WO2020238359A1 - 分区授权方法、装置、设备及计算机可读存储介质 - Google Patents

分区授权方法、装置、设备及计算机可读存储介质 Download PDF

Info

Publication number
WO2020238359A1
WO2020238359A1 PCT/CN2020/080558 CN2020080558W WO2020238359A1 WO 2020238359 A1 WO2020238359 A1 WO 2020238359A1 CN 2020080558 W CN2020080558 W CN 2020080558W WO 2020238359 A1 WO2020238359 A1 WO 2020238359A1
Authority
WO
WIPO (PCT)
Prior art keywords
partition
current user
target partition
path
target
Prior art date
Application number
PCT/CN2020/080558
Other languages
English (en)
French (fr)
Inventor
唐豪鸿
谢健
周可
林子康
邸帅
卢道和
Original Assignee
深圳前海微众银行股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳前海微众银行股份有限公司 filed Critical 深圳前海微众银行股份有限公司
Publication of WO2020238359A1 publication Critical patent/WO2020238359A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/25—Integrating or interfacing systems involving database management systems
    • G06F16/254—Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/903—Querying
    • G06F16/90335—Query processing
    • G06F16/90344—Query processing by using string matching techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/20—Natural language analysis
    • G06F40/205—Parsing
    • G06F40/211—Syntactic parsing, e.g. based on context-free grammar [CFG] or unification grammars
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/20—Natural language analysis
    • G06F40/253—Grammatical analysis; Style critique
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • This application relates to the field of big data technology of financial technology (Fintech), and in particular to a partition authorization method, device, device, and computer-readable storage medium.
  • Apache Ranger is a good solution. It can well support the centralized management of various components of the Hadoop ecosystem, and can also provide very fine-grained permission management, which can meet most of the daily security permission management needs. However, its support for Hive still has shortcomings, for example, it does not support partition permission control for partition tables.
  • the main purpose of this application is to provide a partition authorization method, device, equipment, and computer-readable storage medium, aiming to solve the technical problem that the prior art Ranger does not support permission control by partition.
  • this application provides a partition authorization method, which is applied to the Ranger terminal, and includes the following steps:
  • the Hive terminal is allowed to provide the current user with the data access service of the target partition.
  • the target partition path and the current user identifier are received by the Hive end of the access sentence input by the current user requesting access to the target partition, lexical analysis and grammatical analysis are performed on the access sentence to obtain a syntax tree, and then from the syntax tree Extract the target partition path and current user ID.
  • the method before the step of receiving the target partition path of the target partition that the current user requests to access and the current user identifier sent by the Hive terminal, the method further includes:
  • the step of verifying whether the current user has the data access authority of the target partition according to the target partition path, the current user identifier and the preset authentication strategy includes:
  • the partition path carried in the policy modification instruction is a character string containing wildcards, and when the policy modification instruction is received, the partition path carried in the policy modification instruction and the user mapped to the partition path are used.
  • the steps of identifying the modification of the preset authentication policy and saving the modified preset authentication policy include:
  • the step of verifying whether the current user has the data access authority of the target partition according to the target partition path, the current user identifier and a preset authentication strategy includes:
  • the current user has the data access authority of the target partition
  • the current user does not have the data access authority of the target partition.
  • the method before the step of receiving the target partition path of the target partition that the current user requests to access and the current user identifier sent by the Hive terminal, the method further includes:
  • the permission management table defines the scope to be performed Rights management object.
  • the step of allowing the Hive terminal to provide the current user with the data access service of the target partition includes:
  • the present application also provides a partition authorization device, the partition authorization device is applied to the Ranger end, and the partition authorization device includes:
  • the receiving module is used to receive the target partition path and current user identifier of the target partition that the current user requests to access sent by the Hive terminal;
  • a verification module configured to verify whether the current user has the data access authority of the target partition according to the target partition path, the current user identifier, and a preset authentication strategy
  • the access module is configured to allow the Hive terminal to provide the current user with the data access service of the target partition if the current user has the data access permission of the target partition.
  • the present application also provides a partition authorization device, the partition authorization device includes a memory, a processor, and a partition authorization program stored on the memory and running on the processor, so When the partition authorization program is executed by the processor, the steps of the partition authorization method described above are implemented.
  • the present application also provides a computer-readable storage medium having a partition authorization program stored on the computer-readable storage medium, and when the partition authorization program is executed by a processor, the partition as described above is realized. Steps of authorization method.
  • This application receives the target partition path and current user ID of the target partition that the current user requests to access sent by the Hive terminal; verifies whether the current user has the data access permission of the target partition according to the target partition path, current user ID and preset authentication strategy ; If the current user has the data access permission of the target partition, the Hive terminal is allowed to provide the current user with the data access service of the target partition.
  • This application adds a partition authentication strategy on the Ranger side and authorizes the data access services on the Hive side according to the partition authentication strategy. This realizes that different business users can only operate on the partitioned data related to their own business and achieve the purpose of data isolation. In turn, more fine-grained security authority management of financial infrastructure (distributed, cloud computing, blockchain, etc.) is realized.
  • Figure 1 is a schematic structural diagram of a device hardware operating environment involved in an embodiment of a partition authorized device solution of this application;
  • FIG. 2 is a schematic flowchart of the first embodiment of the partition authorization method of this application
  • Figure 3 is a schematic diagram of functional modules of the partition authorization device of the application.
  • the existing Apache Ranger can well support the centralized management of various components of the Hadoop ecosystem, and can also provide very fine-grained authority management, which can meet most of the daily security authority management requirements.
  • its support for Hive still has shortcomings, for example, it does not support partition permission control for partition tables.
  • FIG. 1 is a schematic structural diagram of a device hardware operating environment involved in a solution of an embodiment of a partition authorization device in this application.
  • the partition authorization device may include a processor 1001, such as a CPU, a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005.
  • the communication bus 1002 is used to implement connection and communication between these components.
  • the user interface 1003 may include a display screen (Display) and an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface.
  • the network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).
  • the memory 1005 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as a magnetic disk memory.
  • the memory 1005 may also be a storage device independent of the foregoing processor 1001.
  • the hardware structure of the partition authorization device shown in FIG. 1 does not constitute a limitation on the partition authorization device, and may include more or less components than shown in the figure, or a combination of certain components, or different The layout of the components.
  • the memory 1005 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a partition authorization program.
  • the operating system is a program that manages and controls partition authorized equipment and software resources, and supports the operation of network communication modules, user interface modules, partition authorization programs, and other programs or software; network communication modules are used to manage and control network interface 1004; users
  • the interface module is used to manage and control the user interface 1003.
  • the network interface 1004 is mainly used to connect to the back-end server and communicate with the back-end server;
  • the user interface 1003 is mainly used to connect to the client (user side) and communicate with the client.
  • the processor 1001 can call the partition authorization program stored in the memory 1005 and perform the following operations:
  • the Hive terminal is allowed to provide the current user with the data access service of the target partition.
  • the target partition path and the current user identifier are received by the Hive end of the access sentence input by the current user requesting access to the target partition, lexical analysis and grammatical analysis are performed on the access sentence to obtain a syntax tree, and then from the syntax tree Extract the target partition path and current user ID.
  • the processor 1001 is further configured to call the partition authorization program stored in the memory 1005 and perform the following operations :
  • the step of verifying whether the current user has the data access authority of the target partition according to the target partition path, the current user identifier and the preset authentication strategy includes:
  • the partition path carried in the policy modification instruction is a character string containing wildcards, and when the policy modification instruction is received, the partition path carried in the policy modification instruction and the user identifier mapped to the partition path are used.
  • the steps of modifying the preset authentication policy and saving the modified preset authentication policy include:
  • the step of verifying whether the current user has the data access authority of the target partition according to the target partition path, the current user identifier and the preset authentication strategy includes:
  • the current user has the data access authority of the target partition
  • the current user does not have the data access authority of the target partition.
  • the processor 1001 is further configured to call the partition authorization program stored in the memory 1005 and perform the following operations :
  • the permission management table defines the scope to be performed Rights management object.
  • the step of allowing the Hive terminal to provide the current user with the data access service of the target partition includes:
  • partition authorization device of this application is basically the same as the following embodiments of the partition authorization method, and will not be repeated here.
  • This application also provides a partition authorization method.
  • Hadoop is an open source software framework capable of distributed processing of large amounts of data. .
  • Apache Ranger Provides a centralized security management framework and solves authorization and auditing. It can perform fine-grained data on the components of the Hadoop ecosystem such as HDFS, Yarn (resource management system), Hive, Hbase (distributed column storage database), etc. Access control. By controlling the Ranger console, administrators can easily control user access rights by configuring policies.
  • Hive A Hadoop-based data warehouse tool that can map structured data files to a database table and provide a complete SQL (Structured Query Language) query function, which can convert SQL statements into MapReduce Tasks are run. Hive is based on a data warehouse and provides dynamic query of static data. It uses SQL-like language. The bottom layer is compiled into a MapReduce program, which runs on Hadoop, and the data is stored on HDFS (Distributed File System).
  • SQL Structured Query Language
  • the embodiment of the present application provides an embodiment of the partition authorization method. It should be noted that although the logical sequence is shown in the flowchart, in some cases, the sequence shown here can be executed in a different order. Steps out or described.
  • FIG. 2 is a schematic flow chart of the first embodiment of a partition authorization method according to this application.
  • the partition authorization method is applied to the Ranger side, and the partition authorization method includes:
  • Step S10 receiving the target partition path of the target partition that the current user requests to access and the current user identifier sent by the Hive terminal;
  • Apache Ranger can well support the centralized management of various components of the Hadoop ecosystem, and can also provide very fine-grained permission management, which can meet most of the daily security permission management needs. However, it does not support partition permission control for Hive, and cannot meet the needs of multi-level partition permission management.
  • this embodiment further includes before step S10: modifying the metadata table of Ranger to add a partition type item to the permission management type.
  • the administrator can add the Hive Partition type of the data warehouse tool partition to the permission management table x_resource_def table in the metadata of the Ranger by operating the Ranger side.
  • the x_resource_def table defines the object Resource that needs permission management in the Ranger, such as a certain database, a certain One table, one column.
  • the Ranger terminal modifies the preset authentication strategy according to the partition path carried in the strategy modification instruction and the user identifier mapped to the partition path, and saves the modified preset authentication strategy.
  • the Ranger terminal modifies the x_policy_resource_map table according to the partition path carried in the policy modification instruction and the user identifier mapped to the partition path.
  • the x_policy_resource_map table stores the preset authentication strategy, so The preset authentication strategy includes a partition path and a mapped user identifier with the authority to access the partition.
  • the table can also store authentication strategies for other types of rights management objects (libraries, tables, columns). The specific circumstances are not limited in this embodiment. You can refer to the prior art about Ranger authorization strategies. This embodiment does not Repeat it again.
  • the user can initiate an access request to the target partition through the Hive side.
  • the access request is issued in the form of an access statement, and the Hive side receives the user input request to access the target partition
  • the access sentence is parsed to obtain a syntax tree containing the target partition path and the current user ID, and the target partition path and the current user ID are sent to the Ranger side for the Ranger side to obtain the access sentence The target partition path and current user ID carried.
  • each partition corresponds to a unique access path, that is, the partition path.
  • Step S20 verifying whether the current user has the data access authority of the target partition according to the target partition path, the current user identifier, and the preset authentication strategy;
  • the data access authority of the current user needs to be verified. Specifically, according to the target partition path and the preset authentication strategy, obtain the user identifier mapped to the target partition path; determine whether the user identifier mapped to the target partition path is consistent with the current user identifier; If the user ID mapped to the target partition path is consistent with the current user ID, the current user has the data access authority of the target partition; if the user ID mapped to the target partition path is the same as the current user If the identifiers are inconsistent, the current user does not have the data access authority of the target partition.
  • Step S30 If the current user has the data access authority of the target partition, the Hive terminal is allowed to provide the current user with the data access service of the target partition.
  • the Hive terminal is allowed to provide the current user with the data access service of the target partition.
  • the Ranger terminal determines that the salesperson has the data access permission of the partition data of product A according to the preset authentication strategy, and the Ranger terminal uses Hive The end provides the salesman with the data access service of the partition data of the A product.
  • the Hive terminal by receiving the target partition path of the target partition that the current user requests to access and the current user ID sent by the Hive terminal; according to the target partition path, the current user ID and the preset authentication strategy, it is verified whether the current user has all the information.
  • the data access authority of the target partition if the current user has the data access authority of the target partition, the Hive terminal is allowed to provide the current user with the data access service of the target partition.
  • Step S101 upon receiving the permission object addition instruction, add the data warehouse tool partition type to the permission management table in the metadata of Ranger, so that the user can input the target partition path through the Hive terminal.
  • the permission management table defines the Ranger The object to be managed in authority.
  • the Ranger metadata table upon receiving the permission object addition instruction initiated by the administrator, is modified to add a partition type item to the permission management type.
  • the administrator can operate the Ranger terminal, Add the partition type of the data warehouse tool, namely the Hive Partition type, to the permission management table x_resource_def table in Ranger's metadata.
  • the x_resource_def table defines the Resource that needs to be managed in Ranger, such as a certain database, a certain table, and a certain column.
  • the method further includes:
  • Step S11 When the policy modification instruction is received, modify the preset authentication strategy according to the partition path carried in the policy modification instruction and the user identifier mapped to the partition path, and save the modified preset authentication strategy ;
  • the step S20 includes:
  • the target partition path and the modified preset authentication strategy obtain the user identifier mapped to the target partition path; determine whether the user identifier mapped to the target partition path is the same as the current user identifier Consistent; if the user ID mapped to the target partition path is consistent with the current user ID, then the current user has the data access authority of the target partition; if the user ID mapped to the target partition path is the same as If the current user IDs are inconsistent, the current user does not have the data access authority of the target partition.
  • step S10 it also includes modifying the metadata table of the Ranger to add a partition type item in the permission management type.
  • the administrator can operate the Ranger console and display the metadata in the Ranger metadata table.
  • the x_resource_def table defines the Resource that needs to be managed in Ranger, such as a certain database, a certain table, and a certain column.
  • the Ranger terminal modifies the preset authentication strategy according to the partition path carried in the strategy modification instruction and the user identifier mapped to the partition path, and saves the modified preset authentication strategy.
  • the Ranger terminal modifies the x_policy_resource_map table according to the partition path carried in the policy modification instruction and the user identifier mapped to the partition path.
  • the x_policy_resource_map table stores the preset authentication strategy, so The preset authentication strategy includes a partition path and a mapped user identifier with the authority to access the partition.
  • the table can also store authentication strategies for other types of rights management objects (libraries, tables, columns). The specific circumstances are not limited in this embodiment. You can refer to the prior art about Ranger authorization strategies. This embodiment does not Repeat it again.
  • the partition path carried by the policy modification instruction is a character string containing wildcard characters, and the above step S11 includes:
  • the administrator needs to enter the partition path and the corresponding user ID when setting the authentication policy, but sometimes the administrator may need to set a series of partition path permissions containing the same character string. If the partition path efficiency is entered one by one Lower.
  • the Ranger terminal searches based on the above-mentioned string containing wildcard characters to obtain all corresponding partition paths, and will modify the preset authentication according to these partition paths and user IDs. Policy, and save the modified preset authentication policy. For example, if the administrator wants to find the partition path starting with fintech, he can enter fintech* to find all partition paths starting with fintech.
  • the Ranger side retrieves all the corresponding partition paths according to the above-mentioned string containing wildcards, it can feedback these partition paths to the administrator for selection, and then modify the preset according to the partition path selected by the administrator and the user ID. Set the authentication strategy, and save the modified preset authentication strategy.
  • the user can also use wildcards to enter the partition path.
  • the target partition path and the current user identifier are received by the Hive end of the access sentence input by the current user requesting access to the target partition, lexical analysis and grammatical analysis are performed on the access sentence to obtain a syntax tree, and then from the syntax tree Extract the target partition path and current user ID.
  • the user can initiate an access request to the target partition through the Hive side.
  • the access request is issued in the form of an access statement.
  • the Hive side receives the user input request to access the target When partitioning the access sentence, perform lexical analysis and grammatical analysis on the access sentence to obtain a syntax tree.
  • the syntax tree is a tree representation of the syntax structure of the source code of the access sentence.
  • Each node on the syntax tree represents The grammatical structure contained in the access sentence is extracted from the nodes in the grammar tree to obtain the target partition path and the current user ID, and the target partition path and the current user ID are sent to the Ranger terminal for use by Ranger The terminal obtains the target partition path and the current user identifier carried by the access statement.
  • the user can send the access statement to the relevant partition to the Hive side through the following two methods, one is the beeline command line tool, and the other is to establish a JDBC (Java Database Connectivity, java database connection) link through the application. choose one of the two methods.
  • JDBC Java Database Connectivity, java database connection
  • step S20 further includes:
  • the access request is rejected, and an alarm prompt is sent to the Hive end.
  • authentication policies are configured for different partitions, thereby achieving more fine-grained security authority management.
  • step S20 includes:
  • Step S21 Obtain a user identifier mapped to the target partition path according to the target partition path and a preset authentication strategy
  • the data access authority of the current user needs to be verified according to the target partition path, the current user ID, and a preset authentication strategy.
  • the preset authentication strategy includes the partition path and the user ID mapped to it with the authority to access the partition, after the target partition path is obtained, it can be obtained from the preset authentication strategy according to the target partition path The mapped user ID with the authority to access the partition.
  • step S21 it may further include: judging whether the target partition path has a preset authentication strategy mapped to it; if the target partition path does not have a preset authentication strategy mapped to it, description
  • the target partition provides data access services for all users, that is, all users have the data access authority of the target partition; if the target partition path has a preset authentication strategy mapped to it, step S22 is executed.
  • Step S22 Determine whether the user ID mapped to the target partition path is consistent with the current user ID
  • Step S23 If the user ID mapped to the target partition path is consistent with the current user ID, then the current user has the data access authority of the target partition;
  • Step S24 If the user ID mapped to the target partition path is inconsistent with the current user ID, the current user does not have the data access authority of the target partition.
  • whether the user identifier mapped to the target partition path is consistent with the current user identifier is judged whether the current user has Data access permissions of the target partition. Specifically, if the user ID mapped to the target partition path is consistent with the current user ID, it is determined that the current user has the data access permission of the target partition; if the user ID mapped to the target partition path is inconsistent with the current user ID, the current user Does not have data access permissions for the target partition.
  • step S30 includes:
  • Step S31 If the current user has the data access authority of the target partition, obtain the registration time of the user ID;
  • the user in order to improve the granularity of the partition authorized access, the user cannot access the historical data before the user registration time, thereby reducing the risk of data leakage. Specifically, if it is determined that the current user has the data access authority of the target partition, the registration time of the user ID is obtained.
  • Step S32 Provide the current user with a data access service for the data updated by the target partition after the registration time through the Hive terminal.
  • the Hive terminal After obtaining the registration time of the user ID, the Hive terminal provides the current user with a data access service for the data updated in the target partition after the registration time. For example, if the current user requests to access the partition data of the A product, if the current user has the data access permission for the partition data of the A product, and the registration time of the current user is obtained at 15:00 on May 1, 2019, the Ranger end passes The Hive end provides current users with data access services for the updated data of product partition A after 15:00 on May 1, 2019. The data of product partition A before 15:00 on May 1, 2019 will not provide data to current users. Access to the service realizes that new users can only see the latest data and cannot access historical data, thereby reducing the risk of data leakage and realizing more fine-grained security authority management.
  • step S30 it further includes:
  • Step S33 Record the operation log of the current user on the Hive end for the operation and maintenance personnel to conduct a security audit.
  • the Ranger terminal will record the operation log of the current user on the Hive terminal for the operation and maintenance personnel to conduct security audits.
  • Auditing is a mechanism for recording user activities in the database. It is the monitoring and recording of selected user actions. It can not only record who has accessed the database, but also record what operations the visitor has performed on the database. After the operation and maintenance personnel discover that the data may be illegally operated, they can audit all the connections and operations of the database through the operation log, so that the source of the illegal user, the terminal used, and the session time can be found.
  • the data access services on the Hive side are partitioned and authorized according to the partition authentication strategy, which realizes that different business users can only operate on the partition data related to their own business.
  • the purpose of isolation also by providing users with data access services for the data of the target partition updated after the registration time, it is realized that different business users can only operate the partition data related to their own business, and new users can only see the latest data , Can not access historical data, thereby reducing the risk of data leakage, achieving more fine-grained security authority management, and more in line with the actual needs of banks and other financial institutions.
  • the application also provides a partition authorization device.
  • Fig. 3 is a schematic diagram of the functional modules of the first embodiment of the partition authorization device according to the application.
  • the partition authorization device is applied to the Ranger terminal, and the partition authorization device includes:
  • the receiving module 10 is configured to receive the target partition path and the current user identifier of the target partition that the current user requests to access sent by the Hive terminal;
  • the verification module 20 is configured to verify whether the current user has the data access authority of the target partition according to the target partition path, the current user identifier, and a preset authentication strategy;
  • the access module 30 is configured to allow the Hive terminal to provide the current user with the data access service of the target partition if the current user has the data access permission of the target partition.
  • the receiving module is also used for:
  • the target partition path and current user identifier are sent by the Hive terminal to receive the access statement input by the current user requesting access to the target partition.
  • the access sentence is subjected to lexical analysis and grammatical analysis to obtain a syntax tree, and then the target partition path and the current user identifier are extracted from the syntax tree.
  • partition authorization device further includes:
  • the saving module is used to modify the preset authentication strategy according to the partition path carried in the strategy modification instruction and the user identifier mapped to the partition path when the strategy modification instruction is received, and to authenticate the modified preset authentication strategy Strategy preservation;
  • the verification module is further configured to verify whether the current user has the data access authority of the target partition according to the target partition path, the current user identification, and the modified preset authentication strategy.
  • saving module is also used for:
  • verification module is also used for:
  • the current user has the data access authority of the target partition
  • the current user does not have the data access authority of the target partition.
  • partition authorization device further includes:
  • the add module is used to add the data warehouse tool partition type to the authorization management table in the metadata of the Ranger when receiving the authorization object addition instruction, so that the user can enter the target partition path through the Hive terminal.
  • the authorization management table defines Objects to be managed in Ranger.
  • the access module is also used for:
  • partition authorization device of this application is basically the same as the above embodiments of the partition authorization method, and will not be repeated here.
  • the embodiment of the present application also proposes a computer-readable storage medium.
  • the computer-readable storage medium stores a partition authorization program, and the partition authorization program implements the steps of the partition authorization method described above when the partition authorization program is executed by the processor.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Computational Linguistics (AREA)
  • Computer Security & Cryptography (AREA)
  • Bioethics (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Data Mining & Analysis (AREA)
  • Audiology, Speech & Language Pathology (AREA)
  • Business, Economics & Management (AREA)
  • Artificial Intelligence (AREA)
  • Economics (AREA)
  • Development Economics (AREA)
  • Finance (AREA)
  • Marketing (AREA)
  • Strategic Management (AREA)
  • Technology Law (AREA)
  • General Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Medical Informatics (AREA)
  • Storage Device Security (AREA)

Abstract

本申请涉及金融科技的大数据领域，并公开了一种分区授权方法、装置、设备及计算机可读存储介质，该方法包括以下步骤：接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；根据目标分区路径、当前用户标识和预设鉴权策略验证当前用户是否具有目标分区的数据访问权限；若当前用户具有目标分区的数据访问权限，则允许Hive端向当前用户提供目标分区的数据访问服务。本申请通过Ranger端的分区鉴权策略对Hive端的数据访问服务进行分区授权，实现了不同业务用户只能操作与自己业务相关的分区数据，进而实现了金融基础设施（分布式、云计算、区块链等）的更细粒度的安全权限管理。

Description

分区授权方法、装置、设备及计算机可读存储介质
本申请要求于2019年5月27日提交中国专利局、申请号为201910459668.5、发明名称为“分区授权方法、装置、设备及计算机可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在申请中。
技术领域
本申请涉及金融科技(Fintech)的大数据技术领域，尤其涉及一种分区授权方法、装置、设备及计算机可读存储介质。
背景技术
随着计算机技术的发展，越来越多的技术(大数据、分布式、区块链Blockchain、人工智能等)应用在金融领域，传统金融业正在逐步向金融科技(Fintech)转变，但由于金融行业的安全性、实时性要求，也对技术提出了更高的要求。
对于大数据平台安全管理而言，随着数据量的增长，用户的增加，业务越来越复杂，一种集中式和细粒度权限控制方法也是日益重要。Apache Ranger就是一个很好的解决方案，它能很好地支持Hadoop生态圈各组件的集中式管理，还能提供非常细粒度的权限管理，能满足日常大部分的安全权限管理需求。但其对Hive的支持还是存在缺陷，例如不支持对分区表的分区权限控制。
发明概述
技术问题
问题的解决方案
技术解决方案
本申请的主要目的在于提供一种分区授权方法、装置、设备及计算机可读存储介质，旨在解决现有技术Ranger不支持按分区进行权限控制的技术问题。
为实现上述目的，本申请提供一种分区授权方法，所述分区授权方法应用于Ranger端，所述分区授权方法包括以下步骤：
接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；
根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限；
若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务。
可选地，所述目标分区路径和当前用户标识由Hive端接收当前用户输入的请求访问目标分区的访问语句，对所述访问语句进行词法解析和语法解析得到语法树，再从所述语法树中提取得到目标分区路径和当前用户标识。
可选地，所述接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识的步骤之前，还包括：
在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存；
所述根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限的步骤包括：
根据所述目标分区路径、当前用户标识和修改后的预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限。
可选地，所述策略修改指令携带的分区路径为含有通配符的字符串，所述在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存的步骤包括：
在接收到策略修改指令时，检索与所述含有通配符的字符串相对应的所有分区路径；
根据所述与所述含有通配符的字符串相对应的所有分区路径，和所述策略修改指令携带的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。
可选地，所述根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限的步骤包括：
根据所述目标分区路径和预设鉴权策略获取与所述目标分区路径相映射的用户标识；
判断与所述目标分区路径相映射的用户标识与所述当前用户标识是否一致；
若与所述目标分区路径相映射的用户标识与所述当前用户标识一致，则所述当前用户具有所述目标分区的数据访问权限；
若与所述目标分区路径相映射的用户标识与所述当前用户标识不一致，则所述当前用户不具有所述目标分区的数据访问权限。
可选地，所述接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识的步骤之前，还包括：
在接收到权限对象添加指令时，在Ranger的元数据中的权限管理表中添加数据仓库工具分区类型，以使用户能够通过Hive端输入目标分区路径，所述权限管理表定义了Ranger中待进行权限管理的对象。
可选地，所述若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务的步骤包括：
若所述当前用户具有所述目标分区的数据访问权限，获取所述用户标识的注册时间；
通过所述Hive端向所述当前用户提供所述目标分区在所述注册时间以后更新的数据的数据访问服务。
进一步地，为实现上述目的，本申请还提供一种分区授权装置，所述分区授权装置应用于Ranger端，所述分区授权装置包括：
接收模块，用于接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；
验证模块，用于根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限；
访问模块，用于若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务。
进一步地，为实现上述目的，本申请还提供一种分区授权设备，所述分区授权设备包括存储器、处理器以及存储在所述存储器上并可在所述处理器上运行的分区授权程序，所述分区授权程序被所述处理器执行时实现如上述所述的分区授权方法的步骤。
进一步地，为实现上述目的，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质上存储有分区授权程序，所述分区授权程序被处理器执行时实现如上所述的分区授权方法的步骤。
本申请通过接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；根据目标分区路径、当前用户标识和预设鉴权策略验证当前用户是否具有目标分区的数据访问权限；若当前用户具有目标分区的数据访问权限，则允许Hive端向当前用户提供目标分区的数据访问服务。本申请通过在Ranger端增加分区鉴权策略，根据分区鉴权策略对Hive端的数据访问服务进行分区授权，实现了不同业务用户只能操作与自己业务相关的分区数据，达到了数据隔离的目的，进而实现了金融基础设施(分布式、云计算、区块链等)的更细粒度的安全权限管理。
发明的有益效果
对附图的简要说明
附图说明
图1为本申请分区授权设备实施例方案涉及的设备硬件运行环境的结构示意图；
图2为本申请分区授权方法第一实施例的流程示意图；
图3为本申请分区授权装置的功能模块示意图。
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
发明实施例
本发明的实施方式
应当理解，此处所描述的具体实施例仅用以解释本申请，并不用于限定本申请。
需要说明的是，现有的Apache Ranger能很好地支持Hadoop生态圈各组件的集中式管理，还能提供非常细粒度的权限管理，能满足日常大部分的安全权限管理需求。但其对Hive的支持还是存在缺陷，例如不支持对分区表的分区权限控制。
基于上述缺陷，本申请提供一种分区授权设备，参照图1，图1为本申请分区授权设备实施例方案涉及的设备硬件运行环境的结构示意图。
如图1所示，该分区授权设备可以包括：处理器1001，例如CPU，通信总线1002、用户接口1003，网络接口1004，存储器1005。其中，通信总线1002用于实现这些组件之间的连接通信。用户接口1003可以包括显示屏(Display)、输入单元比如键盘(Keyboard)，可选用户接口1003还可以包括标准的有线接口、无线接口。网络接口1004可选的可以包括标准的有线接口、无线接口(如WI-FI接口)。存储器1005可以是高速RAM存储器，也可以是稳定的存储器(non-volatile memory)，例如磁盘存储器。存储器1005可选的还可以是独立于前述处理器1001的存储设备。
本领域技术人员可以理解，图1中示出的分区授权设备的硬件结构并不构成对分区授权设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
如图1所示，作为一种计算机可读存储介质的存储器1005中可以包括操作系统、网络通信模块、用户接口模块以及分区授权程序。其中，操作系统是管理和控制分区授权设备与软件资源的程序，支持网络通信模块、用户接口模块、分区授权程序以及其他程序或软件的运行；网络通信模块用于管理和控制网络接口1004；用户接口模块用于管理和控制用户接口1003。
在图1所示的分区授权设备硬件结构中，网络接口1004主要用于连接后台服务器，与后台服务器进行数据通信；用户接口1003主要用于连接客户端(用户端)，与客户端进行数据通信；处理器1001可以调用存储器1005中存储的分区授权程序，并执行以下操作：
接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；
根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限；
若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务。
进一步地，所述目标分区路径和当前用户标识由Hive端接收当前用户输入的请求访问目标分区的访问语句，对所述访问语句进行词法解析和语法解析得到语法树，再从所述语法树中提取得到目标分区路径和当前用户标识。
进一步地，所述接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识的步骤之前，处理器1001还用于调用存储器1005中存储的分区授权程序，并执行以下操作：
在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存；
所述根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限的步骤包括：
根据所述目标分区路径、当前用户标识和修改后的预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限。
进一步地，所述策略修改指令携带的分区路径为含有通配符的字符串，所述在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存的步骤包括：
在接收到策略修改指令时，检索与所述含有通配符的字符串相对应的所有分区路径；
根据所述与所述含有通配符的字符串相对应的所有分区路径，和所述策略修改指令携带的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。
进一步地，所述根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限的步骤包括：
根据所述目标分区路径和预设鉴权策略获取与所述目标分区路径相映射的用户标识；
判断与所述目标分区路径相映射的用户标识与所述当前用户标识是否一致；
若与所述目标分区路径相映射的用户标识与所述当前用户标识一致，则所述当前用户具有所述目标分区的数据访问权限；
若与所述目标分区路径相映射的用户标识与所述当前用户标识不一致，则所述当前用户不具有所述目标分区的数据访问权限。
进一步地，所述接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识的步骤之前，处理器1001还用于调用存储器1005中存储的分区授权程序，并执行以下操作：
在接收到权限对象添加指令时，在Ranger的元数据中的权限管理表中添加数据仓库工具分区类型，以使用户能够通过Hive端输入目标分区路径，所述权限管理表定义了Ranger中待进行权限管理的对象。
进一步地，所述若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务的步骤包括：
若所述当前用户具有所述目标分区的数据访问权限，获取所述用户标识的注册时间；
通过所述Hive端向所述当前用户提供所述目标分区在所述注册时间以后更新的数据的数据访问服务。
本申请分区授权设备的具体实施方式与下述分区授权方法各实施例基本相同，在此不再赘述。
本申请还提供一种分区授权方法。
Hadoop：是一个能够对大量数据进行分布式处理的开源软件框架。。
Apache Ranger：提供一个集中式安全管理框架，并解决授权和审计，它可以对Hadoop生态的组件如HDFS、Yarn(资源管理系统)、Hive、Hbase(分布式列存数据库)等进行细粒度的数据访问控制。通过控制Ranger控制台，管理员可以轻松的通过配置策略来控制用户访问权限。
Hive：一种基于Hadoop的数据仓库工具，可以将结构化的数据文件映射为一张数据库表，并提供完整的SQL(Structured Query Language，结构化查询语言)查询功能，可以将sql语句转换为MapReduce任务进行运行，Hive基于数据仓库，提供静态数据的动态查询，其使用类SQL语言，底层经过编译转为MapReduce程序，在Hadoop上运行，数据存储在HDFS(分布式文件系统)上。
由于现有大数据的安全权限管理方式，可对各个组件进行权限访问控制的管理，也可以对访问场景的权限控制管理，但是这些权限管理控制的方式，在细化粒度中还比较片面，远不符合银行机构等金融机构的实际需求。银行机构等金融机构对权限控制管理更加严格。
基于此，本申请实施例提供了分区授权方法的实施例，需要说明的是，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
在分区授权方法的各个实施例中，为了便于描述，省略执行主体进行阐述各个实施例。参照图2，图2为本申请分区授权方法第一实施例的流程示意图，所述分区授权方法应用于Ranger端，所述分区授权方法包括：
步骤S10，接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；
Apache Ranger能很好地支持Hadoop生态圈各组件的集中式管理，还能提供非常细粒度的权限管理，能满足日常大部分的安全权限管理需求。但其对Hive不支持分区权限控制，不能满足多级分区权限管理的需求。
为解决现有技术Ranger不支持按分区进行权限控制的技术问题，本实施例在步骤S10之前还包括：对Ranger的元数据表进行修改以在权限管理类型中新增分区类型项，具体地，管理员可以通过操作Ranger端，在Ranger的元数据中的权限管理表x_resource_def表中添加数据仓库工具分区Hive Partition类型，x_resource_def表定义了Ranger中需要进行权限管理的对象Resource，例如某一个数据库、某一张表、某一列。
然后，对Ranger端鉴权策略进行修改。在接收到策略修改指令时，Ranger端根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。具体地，在接收到策略修改指令时，Ranger端根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改x_policy_resource_map表，x_policy_resource_map表中存储有预设鉴权策略，所述预设鉴权策略包括分区路径和与其相映射的具有访问该分区权限的用户标识。此外，该表中还可存储有其他类型权限管理对象(库、表 、列)的鉴权策略，具体情况本实施例不做限制，可参见关于Ranger授权策略的现有技术，本实施例不再赘述。
在本实施例中，在对Ranger端的鉴权策略修改完成后，用户可通过Hive端发起对目标分区的访问请求，访问请求以访问语句的形式发出，Hive端接收到用户输入的请求访问目标分区的访问语句时，对该访问语句进行语法分析得到包含目标分区路径和当前用户标识的语法树，并将所述目标分区路径和当前用户标识发送给Ranger端，以供Ranger端获取所述访问语句携带的目标分区路径和当前用户标识。
其中，在运维人员根据产品标识、业务标识或其他分区规则为Hive端的数据划分分区后，每个分区都对应有唯一的访问路径，即分区路径。
步骤S20，根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限；
在本实施例中，在获取到目标分区路径和当前用户标识后，需对当前用户的数据访问权限进行验证。具体地，根据所目标分区路径和预设鉴权策略获取与所述目标分区路径相映射的用户标识；判断与所述目标分区路径相映射的用户标识与所述当前用户标识是否一致；若与所述目标分区路径相映射的用户标识与所述当前用户标识一致，则所述当前用户具有所述目标分区的数据访问权限；若与所述目标分区路径相映射的用户标识与所述当前用户标识不一致，则所述当前用户不具有所述目标分区的数据访问权限。
步骤S30，若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务。
在本实施例中，若Ranger端判定当前用户具有目标分区的数据访问权限，则允许Hive端向当前用户提供目标分区的数据访问服务。
例如，在银行等金融机构中，若业务员通过Hive端请求访问A产品的分区数据，Ranger端根据预设鉴权策略判定业务员具有A产品的分区数据的数据访问权限，则Ranger端通过Hive端向该业务员提供A产品的分区数据的数据访问服务。
本实施例通过接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；根据所述目标分区路径、当前用户标识和预设鉴权策略验 证所述当前用户是否具有所述目标分区的数据访问权限；若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务。通过在Ranger端增加分区鉴权策略，根据分区鉴权策略对Hive端的数据访问服务进行分区授权，实现了不同业务用户只能操作与自己业务相关的分区数据，达到了数据隔离的目的，进而实现了更细粒度的安全权限管理，更加符合银行等金融机构的实际需求。
进一步地，提出本申请分区授权方法第二实施例，上述步骤S10之前还包括：
步骤S101，在接收到权限对象添加指令时，在Ranger的元数据中的权限管理表中添加数据仓库工具分区类型，以使用户能够通过Hive端输入目标分区路径，所述权限管理表定义了Ranger中待进行权限管理的对象。
在本实施例中，在接收到管理员发起的权限对象添加指令时，对Ranger的元数据表进行修改以在权限管理类型中新增分区类型项，具体地，管理员可以通过操作Ranger端，在Ranger的元数据中的权限管理表x_resource_def表中添加数据仓库工具分区类型，即Hive Partition类型。其中，x_resource_def表定义了Ranger中需要进行权限管理的对象Resource，例如某一个数据库、某一张表、某一列。
进一步地，上述步骤S10之前还包括：
步骤S11，在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存；
所述步骤S20包括：
根据所述目标分区路径、当前用户标识和修改后的预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限。
具体地，根据所述目标分区路径和修改后的预设鉴权策略获取与所述目标分区路径相映射的用户标识；判断与所述目标分区路径相映射的用户标识与所述当前用户标识是否一致；若与所述目标分区路径相映射的用户标识与所述当前用户标识一致，则所述当前用户具有所述目标分区的数据访问权限；若与所述目标分区路径相映射的用户标识与所述当前用户标识不一致，则所述当前用户不具有所述目标分区的数据访问权限。
在本实施例中，在步骤S10之前还包括对Ranger的元数据表进行修改以在权限管理类型中新增分区类型项，具体地，管理员可以通过操作Ranger控制台，在Ranger的元数据中的x_resource_def表中添加Hive Partition类型，x_resource_def表定义了Ranger中需要进行权限管理的对象Resource，例如某一个数据库、某一张表、某一列。
然后，对Ranger端鉴权策略进行修改。在接收到策略修改指令时，Ranger端根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。具体地，在接收到策略修改指令时，Ranger端根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改x_policy_resource_map表，x_policy_resource_map表中存储有预设鉴权策略，所述预设鉴权策略包括分区路径和与其相映射的具有访问该分区权限的用户标识。此外，该表中还可存储有其他类型权限管理对象(库、表、列)的鉴权策略，具体情况本实施例不做限制，可参见关于Ranger授权策略的现有技术，本实施例不再赘述。
进一步地，所述策略修改指令携带的分区路径为含有通配符的字符串，上述步骤S11包括：
在接收到策略修改指令时，检索与所述含有通配符的字符串相对应的所有分区路径；
根据所述与所述含有通配符的字符串相对应的所有分区路径，和所述策略修改指令携带的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。
在本实施例中，管理员在设置鉴权策略时，需输入分区路径和对应的用户标识，但有时管理员可能需要设置一系列包含相同字符串的分区路径的权限，若是逐个输入分区路径效率较低。而通过输入含有通配符的字符串，在接收到策略修改指令时，Ranger端根据上述含有通配符的字符串检索以获取相对应的所有分区路径，并将根据这些分区路径和用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。例如，管理员想要查找以fintech开头的分区路径，可以输入fintech*查找以fintech开头的所有分区路径。
进一步地，Ranger端根据上述含有通配符的字符串检索获取到相对应的所有分 区路径后，可将这些分区路径反馈给管理员，以供选择，再根据管理员选择的分区路径与用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。
进一步地，若用户不知道目标分区路径的真正字符或者不想键入完整路径时，用户也可采用通配符的方式输入分区路径。
进一步地，再根据目标分区路径、当前用户标识、和修改后的预设鉴权策略验证当前用户是否具有目标分区的数据访问权限。
进一步地，所述目标分区路径和当前用户标识由Hive端接收当前用户输入的请求访问目标分区的访问语句，对所述访问语句进行词法解析和语法解析得到语法树，再从所述语法树中提取得到目标分区路径和当前用户标识。
在本实施例中，在对Ranger端的鉴权策略修改完成后，用户可通过Hive端发起对目标分区的访问请求，访问请求以访问语句的形式发出，Hive端在接收到用户输入的请求访问目标分区的访问语句时，对该访问语句进行词法解析和语法解析得到语法树，语法树是所述访问语句的源代码的语法结构的树状表现形式，所述语法树上的每个节点表示所述访问语句中包含的一种语法结构，再从所述语法树中的节点上提取得到目标分区路径和当前用户标识，并将所述目标分区路径和当前用户标识发送给Ranger端，以供Ranger端获取所述访问语句携带的目标分区路径和当前用户标识。
进一步地，用户可通过下面两种方法向Hive端发送对相关分区的访问语句，一种是beeline命令行工具，另一种是通过应用程序建立JDBC(Java DataBase Connectivity，java数据库连接)链接，以上两种方法择其一实施。
进一步地，上述步骤S20之后还包括：
若所述当前用户不具有所述目标分区的数据访问权限，则拒绝所述访问请求，并向所述Hive端发送告警提示。
本实施例通过对Ranger的元数据表进行修改，为不同分区配置鉴权策略，实现了更细粒度的安全权限管理。
进一步地，提出本申请分区授权方法第三实施例，上述步骤S20包括：
步骤S21，根据所述目标分区路径和预设鉴权策略获取与所述目标分区路径相映射的用户标识；
在本实施例中，在获取到目标分区路径和当前用户标识后，需根据目标分区路径、当前用户标识和预设鉴权策略对当前用户的数据访问权限进行验证。具体地，由于预设鉴权策略包括分区路径和与其相映射的具有访问该分区权限的用户标识，因此在获取到目标分区路径后，即可根据该目标分区路径从预设鉴权策略中获取与之相映射的具有访问该分区权限的用户标识。
进一步地，在步骤S21之前还可以包括：判断所述目标分区路径是否具有与之相映射的预设鉴权策略；若所述目标分区路径不具有与之相映射的预设鉴权策略，说明该目标分区对所有用户提供数据访问服务，即所有用户具有该目标分区的数据访问权限；若所述目标分区路径具有与之相映射的预设鉴权策略，则执行步骤S22。
步骤S22，判断与所述目标分区路径相映射的用户标识与所述当前用户标识是否一致；
步骤S23，若与所述目标分区路径相映射的用户标识与所述当前用户标识一致，则所述当前用户具有所述目标分区的数据访问权限；
步骤S24，若与所述目标分区路径相映射的用户标识与所述当前用户标识不一致，则所述当前用户不具有所述目标分区的数据访问权限。
在本实施例中，在根据目标分区路径和预设鉴权策略获取与目标分区路径相映射的用户标识后，根据与目标分区路径相映射的用户标识与当前用户标识是否一致判断当前用户是否具有目标分区的数据访问权限。具体地，若与目标分区路径相映射的用户标识与当前用户标识一致，则判定当前用户具有目标分区的数据访问权限；若与目标分区路径相映射的用户标识与当前用户标识不一致，则当前用户不具有目标分区的数据访问权限。
进一步地，为提高分区授权访问的细粒度性，上述步骤S30包括：
步骤S31，若所述当前用户具有所述目标分区的数据访问权限，获取所述用户标识的注册时间；
在本实施例中，为提高分区授权访问的细粒度性，使用户不能访问该用户注册时间以前的历史数据，进而降低了数据泄露风险。具体地，若判定当前用户具有目标分区的数据访问权限，则获取该用户标识的注册时间。
步骤S32，通过所述Hive端向所述当前用户提供所述目标分区在所述注册时间以后更新的数据的数据访问服务。
在获取到该用户标识的注册时间后，通过Hive端向当前用户提供目标分区在注册时间以后更新的数据的数据访问服务。例如，若当前用户请求访问A产品的分区数据，若当前用户具有A产品的分区数据的数据访问权限，且获取到当前用户的注册时间为2019年5月1日15：00，则Ranger端通过Hive端向当前用户提供A产品分区在2019年5月1日15：00以后更新的数据的数据访问服务，对于A产品分区在2019年5月1日15：00以前的数据不对当前用户提供数据访问服务，实现了新增用户只能看到最新的数据，不能访问历史数据，从而降低了数据泄露风险，实现更细粒度的安全权限管理。
进一步地，上述步骤S30之后还包括：
步骤S33，记录所述当前用户在所述Hive端的操作日志，以供运维人员进行安全审计。
在本实施例中，Ranger端会记录当前用户在Hive端的操作日志，以供运维人员进行安全审计。审计是记录数据库中用户活动行为的一种机制，是对选定用户动作的监控和记录，它不但能记录谁访问了数据库，还能记录访问者对数据库进行了何种操作。在运维人员发现数据有可能被非法操作后，就可以通过操作日志对数据库的所有连接和操作进行审计，这样就可以发现非法用户的来源、使用的终端和会话时间等。
在本实施例中，通过在Ranger端增加分区鉴权策略，根据分区鉴权策略对Hive端的数据访问服务进行分区授权，实现了不同业务用户只能操作与自己业务相关的分区数据，达到了数据隔离的目的；还通过向用户提供目标分区在注册时间以后更新的数据的数据访问服务，实现了不同业务用户只能操作与自己业务相关的分区数据，且新增用户只能看到最新的数据，不能访问历史数据，从而降低了数据泄露风险，实现更细粒度的安全权限管理，更加符合银行等金融机构的实际需求。
本申请还提供一种分区授权装置。
参照图3，图3为本申请分区授权装置第一实施例的功能模块示意图，所述分区授 权装置应用于Ranger端，所述分区授权装置包括：
接收模块10，用于接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；
验证模块20，用于根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限；
访问模块30，用于若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务。
进一步地，所述接收模块还用于：
接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识，所述目标分区路径和当前用户标识由Hive端接收当前用户输入的请求访问目标分区的访问语句，对所述访问语句进行词法解析和语法解析得到语法树，再从所述语法树中提取得到目标分区路径和当前用户标识。
进一步地，所述分区授权装置还包括：
保存模块，用于在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存；
所述验证模块还用于根据所述目标分区路径、当前用户识和修改后的预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限。
进一步地，所述保存模块还用于：
在接收到策略修改指令时，检索与所述含有通配符的字符串相对应的所有分区路径；
根据所述与所述含有通配符的字符串相对应的所有分区路径，和所述策略修改指令携带的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。
进一步地，所述验证模块还用于：
根据所述目标分区路径和预设鉴权策略获取与所述目标分区路径相映射的用户标识；
判断与所述目标分区路径相映射的用户标识与所述当前用户标识是否一致；
若与所述目标分区路径相映射的用户标识与所述当前用户标识一致，则所述当 前用户具有所述目标分区的数据访问权限；
若与所述目标分区路径相映射的用户标识与所述当前用户标识不一致，则所述当前用户不具有所述目标分区的数据访问权限。
进一步地，所述分区授权装置还包括：
添加模块，用于在接收到权限对象添加指令时，在Ranger的元数据中的权限管理表中添加数据仓库工具分区类型，以使用户能够通过Hive端输入目标分区路径，所述权限管理表定义了Ranger中待进行权限管理的对象。
进一步地，所述访问模块还用于：
若所述当前用户具有所述目标分区的数据访问权限，获取所述用户标识的注册时间；
通过所述Hive端向所述当前用户提供所述目标分区在所述注册时间以后更新的数据的数据访问服务。
本申请分区授权装置具体实施方式与上述分区授权方法各实施例基本相同，在此不再赘述。
此外，本申请实施例还提出一种计算机可读存储介质。
计算机可读存储介质上存储有分区授权程序，分区授权程序被处理器执行时实现如上所述的分区授权方法的步骤。
本申请计算机可读存储介质具体实施方式与上述分区授权方法各实施例基本相同，在此不再赘述。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，凡是利用本申请说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，这些均属于本申请的保护之内。

Claims (20)

  1. 一种分区授权方法，其中，所述分区授权方法应用于Ranger端，所述分区授权方法包括以下步骤：
    接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；
    根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限；
    若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务。
  2. 如权利要求1所述的分区授权方法，其中，所述目标分区路径和当前用户标识由Hive端接收当前用户输入的请求访问目标分区的访问语句，对所述访问语句进行词法解析和语法解析得到语法树，再从所述语法树中提取得到目标分区路径和当前用户标识。
  3. 如权利要求1所述的分区授权方法，其中，所述接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识的步骤之前，还包括：
    在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存；
    所述根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限的步骤包括：
    根据所述目标分区路径、当前用户标识和修改后的预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限。
  4. 如权利要求3所述的分区授权方法，其中，所述策略修改指令携带的分区路径为含有通配符的字符串，所述在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略 保存的步骤包括：
    在接收到策略修改指令时，检索与所述含有通配符的字符串相对应的所有分区路径；
    根据所述与所述含有通配符的字符串相对应的所有分区路径，和所述策略修改指令携带的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。
  5. 如权利要求1所述的分区授权方法，其中，所述根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限的步骤包括：
    根据所述目标分区路径和预设鉴权策略获取与所述目标分区路径相映射的用户标识；
    判断与所述目标分区路径相映射的用户标识与所述当前用户标识是否一致；
    若与所述目标分区路径相映射的用户标识与所述当前用户标识一致，则所述当前用户具有所述目标分区的数据访问权限；
    若与所述目标分区路径相映射的用户标识与所述当前用户标识不一致，则所述当前用户不具有所述目标分区的数据访问权限。
  6. 如权利要求1所述的分区授权方法，其中，所述接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识的步骤之前，还包括：
    在接收到权限对象添加指令时，在Ranger的元数据中的权限管理表中添加数据仓库工具分区类型，以使用户能够通过Hive端输入目标分区路径，所述权限管理表定义了Ranger中待进行权限管理的对象。
  7. 如权利要求1所述的分区授权方法，其中，所述若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务的步骤包括：
    若所述当前用户具有所述目标分区的数据访问权限，获取所述用 户标识的注册时间；
    通过所述Hive端向所述当前用户提供所述目标分区在所述注册时间以后更新的数据的数据访问服务。
  8. 一种分区授权装置，其中，所述分区授权装置应用于Ranger端，所述分区授权装置包括：
    接收模块，用于接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；
    验证模块，用于根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限；
    访问模块，用于若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务。
  9. 如权利要求8所述的分区授权装置，其中，所述分区授权装置还包括：
    保存模块，用于在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存；
    所述验证模块还用于根据所述目标分区路径、当前用户识和修改后的预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限。
  10. 如权利要求9所述的分区授权装置，其中，所述策略修改指令携带的分区路径为含有通配符的字符串，所述保存模块还用于：
    在接收到策略修改指令时，检索与所述含有通配符的字符串相对应的所有分区路径；
    根据所述与所述含有通配符的字符串相对应的所有分区路径，和所述策略修改指令携带的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。
  11. 如权利要求8所述的分区授权装置，其中，所述分区授权装置还包括：
    添加模块，用于在接收到权限对象添加指令时，在Ranger的元数据中的权限管理表中添加数据仓库工具分区类型，以使用户能够通过Hive端输入目标分区路径，所述权限管理表定义了Ranger中待进行权限管理的对象。
  12. 如权利要求8所述的分区授权装置，其中，所述访问模块还用于：
    若所述当前用户具有所述目标分区的数据访问权限，获取所述用户标识的注册时间；
    通过所述Hive端向所述当前用户提供所述目标分区在所述注册时间以后更新的数据的数据访问服务。
  13. 一种分区授权设备，其中，所述分区授权设备包括存储器、处理器以及存储在所述存储器上并可在所述处理器上运行的分区授权程序，所述分区授权程序被所述处理器执行时实现如下步骤：
    接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；
    根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限；
    若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务。
  14. 如权利要求13所述的分区授权设备，其中，所述分区授权程序被所述处理器执行时还实现如下步骤：
    在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存；
    所述根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限的步骤包括：
    根据所述目标分区路径、当前用户标识和修改后的预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限。
  15. 如权利要求14所述的分区授权设备，其中，所述分区授权程序被所述处理器执行时还实现如下步骤：
    在接收到策略修改指令时，检索与所述含有通配符的字符串相对应的所有分区路径；
    根据所述与所述含有通配符的字符串相对应的所有分区路径，和所述策略修改指令携带的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。
  16. 如权利要求13所述的分区授权设备，其中，所述分区授权程序被所述处理器执行时还实现如下步骤：
    在接收到权限对象添加指令时，在Ranger的元数据中的权限管理表中添加数据仓库工具分区类型，以使用户能够通过Hive端输入目标分区路径，所述权限管理表定义了Ranger中待进行权限管理的对象。
  17. 一种计算机可读存储介质，其中，所述计算机可读存储介质上存储有分区授权程序，所述分区授权程序被处理器执行时实现如下步骤：
    接收由Hive端发送的当前用户请求访问的目标分区的目标分区路径和当前用户标识；
    根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限；
    若所述当前用户具有所述目标分区的数据访问权限，则允许Hive端向所述当前用户提供所述目标分区的数据访问服务。
  18. 如权利要求17所述的计算机可读存储介质，其中，所述分区授权程序被所述处理器执行时还实现如下步骤：
    在接收到策略修改指令时，根据所述策略修改指令携带的分区路径和与所述分区路径相映射的用户标识修改预设鉴权策略，并将 修改后的预设鉴权策略保存；
    所述根据所述目标分区路径、当前用户标识和预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限的步骤包括：
    根据所述目标分区路径、当前用户标识和修改后的预设鉴权策略验证所述当前用户是否具有所述目标分区的数据访问权限。
  19. 如权利要求18所述的计算机可读存储介质，其中，所述分区授权程序被所述处理器执行时还实现如下步骤：
    在接收到策略修改指令时，检索与所述含有通配符的字符串相对应的所有分区路径；
    根据所述与所述含有通配符的字符串相对应的所有分区路径，和所述策略修改指令携带的用户标识修改预设鉴权策略，并将修改后的预设鉴权策略保存。
  20. 如权利要求17所述的计算机可读存储介质，其中，所述分区授权程序被所述处理器执行时还实现如下步骤：
    在接收到权限对象添加指令时，在Ranger的元数据中的权限管理表中添加数据仓库工具分区类型，以使用户能够通过Hive端输入目标分区路径，所述权限管理表定义了Ranger中待进行权限管理的对象。
PCT/CN2020/080558 2019-05-27 2020-03-23 分区授权方法、装置、设备及计算机可读存储介质 WO2020238359A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910459668.5 2019-05-27
CN201910459668.5A CN110188573B (zh) 2019-05-27 2019-05-27 分区授权方法、装置、设备及计算机可读存储介质

Publications (1)

Publication Number Publication Date
WO2020238359A1 true WO2020238359A1 (zh) 2020-12-03

Family

ID=67718643

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/080558 WO2020238359A1 (zh) 2019-05-27 2020-03-23 分区授权方法、装置、设备及计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN110188573B (zh)
WO (1) WO2020238359A1 (zh)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110188573B (zh) * 2019-05-27 2024-06-04 深圳前海微众银行股份有限公司 分区授权方法、装置、设备及计算机可读存储介质
CN110619226A (zh) * 2019-09-12 2019-12-27 秒针信息技术有限公司 一种基于平台的数据处理方法、系统、设备及存储介质
CN111797424A (zh) * 2019-11-26 2020-10-20 北京京东尚科信息技术有限公司 处理请求的方法和装置
CN111177743B (zh) * 2019-12-06 2022-02-22 西安交通大学 一种面向信用大数据的风险控制方法及其系统
CN111125767A (zh) * 2019-12-26 2020-05-08 秒针信息技术有限公司 动态脱敏方法、装置、电子设备和计算机可读存储介质
CN111274167A (zh) * 2020-01-21 2020-06-12 李岗 介质数据的保护方法及系统
CN111651122B (zh) * 2020-05-20 2023-07-28 远景智能国际私人投资有限公司 数据删除方法、装置、服务器及存储介质
CN112257097A (zh) * 2020-11-23 2021-01-22 浪潮云信息技术股份公司 一种基于分布式数据库的分区权限管理方法
WO2023173908A1 (zh) * 2022-03-17 2023-09-21 华为云计算技术有限公司 访问文件的方法、装置、系统及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107066867A (zh) * 2017-03-11 2017-08-18 郑州云海信息技术有限公司 一种大数据集群资源分配方法及装置
CN107196951A (zh) * 2017-06-12 2017-09-22 北京明朝万达科技股份有限公司 一种hdfs系统防火墙的实现方法和防火墙系统
CN107622211A (zh) * 2017-09-27 2018-01-23 浪潮软件股份有限公司 一种大数据集群权限访问控制方法及装置
CN108280367A (zh) * 2018-01-22 2018-07-13 腾讯科技（深圳）有限公司 数据操作权限的管理方法、装置、计算设备及存储介质
CN109643242A (zh) * 2016-05-23 2019-04-16 摩根大通国家银行 用于多租户hadoop集群的安全设计和架构
CN110188573A (zh) * 2019-05-27 2019-08-30 深圳前海微众银行股份有限公司 分区授权方法、装置、设备及计算机可读存储介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6510568B2 (ja) * 2014-06-23 2019-05-08 オラクル・インターナショナル・コーポレイション マルチテナントアプリケーションサーバ環境におけるセキュリティをサポートするためのシステムおよび方法
CN106997368A (zh) * 2016-01-26 2017-08-01 中兴通讯股份有限公司 一种数据仓库中的数据保护方法及装置
US9948655B1 (en) * 2016-04-15 2018-04-17 AtScale, Inc. Data access authorization for dynamically generated database structures
CN109299613B (zh) * 2018-09-03 2023-07-21 中国平安人寿保险股份有限公司 数据库分区权限的设置方法和终端设备
CN109309686A (zh) * 2018-11-01 2019-02-05 浪潮软件集团有限公司 一种多租户管理方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109643242A (zh) * 2016-05-23 2019-04-16 摩根大通国家银行 用于多租户hadoop集群的安全设计和架构
CN107066867A (zh) * 2017-03-11 2017-08-18 郑州云海信息技术有限公司 一种大数据集群资源分配方法及装置
CN107196951A (zh) * 2017-06-12 2017-09-22 北京明朝万达科技股份有限公司 一种hdfs系统防火墙的实现方法和防火墙系统
CN107622211A (zh) * 2017-09-27 2018-01-23 浪潮软件股份有限公司 一种大数据集群权限访问控制方法及装置
CN108280367A (zh) * 2018-01-22 2018-07-13 腾讯科技（深圳）有限公司 数据操作权限的管理方法、装置、计算设备及存储介质
CN110188573A (zh) * 2019-05-27 2019-08-30 深圳前海微众银行股份有限公司 分区授权方法、装置、设备及计算机可读存储介质

Also Published As

Publication number Publication date
CN110188573B (zh) 2024-06-04
CN110188573A (zh) 2019-08-30

Similar Documents

Publication Publication Date Title
WO2020238359A1 (zh) 分区授权方法、装置、设备及计算机可读存储介质
US9628471B1 (en) Protecting user identity at a cloud using a distributed user identity system
US10484385B2 (en) Accessing an application through application clients and web browsers
US9852206B2 (en) Computer relational database method and system having role based access control
US10878218B2 (en) Device fingerprinting, tracking, and management
US20170286653A1 (en) Identity risk score generation and implementation
US9231974B2 (en) Dynamic policy-based entitlements from external data repositories
US11303645B2 (en) Online diagnostic platform, and permission management method and permission management system thereof
CN113114498A (zh) 一种可信区块链服务平台的架构系统及其构建方法
US11321479B2 (en) Dynamic enforcement of data protection policies for arbitrary tabular data access to a corpus of rectangular data sets
CN110493308B (zh) 分布式一致性系统会话方法、装置及存储介质、服务器
US9237156B2 (en) Systems and methods for administrating access in an on-demand computing environment
CN113392415A (zh) 数据仓库的访问控制方法、系统和电子设备
CN111274569A (zh) 统一登录认证的研发运维集成系统及其登录认证方法
CN111930752B (zh) 一种数据处理方法及相关设备
CN113342775B (zh) 基于云的计算环境中的集中式多租户即服务
You et al. [Retracted] Research and Design of Docker Technology Based Authority Management System
CN114168930A (zh) 一种Hive权限控制方法、装置、设备及可读存储介质
Xi et al. Decentralized access control for secure microservices cooperation with blockchain
US7945960B2 (en) Dynamic conditional security policy extensions
CN114896584B (zh) 一种Hive数据权限控制代理层方法及系统
US9336408B2 (en) Solution for continuous control and protection of enterprise data based on authorization projection
US20200151346A1 (en) Method and system for implementing a cloud machine learning environment
KR20050073349A (ko) 3-Ｔｉｅｒ 구조 기반의 데이터베이스 접근 통제 시스템및 방법
CN115422526B (zh) 角色权限管理方法、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20812905

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20812905

Country of ref document: EP

Kind code of ref document: A1