存储模块603，存储模块603用于存储数据库访问装置的程序代码和数据。
当处理模块601为处理器，通信模块602为收发器，存储模块603为存储器时，数据库访问装置可以为图2所示的数据库访问装置。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将 上述功能分配由不同的功能模块完成，即将数据库访问装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
在本申请所提供的几个实施例中，应该理解到，所揭露的数据库访问装置和方法，可以通过其它的方式实现。例如，以上所描述的数据库访问装置实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个装置，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，数据库访问装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是一个物理单元或多个物理单元，即可以位于一个地方，或者也可以分布到多个不同地方。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该软件产品存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (10)

  1. 一种数据访问的控制方法，其特征在于，包括：
    获取第一数据操作指令，所述第一数据操作指令携带目标数据体的标识，所述第一数据操作指令是由第一用户触发的；
    根据所述目标数据体的标识查询权限设置信息，确定所述第一用户操作所述目标数据体的权限；所述权限设置信息包括至少一个数据体的标识以及至少一个用户操作所述至少一个数据体的权限，所述至少一个数据体包括所述目标数据体，所述至少一个用户包括所述第一用户；
    根据所述第一用户操作所述目标数据体的权限以及所述第一数据操作指令生成第二数据操作指令；
    执行所述第二数据操作指令，操作所述目标数据体中在目标范围内的数据；所述目标范围为所述第一用户操作所述目标数据体的权限所允许的范围。
  2. 根据权利要求1所述的方法，其特征在于，若所述第一用户操作所述目标数据的权限为禁止所述第一用户操作所述目标数据体中的至少一个目标字段，则所述根据所述第一用户操作所述目标数据体的权限以及所述第一数据指令生成第二数据操作指令具体包括：
    在所述第一数据操作指令中增加执行条件获得所述第二数据操作指令；在所述执行条件中，所述第一用户操作的目标字段对应的值为空值。
  3. 根据权利要求2所述的方法，其特征在于，所述执行所述第二数据操作指令，操作所述目标数据体中在目标范围内的数据具体包括：
    操作所述目标数据体中除所述目标字段外的其他字段下的N列数据，禁止操作所述目标数据体中所述目标字段下的M列数据；所述N为大于等于1的整数，所述M为大于等于1的整数。
  4. 根据权利要求1所述的方法，其特征在于，若所述第一用户操作所述目标数据体的权限为允许所述第一用户在目标字段满足预设条件时操作所述目标数据体中的数据，则所述根据所述第一用户操作所述目标数据体的权限以及所述第一数据指令生成第二数据操作指令具体包括：
    在所述第一数据操作指令中增加执行条件获得所述第二数据操作指令；在所述执行条件中所述目标字段满足所述预设条件，所述第二数据操作指令用于指示允许所述第一用户在目标字段满足预设条件时操作所述目标数据体。
  5. 根据权利要求4所述的方法，其特征在于，所述执行所述第二数据操作指令，操作所述目标数据体中在目标范围内的数据具体包括：
    操作所述目标数据体中所述目标字段符合所述预设条件的Q行数据；所述Q为大于等于1的整数。
  6. 一种数据访问装置，其特征在于，包括：
    获取单元，用于获取第一数据操作指令，所述第一数据操作指令携带目标数据体的标识，所述第一数据操作指令是由第一用户触发的；
    查询单元，用于根据所述目标数据体的标识查询权限设置信息，确定所述第一用户操作所述目标数据体的权限；所述权限设置信息包括至少一个数据体的标识以及至少一 个用户操作所述至少一个数据体的权限，所述至少一个数据体包括所述目标数据体，所述至少一个用户包括所述第一用户；
    生成单元，用于根据所述第一用户操作所述目标数据体的权限以及所述第一数据操作指令生成第二数据操作指令；
    操作单元，执行所述第二数据操作指令，操作所述目标数据体中在目标范围内的数据；所述目标范围为所述第一用户操作所述目标数据体的权限所允许的范围。
  7. 根据权利要求6所述的数据访问装置，其特征在于，若所述第一用户操作所述目标数据的权限为禁止所述第一用户操作所述目标数据体中的至少一个目标字段，则所述生成单元具体用于，在所述第一数据操作指令中增加执行条件获得所述第二数据操作指令；在所述执行条件中，所述第一用户操作的目标字段对应的值为空值。
  8. 根据权利要求7所述的数据访问装置，其特征在于，所述操作单元具体用于，操作所述目标数据体中除所述目标字段外的其他字段下的N列数据，禁止操作所述目标数据体中所述目标字段下的M列数据；所述N为大于等于1的整数，所述M为大于等于1的整数。
  9. 根据权利要求6所述的数据访问装置，其特征在于，若所述第一用户操作所述目标数据体的权限为允许所述第一用户在目标字段满足预设条件时操作所述目标数据体中的数据，则所述生成单元具体用于，在所述第一数据操作指令中增加执行条件获得所述第二数据操作指令；在所述执行条件中所述目标字段满足所述预设条件，所述第二数据操作指令用于指示允许所述第一用户在目标字段满足预设条件时操作所述目标数据体。
  10. 根据权利要求9所述的数据访问装置，其特征在于，所述操作单元具体用于，操作所述目标数据体中所述目标字段符合所述预设条件的Q行数据；所述Q为大于等于1的整数。
PCT/CN2019/080813 2018-04-19 2019-04-01 一种数据访问的控制方法及数据库访问装置 WO2019201082A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19788730.0A EP3779721A4 (en) 2018-04-19 2019-04-01 METHODS FOR DATA ACCESS CONTROL AND DATABASE ACCESS DEVICE
US17/072,794 US11947700B2 (en) 2018-04-19 2020-10-16 Data access control method and database access apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810354338.5A CN108874863B (zh) 2018-04-19 2018-04-19 一种数据访问的控制方法及数据库访问装置
CN201810354338.5 2018-04-19

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/072,794 Continuation US11947700B2 (en) 2018-04-19 2020-10-16 Data access control method and database access apparatus

Publications (1)

Publication Number Publication Date
WO2019201082A1 true WO2019201082A1 (zh) 2019-10-24

Family

ID=64326866

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/080813 WO2019201082A1 (zh) 2018-04-19 2019-04-01 一种数据访问的控制方法及数据库访问装置

Country Status (4)

Country Link
US (1) US11947700B2 (zh)
EP (1) EP3779721A4 (zh)
CN (1) CN108874863B (zh)
WO (1) WO2019201082A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110895537A (zh) * 2019-11-29 2020-03-20 中国银行股份有限公司 自由查询权限控制的方法及装置
CN112214577A (zh) * 2020-09-27 2021-01-12 中国移动通信集团江苏有限公司 目标用户的确定方法、装置、设备及计算机存储介质
CN112486880A (zh) * 2020-12-17 2021-03-12 北京北信源软件股份有限公司 基于数据库存取接口的usb存储装置
CN112580094A (zh) * 2020-12-14 2021-03-30 京东数字科技控股股份有限公司 数据处理方法、电子设备以及存储介质

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108874863B (zh) * 2018-04-19 2022-03-25 华为技术有限公司 一种数据访问的控制方法及数据库访问装置
CN110413671A (zh) * 2019-06-28 2019-11-05 万翼科技有限公司 数据查询方法及装置
US20210026982A1 (en) * 2019-07-25 2021-01-28 Commvault Systems, Inc. Sensitive data extrapolation system
CN110427775B (zh) * 2019-07-25 2021-07-27 北京明略软件系统有限公司 数据查询权限控制方法及装置
CN110557282A (zh) * 2019-08-23 2019-12-10 北京浪潮数据技术有限公司 一种服务器运维管理方法、装置及设备
CN112597463A (zh) * 2020-12-31 2021-04-02 中国工商银行股份有限公司 数据库数据处理方法、装置及系统
US11514186B2 (en) * 2021-04-14 2022-11-29 Sap Se Integrated database user privilege management
CN113452683A (zh) * 2021-06-15 2021-09-28 郑州云智信安安全技术有限公司 一种数据库行列级权限控制的方法和系统
CN115174224B (zh) * 2022-07-06 2024-02-23 北京神州慧安科技有限公司 一种适用于工业控制网络的信息安全监测方法和装置
CN115659406B (zh) * 2022-12-09 2023-04-28 平安银行股份有限公司 一种数据访问方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106250782A (zh) * 2016-08-12 2016-12-21 天津西瑞尔信息工程有限公司 一种基于sql语句解析的数据权限控制方法及装置
CN106570406A (zh) * 2016-10-27 2017-04-19 深圳前海微众银行股份有限公司 数据级权限配置方法及装置
CN107239711A (zh) * 2016-03-29 2017-10-10 北京明略软件系统有限公司 一种数据库行权限控制方法和系统
CN108874863A (zh) * 2018-04-19 2018-11-23 华为技术有限公司 一种数据访问的控制方法及数据库访问装置

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3756397B2 (ja) * 2000-11-06 2006-03-15 日本電信電話株式会社 アクセス制御方法およびアクセス制御装置および記録媒体
US7240046B2 (en) * 2002-09-04 2007-07-03 International Business Machines Corporation Row-level security in a relational database management system
US7711750B1 (en) * 2004-02-11 2010-05-04 Microsoft Corporation Systems and methods that specify row level database security
CN100495422C (zh) * 2006-11-09 2009-06-03 华为技术有限公司 业务操作权限控制方法
US9002803B2 (en) * 2011-06-07 2015-04-07 Workday, Inc. Role-based security policy for an object-oriented database system
US9286475B2 (en) * 2012-02-21 2016-03-15 Xerox Corporation Systems and methods for enforcement of security profiles in multi-tenant database
US20140181134A1 (en) * 2012-12-21 2014-06-26 Marcel Hermanns Push-down of authority check within query engine
CN103065100B (zh) * 2012-12-26 2015-07-22 中国人民解放军总参谋部第六十一研究所 一种基于容器的用户私有数据保护方法
CN104683348B (zh) * 2015-03-13 2019-03-12 河南理工大学 一种基于属性的访问控制策略合成方法
CN107615277A (zh) * 2015-03-26 2018-01-19 卡斯维尔公司 用于查询数据源的系统和方法
US10127393B2 (en) * 2015-07-20 2018-11-13 The United States Of America, As Represented By The Secretary Of Commerce Next generation access control system and process for controlling database access
CN106469282A (zh) * 2015-08-21 2017-03-01 阿里巴巴集团控股有限公司 数据访问权限控制方法及装置
US10235531B2 (en) * 2016-07-05 2019-03-19 Sap Se Column protection
US10303894B2 (en) * 2016-08-31 2019-05-28 Oracle International Corporation Fine-grained access control for data manipulation language (DML) operations on relational data
CN107403106B (zh) * 2017-07-18 2020-06-02 北京计算机技术及应用研究所 基于终端用户的数据库细粒度访问控制方法
CN107503106A (zh) 2017-10-11 2017-12-22 苏州吉森智能科技有限公司 数控裁床的裁刀自动纠偏机构
US20190114341A1 (en) * 2017-10-12 2019-04-18 Sap Se Generic runtime protection for transactional data
US11188661B2 (en) * 2018-12-12 2021-11-30 Sap Se Semi-rule based high performance permission management
CN111523098A (zh) * 2020-04-15 2020-08-11 支付宝(杭州)信息技术有限公司 数据权限管理方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107239711A (zh) * 2016-03-29 2017-10-10 北京明略软件系统有限公司 一种数据库行权限控制方法和系统
CN106250782A (zh) * 2016-08-12 2016-12-21 天津西瑞尔信息工程有限公司 一种基于sql语句解析的数据权限控制方法及装置
CN106570406A (zh) * 2016-10-27 2017-04-19 深圳前海微众银行股份有限公司 数据级权限配置方法及装置
CN108874863A (zh) * 2018-04-19 2018-11-23 华为技术有限公司 一种数据访问的控制方法及数据库访问装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3779721A4

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110895537A (zh) * 2019-11-29 2020-03-20 中国银行股份有限公司 自由查询权限控制的方法及装置
CN112214577A (zh) * 2020-09-27 2021-01-12 中国移动通信集团江苏有限公司 目标用户的确定方法、装置、设备及计算机存储介质
CN112214577B (zh) * 2020-09-27 2024-04-09 中国移动通信集团江苏有限公司 目标用户的确定方法、装置、设备及计算机存储介质
CN112580094A (zh) * 2020-12-14 2021-03-30 京东数字科技控股股份有限公司 数据处理方法、电子设备以及存储介质
CN112580094B (zh) * 2020-12-14 2024-05-17 京东科技控股股份有限公司 数据处理方法、电子设备以及存储介质
CN112486880A (zh) * 2020-12-17 2021-03-12 北京北信源软件股份有限公司 基于数据库存取接口的usb存储装置
CN112486880B (zh) * 2020-12-17 2024-02-20 北京北信源软件股份有限公司 基于数据库存取接口的usb存储装置

Also Published As

Publication number Publication date
CN108874863B (zh) 2022-03-25
EP3779721A4 (en) 2021-04-28
EP3779721A1 (en) 2021-02-17
US11947700B2 (en) 2024-04-02
CN108874863A (zh) 2018-11-23
US20210034777A1 (en) 2021-02-04

Similar Documents

Publication Publication Date Title
WO2019201082A1 (zh) 一种数据访问的控制方法及数据库访问装置
US10965714B2 (en) Policy enforcement system
US10972506B2 (en) Policy enforcement for compute nodes
US10826878B2 (en) Database management system shared ledger support
US10367824B2 (en) Policy management, enforcement, and audit for data security
US11163904B2 (en) Fine-grained access control to datasets
US9288211B2 (en) Providing access control for public and private document fields
US9081978B1 (en) Storing tokenized information in untrusted environments
US11556666B2 (en) Data access policy management
Mukherjee Popular SQL server database encryption choices
TW202024984A (zh) 資料讀寫方法及裝置、電子設備
US20140130180A1 (en) Control of access to files
TW202025020A (zh) 基於區塊鏈的內容管理系統及方法、裝置、電子設備
US10657273B2 (en) Systems and methods for automatic and customizable data minimization of electronic data stores
Fotache et al. Framework for the Assessment of Data Masking Performance Penalties in SQL Database Servers. Case Study: Oracle
US12050717B1 (en) Method and system for mapping knowledge objects for data compliance
Gangwar et al. Database Security Measurements Issues in Adhoc Network
Torabian Protecting sensitive data using differential privacy and role-based access control
Jo et al. Safe & efficient privacy-policy enforcement on hadoop

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19788730

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019788730

Country of ref document: EP

Effective date: 20201026