WO2021208758A1

WO2021208758A1 - Data permissions management

Info

Publication number: WO2021208758A1
Application number: PCT/CN2021/085189
Authority: WO
Inventors: 刘洋; 周家英; 刘恒
Original assignee: 支付宝(杭州)信息技术有限公司
Priority date: 2020-04-15
Filing date: 2021-04-02
Publication date: 2021-10-21
Also published as: CN111523098A

Abstract

Disclosed in one or more embodiments of the present invention are a data permissions management method and apparatus, for use in solving the problem in the prior art of inaccurate data security control. The method comprises: receiving a data operation request sent by a user, the data operation request being used for requesting to perform a first operation on a first column of data in a target data set, the target data set comprising a plurality of columns of data, and the columns of data corresponding to respective security levels; obtaining, on the basis of the data operation request, data operation permissions information corresponding to the user and/or the security level of the first column of data; identifying, according to the data operation permissions information and/or the security level, the permission of the user to perform the first operation on the first column of data to obtain an authentication result; and determining, according to the authentication result, whether the user is permitted to perform the first operation on the first column of data.

Description

Data authority management

Technical field

This specification relates to the field of data security technology, and in particular to a data authority management method and device.

Background technique

In today's big data era, many companies have their own big data systems, which serve as infrastructure for cloud computing and artificial intelligence and other technologies. The big data system covers a lot of important data. In these data, it may even include user's private information or enterprise's confidential information. Therefore, the classification of people and data security levels is also an important part of data security management. In order to prevent data leakage, data rights management is required, that is, who can access what data is how and who can be accessed. This is particularly important in financial-level enterprises.

In related technologies, for data permission management, one method is to divide the behavior of subjects accessing objects into different levels, such as List, Read, Write, and Permissions management. The method only serves to describe the behavior, and does not affect the control of data security. Another method is to control the subject's access to data by adjusting the subject's security level. The disadvantage of this approach is also obvious: if the subject only needs to access a column in the table whose security level is higher than its own, the subject After the security level of is increased, other columns that the subject could not access may also be allowed to access, resulting in over-authorization.

Summary of the invention

On the one hand, one or more embodiments of this specification provide a data authority management method, including: receiving a data operation request sent by a user, the data operation request being used to request a first operation to be performed on the first column of data in the target data set , The target data set includes a plurality of column data, and each column data corresponds to its own security level. Based on the data operation request, obtain data operation authority information corresponding to the user and/or the security level of the first column of data. According to the data operation authority information and/or the security level, the authority of the user to perform the first operation on the first column of data is authenticated, and an authentication result is obtained. According to the authentication result, it is determined whether the user is allowed to perform the first operation on the first column of data.

On the other hand, one or more embodiments of the present specification provide a data authority management device, including: a receiving module, which receives a data operation request sent by a user, and the data operation request is used to request the first column of data in the target data set. Perform the first operation, the target data set includes a plurality of column data, and each column data corresponds to its own security level. The obtaining module obtains the data operation authority information corresponding to the user and/or the security level of the first column of data based on the data operation request. The authentication module, according to the data operation authority information and/or the security level, authenticates the user's authority to perform the first operation on the first column of data, and obtains an authentication result. The determining module determines, according to the authentication result, whether to allow the user to perform the first operation on the first column of data.

In another aspect, one or more embodiments of the present specification provide a data rights management device, including a processor and a memory arranged to store computer-executable instructions. When the executable instruction is executed, the processor: receives a data operation request sent by a user, the data operation request is used to request a first operation to be performed on the first column of data in the target data set, the target data set It includes a plurality of column data, and each column data corresponds to its own security level. Based on the data operation request, obtain data operation authority information corresponding to the user and/or the security level of the first column of data. According to the data operation authority information and/or the security level, the authority of the user to perform the first operation on the first column of data is authenticated, and an authentication result is obtained. According to the authentication result, it is determined whether the user is allowed to perform the first operation on the first column of data.

In another aspect, one or more embodiments of this specification provide a storage medium for storing computer-executable instructions that, when executed, implement the following process: receiving a data operation request sent by a user, and the data The operation request is used to request the first operation to be performed on the first column of data in the target data set. The target data set includes a plurality of column data, and each column data corresponds to its own security level. Based on the data operation request, obtain data operation authority information corresponding to the user and/or the security level of the first column of data. According to the data operation authority information and/or the security level, the authority of the user to perform the first operation on the first column of data is authenticated, and an authentication result is obtained. According to the authentication result, it is determined whether the user is allowed to perform the first operation on the first column of data.

Description of the drawings

In order to more clearly explain one or more embodiments of this specification or the technical solutions in the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, in the following description The drawings are only some of the embodiments described in one or more embodiments of this specification. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative labor. .

Fig. 1 is a schematic flowchart of a data authority management method according to an embodiment of the present specification;

Fig. 2 is a schematic flowchart of a data authority management method according to another embodiment of the present specification;

Fig. 3 is a schematic flowchart of a data authority management method according to still another embodiment of the present specification;

Fig. 4 is a schematic flowchart of a data authority management method according to still another embodiment of this specification;

Fig. 5 is a schematic block diagram of a data authority management device according to an embodiment of the present specification;

Fig. 6 is a schematic block diagram of a data rights management device according to an embodiment of the present specification.

Detailed ways

One or more embodiments of this specification provide a data authority management method and device to solve the problem of inaccurate data security management and control in the prior art.

In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the following will combine the drawings in one or more embodiments of this specification to compare The technical solution is described clearly and completely. Obviously, the described embodiments are only a part of the embodiments in this specification, rather than all the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by a person of ordinary skill in the art without creative work shall fall within the protection scope of one or more embodiments of this specification.

Fig. 1 is a schematic flowchart of a data authority management method according to an embodiment of the present specification. As shown in Fig. 1, the method includes:

S102: Receive a data operation request sent by a user. The data operation request is used to request a first operation to be performed on the first column of data in the target data set. The target data set includes multiple column data, and each column data corresponds to its own security level.

Among them, the "first" in the first column of data does not have the meaning of a sequence number, and it is only used to indicate the column data targeted by the data operation request. Therefore, the first column of data can be any column of data in the target data set. In one embodiment, the target data set may be a data table including multiple columns of data.

The security level is a way to classify the column data according to the degree of data confidentiality of the column data. The higher the security level, the higher the degree of confidentiality of the corresponding column data, and the more sensitive the data.

S104: Based on the data operation request, obtain data operation authority information corresponding to the user and/or the security level of the first column of data.

The data operation authority information includes first authority information corresponding to various operations that the user is authorized to perform on the target data set and/or second authority information corresponding to various operations that the user is authorized to perform on the first column of data. Various operations such as query operations, read operations, update operations, delete operations, etc.

For example, if the target data set is a data table that includes multiple columns of data, the data operation authority information may include the first authority information corresponding to the various operations that the user has the right to perform on the data table, and may also include the user’s The second permission information corresponding to the various operations that the first column of data (can be any column of data) is authorized to perform.

For another example, suppose the user has the right to perform read operations on the data table, the first permission information should contain the permission information corresponding to the read operation; suppose the user has the right to access the first column of data in the data table (which can be any column of data). ) To perform a query operation, the second authority information should include authority information corresponding to the query operation.

S106: According to the data operation authority information and/or the security level, authenticate the user's authority to perform the first operation on the first column of data, and obtain an authentication result.

S108: Determine whether the user is allowed to perform the first operation on the first column of data according to the authentication result.

Among them, if the authentication result is right, the user is allowed to perform the first operation on the first column of data; if the authentication result is no right, the user is denied to perform the first operation on the first column of data.

Using the technical solutions of one or more embodiments of this specification, after receiving a data operation request from a user to perform the first operation on the first column of data in the target data set, the data operation authority information and/or the first operation permission information corresponding to the user is obtained. According to the security level of the column data, the user is authenticated based on the acquired data operation authority information and/or the security level of the first column of data, and then it is determined whether the user is allowed to perform the first operation on the first column of data according to the authentication result. The data authority and the security level of the column data are combined to manage the data comprehensively, thereby improving the accuracy of user authentication. In addition, the data management and control solution does not need to adjust the data security level, thereby avoiding over-authorization problems caused by adjusting the data security level, and ensuring data security management and control effects to a greater extent.

The following describes in detail how to authenticate the user's authority to perform the first operation on the first column of data according to the user's corresponding data operation authority information and/or the security level of the first column of data.

In one embodiment, when authenticating the user's permission to perform the first operation on the first column of data, first determine whether the second permission information corresponding to the various operations that the user has the right to perform on the first column of data in the data table contains the second permission information. The authority information corresponding to an operation; if yes, it is determined that the user has the authority to perform the first operation on the first column of data; if not, the first authority information and/or corresponding to the various operations that the user is authorized to perform on the data table are further determined Or the security level of the first column of data, to identify the user's authority to perform the first operation on the first column of data.

Wherein, further according to the first permission information corresponding to the various operations that the user has the right to perform on the data table and/or the security level of the first column of data, authenticating the user’s permission to perform the first operation on the first column of data may include: judging Whether the first permission information contains the permission information corresponding to the first operation; if so, compare the security level of the user and the security level of the first column of data, and verify the user’s execution of the first operation on the first column of data based on the comparison result Permission; if not, it is determined that the user does not have the permission to perform the first operation on the first column of data.

Among them, the user’s authority to perform the first operation on the first column of data is identified according to the comparison result, specifically: if the comparison result is that the user’s security level is lower than the security level of the first column of data, it is determined that the user does not have the right to perform the first operation on the first column of data. The column data has the permission to perform the first operation; if the comparison result is that the user's security level is not lower than the security level of the first column of data, it is determined that the user has the permission to perform the first operation on the first column of data.

In the above-mentioned embodiment, when authenticating the user's authority to perform the first operation on the first column of data, the user's authority information on the first column of data is preferentially queried, thereby combining authority management and security levels, not only can accurately control the column data The operation authority (that is, the data operation authority is controlled to the column level), and the authority control of one column of data will not affect the authority control of other column data, so it can improve the data security control effect and avoid over-authorization.

In one embodiment, if the user needs to perform an operation on a certain column of data in the target data set, he can initiate a permission request to perform the operation on the column of data in advance, and initiate a data operation request for the column of data after the permission application is successful. The following takes the first column of data (which can be any column of data) in the target data set as an example to illustrate how to authorize the user to operate the first column of data in advance.

In one embodiment, when the first permission application for performing the first operation on the target data set sent by the user is received, the first review result of reviewing the first permission application is determined; if the first review result is approved, Then, the permission information corresponding to the first operation is recorded in the first permission information.

Fig. 2 is a schematic flowchart of a data authority management method according to another embodiment of the present specification. As shown in Fig. 2, the method includes:

S201: Receive a first permission application sent by a user to perform a first operation on a target data set.

S202: Determine a first review result of reviewing the first permission application. Among them, a user with a certain authority (such as a data authority manager) can review and approve the first authority application, or the computer can review the first authority application based on pre-set authority approval conditions, so as to obtain the first review result .

S203: Determine whether the first audit result is approved; if yes, execute S204; if not, execute S205.

S204: It is determined that the authorization is successful, and the authority information corresponding to the first operation is recorded in the first authority information.

S205: It is determined that the authorization fails. When the authorization fails, the authority information corresponding to the first operation is not recorded in the first authority information.

For example, the target data set is the user information table shown in Table 1, and the user information table includes multiple column data and the security level corresponding to each column data.

Table 1

列名Column name	描述describe	安全等级Security Level
idid	用户IDUser ID	00
nicknamenickname	昵称Nick name	00
namename	用户姓名username	22
mobilemobile	用户手机号User phone number	22
birthdaybirthday	用户生日User birthday	22
credit_cardcredit_card	用户的信用卡号User's credit card number	33

Assuming that the user needs to perform the first operation (such as a query operation) on the first column (such as the id column or the nickname column) in the user information table 1 whose security level is not higher than that of the user information table, you can apply for a table that performs the first operation on the user information table Permissions. After the approval is passed, a table permission entry for the user to perform the first operation on the user information table 1 is recorded in the first permission information, that is, the permission information corresponding to the first operation is added.

In this embodiment, if the user wants to perform operations on the target data set or column data whose security level is not higher than that of his The data set performs the operation. This simplifies the authorization process for the user to manipulate the target data set.

In one embodiment, when the second permission application for performing the first operation on the first column of data sent by the user is received, the second review result of reviewing the second permission application is determined; if the second review result is approved , Then the permission information corresponding to the first operation is recorded in the second permission information.

Fig. 3 is a schematic flowchart of a data authority management method according to another embodiment of the present specification. As shown in Fig. 3, the method includes:

S301: Receive a second permission application sent by a user to perform a first operation on the first column of data in the target data set.

S302: Determine a second review result of reviewing the second permission application. Among them, a user with a certain authority (such as a data authority manager) can review and approve the second authority application, or the computer can review the first authority application based on pre-set authority approval conditions to obtain the second review result .

S303: Determine whether the second audit result is approved; if yes, execute S304; if not, execute S305.

S304: It is determined that the authorization is successful, and the authority information corresponding to the first operation is recorded in the second authority information.

S305: It is determined that the authorization fails. When the authorization fails, the authority information corresponding to the first operation is not recorded in the second authority information.

Still take the above user information table 1 as an example. Assuming that the user needs to perform the first operation on the second column of user information table 1 whose security level is higher than that of his own (such as name column, mobile column, birthday column or credit_card column), he can apply for the second column in user information table 1 The column permission for the data to perform the first operation. After the approval is passed, a column permission item for the user to perform the first operation on the second column of data is recorded in the second permission information, that is, the permission information corresponding to the first operation is added.

It can be seen that, in this embodiment, if the user wants to perform an operation on a column of data with a higher security level than his own, he only needs to apply for the operation authority for the column of data in advance, and then the operation can be performed on the column of data after the authorization is successful. It does not affect the authority control of other column data, so the data operation authority can be controlled to the column level.

Based on the authorization method in the embodiment shown in FIG. 2 or FIG. 3, the data authority can be managed according to the steps shown in FIG. 4. As shown in Figure 4, data authority management includes the following steps:

S401: Receive a data operation request sent by a user for requesting to perform a first operation on a first column of data in a target data set, where the target data set includes multiple column data, and each column data corresponds to its own security level.

Among them, the first operation is a query operation, a read operation, an update operation, a delete operation, and so on. The first column of data can be any column of data in the target data set. In one embodiment, the target data set may be a data table including multiple columns of data.

The security level is a way to classify the column data according to the degree of data confidentiality of the column data. The higher the security level, the higher the degree of confidentiality of the corresponding column data, and the more sensitive the data. The security level of column data can be pre-set by authorized designated personnel (such as data management personnel).

S402: Based on the data operation request, obtain second permission information corresponding to various operations that the user has the right to perform on the first column of data.

Among them, various operations such as query operations, read operations, update operations, delete operations, etc. The first operation is one of various operations.

S403: Determine whether the second authority information includes authority information corresponding to the first operation. If yes, execute S409; if not, execute S404.

S404: Acquire first permission information corresponding to various operations that the user has the right to perform on the target data set.

S405: Determine whether the first permission information includes permission information corresponding to the first operation. If yes, execute S406; if not, execute S408.

S406: Determine the security level of the user and the security level of the first column of data.

S407: Determine whether the security level of the user is lower than the security level of the first column of data. If yes, execute S408; if not, execute S409.

S408: Determine that the user does not have the authority to perform the first operation on the first column of data, and refuse the user to perform the first operation on the first column of data.

S409: Determine that the user has the authority to perform the first operation on the first column of data, and allow the user to perform the first operation on the first column of data.

In this embodiment, after receiving a data operation request from the user to perform the first operation on the first column of data in the target data set, the user's authority information for the first column of data is first queried, and if the user cannot query the first column of data In the case of data permission information, combined with the user’s permission information and security level of the target data set, the user is authenticated, thus combining the permission management and the security level, not only can accurately control the operation permissions of the column data (about Data operation authority is controlled to the column level), and the authority control of one column of data will not affect the authority control of other column data, so it can improve the effect of data security control and avoid over-authorization.

The following specific embodiments are used to illustrate the data rights management method provided by one or more embodiments of this specification.

Still take the above user information table 1 as an example. Assume that the user "Zhang San" is the subject of data manipulation, and his security level is 0. If Zhang San wants to access the column data in the user information table 1, there are two situations:

(1) Zhang San wants to access the column of user information table 1 whose security level is not higher than his own. For example, Zhang San needs to perform a query on the id column or the nickname column. Since the security level of the id column or nickname column is not higher than that of Zhang San, Zhang San can apply in advance for the table permission to perform query operations on the user information table 1. After the approval is passed, the first permission information (that is, used to record Zhang San 3. The authority information that has the right to perform various operations on the user information table 1) adds a permission item that Zhang San has the authority to perform queries on the user information table 1.

After the authorization is successful, if Zhang San initiates a data operation request to perform a query operation on the id column, the authentication process is as follows:

First, query the first permission information and second permission information corresponding to Zhang San (the permission information that Zhang San has the right to perform various operations on the id column is recorded), and determine whether the second permission information contains the permission items corresponding to the query operation . Since Zhang San only applied for the table permission to perform query operations on the user information table 1 in advance, and did not apply for the column permission to perform query operations on the id column, the second permission information does not include (that is, the query cannot be queried) corresponding to the query operation The permission item. Now proceed to the next step.

Secondly, it is judged whether the first permission information contains the permission item corresponding to the query operation, that is, it is judged whether the permission item for Zhang San to perform the query operation on the user information table 1 is recorded in the first permission information. Since Zhang San has previously applied for the table permission to perform the query operation on the user information table 1, the first permission information contains the permission item corresponding to the query operation. Now proceed to the next step, namely security level check.

Then, determine the security level of the id column in Zhang Sanhe user information table 1, and determine whether the security level of Zhang San is lower than the security level of the id column. Since Zhang San’s security level and the security level of the id column are both 0, that is, Zhang San’s security level is not lower than the security level of the id column, so Zhang San has the right to perform query operations on the id column. At this time, the authentication success message is returned, and Zhang San is allowed to perform query operations on the id column.

Similarly, if Zhang San initiates a data operation request to perform a query operation on the nickname column, since the security level of the nickname column and the security level of the id column are the same, both are 0, the authentication process is the same as the id column, and will not be repeated.

If Zhang San initiates the permission to perform query operations on the column data in the user information table 1 whose security level is higher than his own (such as the name column). The authentication process is as follows:

First, query the first permission information corresponding to Zhang San (that is, the permission information used to record Zhang San's right to perform various operations on the user information table 1) and the second permission information (record that Zhang San has the right to execute each name column The permission information of the class operation), and determine whether the second permission information contains the permission item corresponding to the query operation. Since Zhang San only applied for the table permission to perform the query operation on the user information table 1 in advance, and did not apply for the column permission to perform the query operation on the name column, the second permission information does not include (that is, the query cannot be queried) the corresponding query operation The permission item. Now proceed to the next step.

Secondly, it is judged whether the first permission information contains the permission item corresponding to the query operation, that is, it is judged whether the permission item for Zhang San to perform the query operation on the user information table 1 is recorded in the first permission information. Since Zhang San has previously applied for the table permission to perform the query operation on the user information table 1, the first permission information contains the permission item corresponding to the query operation. At this time, proceed to the next step, namely security level check.

Then, determine the security level of the name column in Zhang Sanhe user information table 1, and determine whether the security level of Zhang San is lower than the security level of the name column. Since Zhang San’s security level is 0 and the name column’s security level is 2, that is, Zhang San’s security level is lower than the name column’s security level, so Zhang San has no right to perform query operations on the name column. At this time, the authentication failure information is returned, and Zhang San is refused to perform the query operation on the name column.

Similarly, if Zhang San initiates a data operation request to perform a query operation on other column data higher than his security level (such as mobile column, birthday column or credit_card column), the authentication process is the same as the name column, and will not be repeated.

(2) Zhang San wants to access the column of user information table 1 whose security level is higher than his own. For example, Zhang San needs to perform a query operation on the name column. Since the security level of the name column is higher than that of Zhang San, Zhang San can apply in advance for the column permission to perform query operations on the name column. After the approval is passed, the second permission information (record that Zhang San has the right to perform various types of query operations on the name column Add a permission item of Zhang San's query permission on the name column in the operation permission information).

After the authorization is successful, if Zhang San initiates a data operation request to perform a query operation on the name column, the authentication process is as follows:

First, query the first permission information corresponding to Zhang San (that is, the permission information used to record Zhang San's right to perform various operations on the user information table 1) and the second permission information (record that Zhang San has the right to execute each name column Permission information for class operations).

Secondly, it is judged whether the second permission information contains the permission item corresponding to the query operation. Since Zhang San has previously applied for the column permission to perform the query operation on the name column, the second permission information contains the permission item corresponding to the query operation. At this time, the authentication success message is returned, and Zhang San is allowed to perform query operations on the name column.

If Zhang San initiates a data operation request to perform a query operation on the mobile column, the authentication process is as follows:

First, query the first permission information corresponding to Zhang San (that is, the permission information used to record Zhang San's right to perform various operations on the user information table 1) and the second permission information (record that Zhang San has the right to perform various operations on the mobile column. The permission information of the class operation), and determine whether the second permission information contains the permission item corresponding to the query operation. Since Zhang San only applied for column permission to perform query operations on the name column in advance, but did not apply for column permissions to perform query operations on the mobile column, the second permission information does not include (that is, the query cannot be queried) the corresponding permissions for the query operation item. Now proceed to the next step.

Secondly, it is judged whether the first permission information contains the permission item corresponding to the query operation, that is, it is judged whether the permission item for Zhang San to perform the query operation on the user information table 1 is recorded in the first permission information. If it does not, it means that Zhang San has no right to perform the query operation on the mobile column of the user information table 1. At this time, the authentication failure information is returned, and Zhang San is refused to perform the query operation on the mobile column. If it does, proceed to the next step, which is the security level check.

Then, determine the security level of the mobile column in Zhang Sanhe user information table 1, and determine whether the security level of Zhang San is lower than the security level of the mobile column. Since Zhang San’s security level is lower than that of the mobile column, Zhang San has no right to perform query operations on the mobile column. At this time, the authentication failure information is returned, and Zhang San is refused to perform the query operation on the mobile column.

Similarly, if Zhang San initiates a data operation request to perform a query operation on the birthday column or the credit_card column, since the security level of the birthday column or the credit_card column is higher than the security level of Zhang San, the authentication process is the same as that of the mobile column. Go into details.

It can be seen from the above embodiment that Zhang San cannot perform operations on column data with a higher security level than himself in the user information table 1. If Zhang San wants to perform certain operations on column data with a higher security level than himself, then You need to apply for permission to perform this type of operation on the column in advance. It can be seen that this method of combining authority management and security level to comprehensively authenticate users can not only accurately control data security, but also make authorization for one column of data not affect the authority control of other columns, thereby avoiding over-authorization , To ensure the effectiveness of data security management and control.

In summary, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown in order to achieve the desired result. In certain embodiments, multitasking and parallel processing may be advantageous.

The above is the data authority management method provided by one or more embodiments of this specification. Based on the same idea, one or more embodiments of this specification also provide a data authority management device.

Fig. 5 is a schematic flowchart of a data authority management device according to an embodiment of the present specification. As shown in Fig. 5, the device includes:

The receiving module 510 receives a data operation request sent by a user; the data operation request is used to request to perform a first operation on the first column of data in the target data set; the target data set includes multiple column data; each of the column data Corresponding to their respective security levels;

The obtaining module 520, based on the data operation request, obtains the data operation authority information corresponding to the user and/or the security level of the first column of data;

The authentication module 530, according to the data operation authority information and/or the security level, authenticates the user's authority to perform the first operation on the first column of data, and obtains an authentication result;

The determining module 540 determines whether the user is allowed to perform the first operation on the first column of data according to the authentication result.

In one embodiment, the data operation authority information includes first authority information corresponding to various operations that are authorized to perform on the target data set and/or corresponding to various operations that are authorized to perform on the first column of data. ’S second authority information.

In one embodiment, the authentication module 530 includes: a judging unit, judging whether the second permission information contains the permission information corresponding to the first operation; the first determining unit, if the second permission information is If the authority information corresponding to the first operation is included, it is determined that the user has the authority to perform the first operation on the first column of data; the first authentication unit, if the second authority information does not include all According to the authority information corresponding to the first operation, the authority of the user to perform the first operation on the first column of data is authenticated according to the first authority information and/or the security level.

In an embodiment, the first authentication unit: judges whether the first permission information includes the permission information corresponding to the first operation; if so, compares the security level of the user with the first The security level of the column data, and the authorization of the user to perform the first operation on the first column of data is identified according to the comparison result; if not, it is determined that the user does not have the authority to perform the first operation on the first column of data. The authority of the first operation is described.

In one embodiment, the first authentication unit: if the comparison result is that the security level of the user is lower than the security level of the first column of data, it is determined that the user does not have the right to the first column of data. A column of data has the authority to perform the first operation; if the comparison result is that the security level of the user is not lower than the security level of the first column of data, it is determined that the user has access to the first column The permission of the data to perform the first operation.

In one embodiment, the device further includes: a second receiving module, which receives the first operation sent by the user for performing the first operation on the target data set before the receiving the data operation request sent by the user. Permission application; a second determination module, which determines the first review result of reviewing the first permission application; a first recording module, if the first review result is approved, records in the first permission information Authority information corresponding to the first operation.

In one embodiment, the device further includes: a third receiving module, which receives the first operation sent by the user to perform the first operation on the first column of data before the data operation request sent by the user is received. The second permission application; the third determination module, which determines the second review result of the review of the second permission application; the second recording module, if the second review result is approved, then it is in the second permission information Record the authority information corresponding to the first operation.

Using the device of one or more embodiments of the present specification, after receiving a data operation request from a user to perform a first operation on the first column of data in the target data set, the data operation authority information and/or the first column corresponding to the user are obtained. The data security level is used to authenticate the user based on the acquired data operation authority information and/or the security level of the first column of data, and then determine whether the user is allowed to perform the first operation on the first column of data according to the authentication result. The data authority and the security level of the column data are combined to manage the data comprehensively, thereby improving the accuracy of user authentication. In addition, the device does not need to adjust the data security level, thereby avoiding over-authorization problems caused by adjusting the data security level, and ensuring data security management and control effects to a greater extent.

Those skilled in the art should understand that the above-mentioned data rights management device can be used to implement the data rights management method described above, and the detailed description should be similar to that described in the previous method. To avoid cumbersomeness, it will not be repeated here.

Based on the same idea, one or more embodiments of this specification also provide a data rights management device, as shown in FIG. 6. The data rights management device may have relatively large differences due to different configurations or performances, and may include one or more processors 601 and a memory 602, and the memory 602 may store one or more storage applications or data. Among them, the memory 602 may be short-term storage or persistent storage. The application program stored in the memory 602 may include one or more modules (not shown in the figure), and each module may include a series of computer-executable instructions for the data rights management device. Furthermore, the processor 601 may be configured to communicate with the memory 602, and execute a series of computer-executable instructions in the memory 602 on the data rights management device. The data rights management device may also include one or more power supplies 603, one or more wired or wireless network interfaces 604, one or more input and output interfaces 605, and one or more keyboards 606.

Specifically, in this embodiment, the data rights management device includes a memory and one or more programs. One or more programs are stored in the memory, and one or more programs may include one or more modules, and each Each module may include a series of computer-executable instructions in the data rights management device, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following: Data operation request; The data operation request is used to request the first operation to be performed on the first column of data in the target data set; the target data set includes multiple column data; each of the column data corresponds to its own security level; According to the data operation request, obtain the data operation authority information corresponding to the user and/or the security level of the first column of data; according to the data operation authority information and/or the security level, authenticate the user to the The permission of the first column of data to perform the first operation is obtained, and the authentication result is obtained; according to the authentication result, it is determined whether the user is allowed to perform the first operation on the first column of data.

Optionally, the data operation authority information includes first authority information corresponding to various operations that are authorized to perform on the target data set and/or first authority information corresponding to various operations that are authorized to perform on the first column of data. 2. Permission information.

Optionally, when the computer-executable instructions are executed, the processor may also cause the processor to: determine whether the second permission information contains the permission information corresponding to the first operation; if so, determine that the user has the right The first column of data has the right to perform the first operation; if not, according to the first permission information and/or the security level, authenticate the user to perform the first operation on the first column of data Operation authority.

Optionally, when the computer-executable instructions are executed, the processor may also make the processor: determine whether the first permission information contains the permission information corresponding to the first operation; if so, compare the user’s The security level and the security level of the first column of data, and the authorization of the user to perform the first operation on the first column of data is identified according to the comparison result; if not, it is determined that the user does not have the right to perform the first operation on the first column of data The permission of the first column of data to perform the first operation.

Optionally, when the computer-executable instructions are executed, the processor may also be caused to: if the comparison result is that the security level of the user is lower than the security level of the first column of data, determine the The user does not have the authority to perform the first operation on the first column of data; if the comparison result is that the security level of the user is not lower than the security level of the first column of data, the user is determined Have the authority to perform the first operation on the first column of data.

Optionally, when the computer-executable instructions are executed, the processor may also cause the processor to: receive a first permission application sent by the user to perform the first operation on the target data set; A first review result of a permission application for review; if the first review result is approved, then the permission information corresponding to the first operation is recorded in the first permission information.

Optionally, when the computer-executable instructions are executed, the processor may also cause the processor to: receive a second permission application sent by the user to perform the first operation on the first column of data; The second review result of the second permission application for review; if the second review result is approved, then the permission information corresponding to the first operation is recorded in the second permission information.

One or more embodiments of this specification also propose a computer-readable storage medium that stores one or more programs, and the one or more programs include instructions. When the instructions include multiple application programs When the electronic device is executed, the electronic device can execute the above-mentioned data authority management method, and is specifically used to execute: receiving a data operation request sent by a user; the data operation request is used to request execution of the first column of data in the target data set The first operation; the target data set includes a plurality of column data; each of the column data corresponds to its own security level; based on the data operation request, obtain the data operation authority information corresponding to the user and/or the first The security level of the column data; according to the data operation authority information and/or the security level, authenticate the user’s authority to perform the first operation on the first column of data to obtain the authentication result; according to the authentication Right result, it is determined whether the user is allowed to perform the first operation on the first column of data.

The systems, devices, modules, or units illustrated in the above embodiments may be specifically implemented by computer chips or entities, or implemented by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cell phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or Any combination of these devices.

For the convenience of description, when describing the above device, the functions are divided into various units and described separately. Of course, when implementing one or more embodiments of this specification, the functions of each unit may be implemented in the same one or more software and/or hardware.

Those skilled in the art should understand that one or more embodiments of this specification can be provided as a method, a system, or a computer program product. Therefore, one or more embodiments of this specification may adopt the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, one or more embodiments of this specification may adopt computer programs implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The form of the product.

One or more embodiments of this specification are described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to the embodiments of this application. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are used to generate It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

In a typical configuration, the computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.

Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

It should also be noted that the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or equipment including a series of elements not only includes those elements, but also includes Other elements that are not explicitly listed, or also include elements inherent to such processes, methods, commodities, or equipment. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, method, commodity, or equipment that includes the element.

One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments. In these distributed computing environments, tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the difference from other embodiments. In particular, as for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.

The above description is only one or more embodiments of this specification, and is not intended to limit this specification. For those skilled in the art, one or more embodiments of this specification may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification should be included in the scope of the claims of one or more embodiments of this specification.

Claims

A data authority management method, including:

Receive a data operation request sent by a user; the data operation request is used to request the first operation to be performed on the first column of data in the target data set; the target data set includes multiple column data; each column data corresponds to its own security grade;

Obtaining data operation authority information corresponding to the user and/or the security level of the first column of data based on the data operation request;

According to the data operation authority information and/or the security level, authenticate the user's authority to perform the first operation on the first column of data, and obtain an authentication result;

According to the authentication result, it is determined whether the user is allowed to perform the first operation on the first column of data.
The method according to claim 1, wherein the data operation authority information includes first authority information corresponding to various operations that are authorized to perform on the target data set and/or various operations that are authorized to perform on the first column of data. The second permission information corresponding to the class operation.
The method according to claim 2, wherein the authentication of the user's authority to perform the first operation on the first column of data according to the data operation authority information and/or the security level includes:

Determining whether the second authority information includes authority information corresponding to the first operation;

If yes, it is determined that the user has the authority to perform the first operation on the first column of data;

If not, according to the first authority information and/or the security level, the authority of the user to perform the first operation on the first column of data is authenticated.
The method according to claim 3, wherein the authenticating the user's authority to perform the first operation on the first column of data according to the first authority information and/or the security level includes:

Determining whether the first authority information includes authority information corresponding to the first operation;

If yes, compare the security level of the user with the security level of the first column of data, and authenticate the user's authority to perform the first operation on the first column of data according to the comparison result;

If not, it is determined that the user does not have the authority to perform the first operation on the first column of data.
The method according to claim 4, wherein the authentication of the user's authority to perform the first operation on the first column of data according to the comparison result comprises:

If the comparison result is that the security level of the user is lower than the security level of the first column of data, it is determined that the user does not have the authority to perform the first operation on the first column of data;

If the comparison result is that the security level of the user is not lower than the security level of the first column of data, it is determined that the user has the authority to perform the first operation on the first column of data.
The method according to claim 2, before the receiving the data operation request sent by the user, the method further comprises:

Receiving a first permission application sent by the user to perform the first operation on the target data set;

Determining the first review result of reviewing the first permission application;

If the first review result is approved, the authority information corresponding to the first operation is recorded in the first authority information.
The method according to claim 2 or 6, before the receiving the data operation request sent by the user, further comprising:

Receiving a second permission application sent by the user to perform the first operation on the first column of data;

Determining the second review result of reviewing the second permission application;

If the second review result is approved, the authority information corresponding to the first operation is recorded in the second authority information.
A data authority management device, including:

The receiving module receives a data operation request sent by a user; the data operation request is used to request a first operation to be performed on the first column of data in the target data set; the target data set includes multiple column data; each column data corresponds to Respective security level;

An obtaining module, based on the data operation request, obtaining data operation authority information corresponding to the user and/or the security level of the first column of data;

An authentication module, which authenticates the user's authority to perform the first operation on the first column of data according to the data operation authority information and/or the security level, and obtains an authentication result;

The determining module determines, according to the authentication result, whether to allow the user to perform the first operation on the first column of data.
The device according to claim 8, wherein the data operation authority information includes first authority information corresponding to various operations that are authorized to perform on the target data set and/or various operations that are authorized to perform on the first column of data. The second permission information corresponding to the class operation.
The device according to claim 9, wherein the authentication module comprises:

A judging unit, judging whether the second permission information includes permission information corresponding to the first operation;

A first determining unit, if the second authority information includes authority information corresponding to the first operation, determine that the user has the authority to perform the first operation on the first column of data;

The first authentication unit, if the second authority information does not include the authority information corresponding to the first operation, authenticate the user to the first operation according to the first authority information and/or the security level The permission for a list of data to perform the first operation.
The device according to claim 10, the first authentication unit:

Determining whether the first authority information includes authority information corresponding to the first operation;

If yes, compare the security level of the user with the security level of the first column of data, and authenticate the user's authority to perform the first operation on the first column of data according to the comparison result;

If not, it is determined that the user does not have the authority to perform the first operation on the first column of data.
The device according to claim 11, the first authentication unit:

If the comparison result is that the security level of the user is lower than the security level of the first column of data, it is determined that the user does not have the authority to perform the first operation on the first column of data;

If the comparison result is that the security level of the user is not lower than the security level of the first column of data, it is determined that the user has the authority to perform the first operation on the first column of data.
A data authority management device, including:

Processor; and

A memory arranged to store computer-executable instructions which, when executed, cause the processor to:

Receive a data operation request sent by a user; the data operation request is used to request the first operation to be performed on the first column of data in the target data set; the target data set includes multiple column data; each column data corresponds to its own security grade;

Obtaining data operation authority information corresponding to the user and/or the security level of the first column of data based on the data operation request;

According to the data operation authority information and/or the security level, authenticate the user's authority to perform the first operation on the first column of data, and obtain an authentication result;

According to the authentication result, it is determined whether the user is allowed to perform the first operation on the first column of data.
A storage medium for storing computer-executable instructions, which, when executed, implement the following processes:

Receive a data operation request sent by a user; the data operation request is used to request the first operation to be performed on the first column of data in the target data set; the target data set includes multiple column data; each column data corresponds to its own security grade;

Obtaining data operation authority information corresponding to the user and/or the security level of the first column of data based on the data operation request;

According to the data operation authority information and/or the security level, authenticate the user's authority to perform the first operation on the first column of data, and obtain an authentication result;

According to the authentication result, it is determined whether the user is allowed to perform the first operation on the first column of data.