WO2023236637A1

WO2023236637A1 - Data management method and device

Info

Publication number: WO2023236637A1
Application number: PCT/CN2023/085907
Authority: WO
Inventors: 黄爽; 王海靖
Original assignee: 华为云计算技术有限公司
Priority date: 2022-06-08
Filing date: 2023-04-03
Publication date: 2023-12-14
Also published as: CN117235092A

Abstract

The present application relates to the technical field of data management, and provides a data management method and device. The method comprises: receiving a target access request sent by a first client, the target access request being used for requesting to access a data set; obtaining an authentication rule of the data set, the authentication rule indicating that for any access request requesting to access the data set, when a first attribute value of any access request and a second attribute value of any data subset involved in any access request meet a preset rule, endowing any access request with the permission to access any data subset; obtaining a first attribute value of the target access request on the basis of user information of the target access request; and on the basis of the authentication rule, and a target data subset and the first attribute value involved in the target access request, authenticating the target access request, and returning a response to the target access request. According to the present application, a security administrator does not need to configure the authentication rule for each user, such that the configuration efficiency of the authentication rule is effectively improved.

Description

Data management method and device

This application claims priority to the Chinese patent application with application number 202210643182.9 and the invention title "Data Management Method and Device" submitted on June 8, 2022, the entire content of which is incorporated into this disclosure by reference.

Technical field

The present application relates to the field of data management technology, and in particular to a data management method and device.

Background technique

The database includes multiple data sets. A data set consists of multiple data subsets. Moreover, data of multiple users or user groups are usually stored in the database, and data of different users or user groups are stored in different data subsets of the database. In order to ensure data security, it is necessary to control user access requests for data in the database. For example, when the database includes multiple data tables, the data tables include multiple data rows, and the data of different users or user groups are stored in different data rows, it is necessary to control that each user can only write and read their own data row.

Currently, after creating a data set, security administrators need to configure a large number of authentication rules for the data set based on users. After the database receives the access request, the database will determine the authentication rule to be used to authenticate the access request from the large number of authentication rules based on the access request. And when the access request complies with the authentication rules, the access request is allowed to access the data subset. When the access request does not comply with the authentication rules, the access request is not allowed to access the data subset.

However, in this solution for permission control of access requests, the configuration efficiency of authentication rules is low, resulting in low efficiency of data management.

Contents of the invention

This application provides a data management method and device. This application does not require the security administrator to configure authentication rules for each user, which effectively improves the efficiency of configuring authentication rules, thereby improving the efficiency of data management. The technical solutions provided by this application are as follows:

In the first aspect, this application provides a data management method. The method includes: receiving a target access request sent by the first client. The target access request is used to request access to a data set. The data set has multiple attributes. The data subset in the data set includes attribute values corresponding to the multiple attributes. The target The access type of the access request includes writing data and/or reading data; the authentication rules for obtaining the data set, the authentication rules indicate: for any access request requesting access to the data set, when the first attribute value of any access request matches any When the second attribute value of any data subset involved in an access request satisfies the preset rules, any access request is given the permission to access any data subset, and the first attribute value is the corresponding authentication of the user information of any access request. The attribute value of the right keyword. The second attribute value is the attribute value of any data subset corresponding to the authentication keyword. The authentication keyword is used to indicate one or more of multiple attributes; based on the user information of the target access request , obtain the first attribute value of the target access request; based on the authentication rules, the target data subset involved in the target access request, and the first attribute value, authenticate the target access request, and return a response to the target access request.

Wherein, when the access request is a write data request, the data subset involved in the access request is the data subset written by the write data request. When the access request is a read data request, the data subset involved in the access request is the data subset in the data set read by the read data request. Authentication rules indicate the rules to be followed to authenticate access requests requesting access to the data set. The preset rule is the condition that the first attribute value and the second attribute value need to meet when the access request has access permission. For example, the pre- The rule may be that the first attribute value and the second attribute value are equal.

In the data management method provided by this application, after obtaining the user information and the attribute values corresponding to the sub-data sets involved in the access data according to the authentication keywords in the authentication rules, the user's access behavior can be based on the preset rules. Perform authentication. Different from the existing technology, the authentication rules in this solution are general rules applicable to all data subsets in the data set. The authentication rules include authentication keywords and corresponding preset rules instead of each data subset. Set specific permission rules. Therefore, this solution does not require the security administrator to configure access rights rules for each data subset, which effectively improves the efficiency of configuring authentication rules, thereby improving the efficiency of data management. When this data management method is applied to scenarios such as databases, big data SQL engines, or business intelligence, it can effectively improve the user experience of the corresponding scenarios, such as improving the ease of use of the SQL engine. The process of authenticating a target access request is a process of determining whether the second attribute value corresponding to the authentication keyword of the target data subset involved in the target access request and the first attribute value of the target access request satisfy the preset rules. In an implementable manner, the target access request is authenticated based on the authentication rules, the target data subset involved in the target access request, and the first attribute value, including: obtaining the target data subset from the target data subset. the second attribute value of the target access request; when the first attribute value of the target access request and the second attribute value of the target data subset meet the preset rules, grant the target access request the permission to access the target data subset; in the third attribute value of the target access request When the first attribute value and the second attribute value of the target data subset do not satisfy the preset rules, the target access request is not granted the permission to access the target data subset.

In an implementation scenario, the authentication key includes at least one of a user name, a user group name, and a role of the user.

In the first method of determining the authentication key, the authentication key can be the default one on the server side. In the second way of determining the authentication key, the authentication key may be specified by the user. In the third method of determining the authentication keyword, the server can specify the authentication content, the user can specify the attribute keyword used to represent the authentication content, and the server can use the attribute keyword used to represent the authentication content. Identified as the authentication key.

Optionally, obtaining the first attribute value of the target access request based on the user information of the target access request includes: querying the pre-stored relationship information based on the user information of the target access request, and obtaining the user information in the relationship information related to the target access request. The third attribute value corresponding to the authentication keyword; determine the third attribute value as the first attribute value of the target access request. The pre-stored relationship information may include relevant information of all users who may initiate access to the data set in the server. Corresponding to the data set having multiple attributes, the relationship information records the standard attribute values of each user corresponding to the multiple attributes. After receiving the access request, the server can query the relationship information according to the access request and obtain the third attribute value that belongs to the user who sent the target access request and is used to indicate the authentication keyword. In an implementable manner, the implementation process can be implemented by authenticating the access request.

As an implementation method, the user can specify the attribute keyword used to represent the authentication content in the maintenance request. Before receiving the target access request sent by the first client, the data management method further includes: receiving a maintenance request sent by the second client, where the maintenance request is used to request maintenance of the data set, and the maintenance request carries authentication content. The attribute keyword; determine the attribute keyword as the authentication keyword.

Among them, the maintenance request includes a creation request and a modification request. The attribute keyword indicating the authentication content is indicated in the creation request or the modification request. The creation request is used to request the creation of the data set, and the modification request is used to request the modification of the attributes of the data set. For example, the creation request may be a table creation request that requests the creation of a data table in the database. The modification request may be a table modification request used to request modification of attributes of the data table.

In an implementation manner, the data set is a data table, and the data subset is a data row in the data table.

In a second aspect, this application provides a data management device. The data management device includes: a receiving module, used to receive a target access request sent by the first client, the target access request is used to request access to a data set, and the data set has Multiple attributes. The data subset in the data set includes attribute values corresponding to multiple attributes. The access type of the target access request includes writing data and/or reading data; the acquisition module is used to obtain the authentication rules and authentication rules of the data set. Instruction: For any access request requesting access to a data set, when the first attribute value of any access request and the second attribute value of any data subset involved in any access request satisfy the preset rules, any access request is Request to grant permission to access any data subset. The first attribute value is the attribute value corresponding to the authentication keyword of the user information of any access request. The second attribute value is the attribute value corresponding to the authentication keyword of any data subset. , the authentication keyword is used to indicate one or more of multiple attributes; the acquisition module is also used to obtain the first attribute value of the target access request based on the user information of the target access request; the processing module is used to obtain the first attribute value of the target access request based on the authentication The rules, the target data subset and the first attribute value involved in the target access request are used to authenticate the target access request and return a response to the target access request.

Optionally, the processing module is specifically configured to: obtain the second attribute value of the target data subset from the target data subset; when the first attribute value of the target access request and the second attribute value of the target data subset satisfy a preset Rules grant a target access request permission to access a subset of the target data.

Optionally, the authentication key includes at least one of a user name, a user group name, and a role of the user.

Optionally, the acquisition module is specifically configured to: query pre-stored relationship information based on the user information of the target access request, and obtain the third attribute value corresponding to the user information and authentication keyword of the target access request in the relationship information; The third attribute value is determined as the first attribute value of the target access request.

Optionally, the receiving module is also configured to: receive a maintenance request sent by the second client, the maintenance request is used to request maintenance of the data set, the maintenance request carries an attribute keyword indicating the authentication content; determine the attribute keyword as Authentication keyword.

Optionally, the maintenance request includes a creation request and a modification request. The attribute keyword indicating the authentication content is indicated in the creation request or the modification request. The creation request is used to request the creation of the data set, and the modification request is used to request the modification of attributes of the data set.

Optionally, the data set is a data table, and the data subset is the data rows in the data table.

In a third aspect, this application provides a computer device, including a memory and a processor. The memory stores program instructions, and the processor runs the program instructions to execute the method provided in the first aspect of this application and any possible implementation thereof. .

In a fourth aspect, this application provides a computer cluster, including multiple computer devices. The multiple computer devices include multiple processors and multiple memories. Program instructions are stored in the multiple memories, and the multiple processors run the program instructions. The computer cluster is caused to execute the method provided in the first aspect of this application and any possible implementation manner thereof.

In a fifth aspect, the application provides a computer-readable storage medium. The computer-readable storage medium is a non-volatile computer-readable storage medium. The computer-readable storage medium includes program instructions. When the program instructions are stored on a computer device, When running, the computer device is caused to execute the method provided in the first aspect of the application and any possible implementation manner thereof.

In a sixth aspect, this application provides a computer program product containing instructions. When the computer program product is run on a computer, it causes the computer to execute the method provided in the first aspect of this application and any possible implementation thereof.

Description of the drawings

Figure 1 is a schematic diagram of an application scenario involved in a data management method provided by an embodiment of the present application;

Figure 2 is a schematic diagram of an application scenario involved in another data management method provided by an embodiment of the present application;

Figure 3 is a schematic diagram of a data management method provided by an embodiment of the present application implemented through multiple functional modules deployed on the server;

Figure 4 is a flow chart of a data management method for reading data requests provided by an embodiment of the present application;

Figure 5 is a flow chart of a method for obtaining authentication keywords of a data set provided by an embodiment of the present application;

Figure 6 is a flow chart of a method for obtaining the first attribute value of a target read data request provided by an embodiment of the present application;

Figure 7 is a flow chart of a data management method for writing data requests provided by an embodiment of the present application;

Figure 8 is a flow chart of a method for obtaining the first attribute value of a target write data request provided by an embodiment of the present application;

Figure 9 is a schematic structural diagram of a data management device provided by an embodiment of the present application;

Figure 10 is a schematic structural diagram of a computer device provided by an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

Databases usually store data from multiple users or multiple user groups, and data from different users or different user groups are stored in different data subsets of the database. In order to ensure the security of data, it is necessary to control the permissions of users' access requests to the database. In one implementation scenario, when the database includes multiple data tables, the data tables include multiple data rows, and the data of different users or different user groups are stored in different data rows, access requests need to be processed according to the data rows. Permission control refers to row-level data permission control to control that each user or user group can only write and read its own data rows.

For example, in the usage scenario of database or structured query language (SQL) engine, if audit logs are required, the background will record the operation results to the audit log for various operations performed by different users on the front-end interface. In this way, an audit log table in the background can contain data records belonging to different users. By controlling row-level data permissions on the audit log table, each user can only write and read his or her own data records. As shown in Table 1, rows 1 and 3 record the data of user 1, rows 2, 5 and 7 record the data of user 2, and rows 4, 6 and 8 record the data of user 3, then By performing row-level data permission control on the audit log table, only user 1 is allowed to read and write data recorded in rows 1 and 3, user 2 is allowed to read and write data recorded in rows 2, 5, and 7, and user 3 is allowed to read and write data recorded in rows 4 and 7. Data recorded in rows 6 and 8.

Table 1

For another example, in a scenario where organizations or regions are distinguished, through row-level data permission control, when users from different organizations/regions access a certain data table, each user can only read and write data rows in his or her own organization/region. . As shown in Table 2, rows 1 and 3 record the data of department 1, rows 2 and 5 record the data of department 2, rows 4 and 6 record the data of department 3, and rows 7 and 8 The data recorded is the data of department 4. By performing row-level data permission control, only Users in department 1 can read and write data recorded in rows 1 and 3, users in department 2 can read and write data recorded in rows 2 and 5, users in department 3 can read and write data recorded in rows 4 and 6, and users in department 4 can read and write data recorded in rows 2 and 5. Read and write the data recorded in lines 7 and 8.

Table 2

Currently, after creating a data set, the security administrator needs to configure authentication rules for each access object (such as a user or user group) that needs to access the data set, so that the data rows in the data set can be authorized according to the authentication rules. control. However, the database can accommodate many data rows, and there are many access objects that require access. It takes a lot of time for security administrators to configure authentication rules and is error-prone. The configuration efficiency of authentication rules is low, resulting in data management. The efficiency is lower. Moreover, the authentication rules configured by the security administrator are usually represented by specific expressions. When authenticating access requests according to the authentication rules, they need to match the authentication rules of all data rows in the database. The authentication rules that need to match Excessive number leads to poor read and write performance of the database.

The embodiment of this application provides a data management method. By obtaining the authentication rules of the data set requested by the target access request, based on the user information of the target access request, obtain the first attribute value of the target access request, and control the authentication that is too narrow, the target data subset involved in the target access request, and The first attribute value authenticates the target access request and regulates the response to the target access request.

The data set has multiple attributes, the data subset in the data set includes attribute values corresponding to the multiple attributes, and the access type of the target access request includes writing data and/or reading data. When the access request is a write data request, the data subset involved in the access request is the data subset written by the write data request. When the access request is a read data request, the data subset involved in the access request is the data subset in the data set read by the read data request. Authentication rules indicate the rules to be followed to authenticate access requests requesting access to the data set. In the embodiment of this application, the authentication rule indicates: for any access request requesting access to a data set, when the first attribute value of any access request is the same as the second attribute value of any data subset involved in any access request, When preset rules are met, any access request is granted access to any subset of data. The first attribute value is the attribute value of the authentication keyword corresponding to the user information of any access request. The second attribute value is the attribute value corresponding to the authentication key of any data subset. The authentication key is used to indicate one or more of multiple attributes of the data set. The preset rule is the condition that the first attribute value and the second attribute value need to meet when the access request has access permission. For example, the preset rule may be that the first attribute value and the second attribute value are equal.

In this data management method, after obtaining the authentication rules of the data set, it is also necessary to obtain the first attribute value of the target access request based on the user information of the target access request, and then verify the target access request based on the authentication rules and the first attribute value. access request Performing authentication, we can see that the authentication rules are general rules applicable to all data subsets in the data set, rather than rules bound to the user. Therefore, there is no need for the security administrator to configure authentication rules for each user, which effectively improves the efficiency of configuring authentication rules, thereby improving the efficiency of data management. Moreover, during the authentication process, authentication is based on the authentication rules of the data set requested by the target access request. There is no need to match a large number of authentication rules, which reduces the complexity of data management and helps improve data reading. Write performance.

Figure 1 is a schematic diagram of an application scenario involved in a data management method provided by an embodiment of the present application. As shown in Figure 1, the application scenario includes: a first client 10 and a server 20. A communication connection is established between the first client 10 and the server 20 . Among them, the first client 10 is used to send an access request to the server 20 . The server 20 is configured to use the data management method provided by the embodiment of the present application to authenticate the received access request, and respond to the access request according to the authentication result. Furthermore, the process of the server 20 authenticating the access request may include: obtaining the authentication rules of the data set, obtaining the first attribute value of the target access request based on the user information of the target access request; based on the authentication rules, the target access request The target data subset and the first attribute value are involved, the target access request is authenticated, and a response to the target access request is returned.

Optionally, the authentication keyword in the embodiment of this application may be defaulted by the server 20 . Alternatively, the authentication key can be user-specified. Alternatively, the server can specify the authentication content, the user can specify the attribute keyword used to represent the authentication content, and the server can determine the attribute keyword used to represent the authentication content as the authentication keyword. This application implements The example does not specifically limit it. For example, the administrator of the server can specify an authentication keyword and require a subset of data stored in the server to be authenticated using this authentication keyword. At this time, the authentication keyword is the server's default. For another example, the user can instruct to create a data set in the server, and the user can specify an authentication key used to authenticate the data subset in the data set. At this time, the authentication key is specified by the user. For another example, the administrator of the server can specify the authentication content and require a subset of data stored in the server to use the authentication content for authentication. The user can specify the attribute keyword used to represent the authentication content, and the server can determine the authentication keyword based on it. At this time, the server specifies the authentication content, and the user specifies the attribute keyword used to represent the authentication content.

In an implementable manner, as shown in FIG. 2 , the application scenario may also include a second client 30 . The second client 30 has established a communication connection with the server 20 . The second client 30 has the authority to maintain the data set on the server 20 . For example, the second client 30 has the authority to create a data set on the server 20 and/or modify the attributes of the data set. In an implementation scenario, the server 20 can specify the authentication content, and the second client 30 can send a maintenance request to the server 20 and indicate in the maintenance request an attribute keyword used to represent the authentication content. After the server 20 obtains the maintenance request, it can identify the attribute keyword representing the authentication content in the maintenance request according to the authentication content, and determine the attribute keyword as the authentication keyword. Optionally, the maintenance request may be a creation request requesting to create a data set in the server 20 . Alternatively, the maintenance request may be a modification request requesting modifications to an attribute of the data set. It should be noted that the first client that sends the access request and the second client that sends the maintenance request may also be the same client, which is not specifically limited in the embodiment of this application.

Optionally, the first client 10, the second client 30 and the server 20 can be implemented by a physical machine, a physical machine cluster including multiple physical machines, a bare metal server, a cloud server, a virtual machine or a container, etc. Moreover, the server 20 can be implemented through software. Moreover, the server 20 can be independently deployed on a physical machine, a physical machine cluster, a bare metal server, a cloud server, a virtual machine or a container, or the server 20 can be deployed in a distributed manner on multiple physical machines or multiple physical machines. On one or more of a cluster, multiple bare metal servers, multiple cloud servers, multiple virtual machines, and multiple containers. It should be understood that the server 20 can also be deployed on the same physical device as the first client 10 or the second client 30 .

In an implementation manner, the server 20 may be deployed on one or more of a physical machine, a physical machine cluster, a bare metal server, a cloud server, a virtual machine, and a container on a cloud platform. A large number of basic resources owned by cloud service providers are deployed in the cloud platform. For example, computing resources, storage resources, network resources, etc. are deployed in the cloud platform, and the computing resources can be a large number of computer devices (such as servers). The server 20 can utilize the basic resources deployed in the cloud platform to implement the data management method provided by the embodiment of the present application to authenticate the access request from the first client 10 and respond to the access request according to the authentication result.

At this time, the data management method provided by the embodiment of the present application can be abstracted by the cloud service provider on the cloud platform into a cloud service for managing data and provided to the user. After the user purchases the cloud service on the cloud platform, the cloud platform can use the server 20 to provide the user with cloud services for data management. In an implementation scenario, the user can write data to the server 20 and read data from the server 20 . After receiving the user's access request for writing or reading data, the server 20 uses the data management method provided by the embodiment of the present application to authenticate the access request, and responds to the access request according to the authentication result. In another implementation scenario, the cloud service can serve as an add-on feature to other services. For example, users may offer services to save data and provide data to other users. However, in order to improve data security, users can purchase this cloud service. When a user's client receives an access request sent by another client, the user can use the cloud service to decide how to respond to the access request. At this time, the cloud service can use the data management method provided by the embodiment of the present application to authenticate the access request, and feed back the authentication result to the user, so that the user can respond to the access request based on the authentication result.

It should be noted that in the embodiment of the present application, the cloud platform may be a cloud platform of a central cloud, an edge cloud, or a cloud platform including a central cloud and an edge cloud, which is not specifically limited in the embodiment of the present application. Moreover, when the cloud platform is a cloud platform including a central cloud and an edge cloud, the server 20 may be partially deployed in the cloud platform of the edge cloud and partially deployed in the cloud platform of the central cloud.

Moreover, the data management method provided by the embodiments of this application can be applied to scenarios such as databases, big data SQL engines, or business intelligence (BI) that require permission control on data subsets. Moreover, the big data SQL engine can be an engine such as Hive or Spark. Correspondingly, the server 20 may be the server 20 of the engine.

In an implementation manner, the data management method provided by the embodiment of the present application can be implemented through a functional module deployed on the server 20 . Moreover, the functional module can be specifically implemented by a computer device executing a computer program. Alternatively, the data management method provided by the embodiment of the present application can be implemented through multiple functional modules deployed on the server 20 . The multiple functional modules can be deployed in a centralized manner or in a distributed manner. Correspondingly, the plurality of functional modules can be specifically implemented by one or more computer devices executing computer programs. Each computer device in the one or more computer devices can implement part or all of the functions in the data management method provided by the embodiments of the present application.

FIG. 3 is a schematic diagram of a data management method provided by an embodiment of the present application implemented through multiple functional modules deployed on the server 20 . As shown in Figure 3, the server 20 includes: a data reading and writing module 201, a metadata module 202, an authentication module 203 and a data storage module 204. The metadata module 202 is used to store description information of the data set. The authentication module 203 is used to authenticate the user based on the access request sent by the first client, and feed back the authentication result to the data reading and writing module 201, so that the data reading and writing module 201 determines the first attribute value according to the authentication result. The data storage module 204 is used to store data written into the data set. The data reading and writing module 201 is used to receive the access request, obtain the description information of the data set requested by the access request from the metadata module 202 based on the access request, obtain the authentication result of the access request through the authentication module 203, and obtain the authentication result of the access request according to the description information. and the authentication result, execute the data management method provided by the embodiment of this application, authenticate the access request, and respond to the access request based on the authentication result. Among them, the implementation process of each module in Figure 3 to realize its function, Please refer to the relevant descriptions in the method embodiments below.

It should be understood that the above content is an exemplary description of the application scenarios of the data management method provided by the embodiment of the present application, and does not constitute a limitation on the application scenarios of the data management method. Persons of ordinary skill in the art will know that as business needs evolve, Changes and application scenarios can be adjusted according to application requirements, and the embodiments of this application do not list them one by one.

The following describes the implementation process of the data management method provided by the embodiment of the present application. Moreover, since the access request can be a read data request or a write data request, and the process of implementing the data management method is different for read data requests and write data requests, so the following is respectively for read data requests and write data requests. The implementation process of this data management method is explained. As shown in Figure 4, for a read data request, the implementation process of the data management method includes the following steps:

Step 401: Obtain the authentication keyword of the data set.

A dataset is a collection of data that includes one or more subsets of data. The dataset has several properties. All data subsets that can be recorded in the data set include attribute values corresponding to the multiple attributes. In one implementation, the data set can be a data table. A data table has one or more data rows and multiple data columns. At this time, the data subset can be the data rows in the data table. Different data rows are used to record information about different objects. Data columns are used to represent attributes of a data table. The content located in different columns in the data row is the attribute value of the attribute represented by the corresponding column. When the data table includes multiple data columns, the multiple data columns respectively represent multiple attributes of the data table. Or, the data subset is the data column in the data table, and the data row is used to represent the attribute of the data table. For example, as shown in Table 3, the data set is a data table for a company that counts employee attendance. The data table includes multiple rows and columns, and the data rows record the attendance information of different employees. Data columns are used to represent attributes of a data table. The attributes of this data table include: user name, user number, user group name, date, working time and off work time. The contents in different columns in a data row respectively represent the attribute values of user name, user number, user group name, date, working time and off-duty time. For example, for the data row used to represent the attendance information of employee Zhang **, the contents represented by the data in this data row are: the content of the first column indicates that the attribute value of the user name is Zhang **, and the content of the second column indicates the user number. The attribute value of is 010001, the attribute value of the third column indicating the user group name is Development Department, the attribute value of the fourth column indicating the date is 2022/5/10, and the attribute value of the fifth column indicating working hours is 08: 56. The sixth column indicates that the attribute value of off-duty time is 20:56.

table 3

The authentication key is used to indicate one or more of multiple attributes of the data set. And the multiple attributes indicated by the authentication keyword can be part or all of the multiple attributes of the data set. When the authentication keyword is used to indicate one of multiple attributes of the data set, the server is used to perform authentication based on an attribute indicated by the authentication keyword. For example, for the data set shown in Table 3, the authentication keyword can indicate the user group name in multiple attributes of the data set, and the server can perform authentication based on the user group name. When the authentication keyword is used to indicate multiple attributes of the data set, the server is configured to perform authentication based on the multiple attributes indicated by the authentication keyword. For example, for the data set shown in Table 3, the authentication keyword can indicate the user group name and user name in multiple attributes of the data set, and the server can perform authentication based on the user group name and user name. Moreover, in this embodiment of the present application, all data subsets in the data set use the same authentication keyword. For example, when the authentication key indicates that the data set has multiple When one of the attributes is specified, all data subsets in the data set are authenticated using the authentication key indicating an attribute. For example, when the authentication key indicates more than one of multiple attributes of the data set, all data subsets in the data set are authenticated using the authentication key indicating the multiple attributes, and all data subsets use the authentication Multiple attributes indicated by keywords all correspond to the same.

In the embodiments of this application, the authentication keywords may be determined in various ways. The embodiments of this application take the following examples as examples to illustrate:

In the first determination method, the authentication keyword can be the server's default one. For example, the administrator of the server can specify an authentication keyword and require a subset of data stored in the server to use the authentication keyword for authentication. Furthermore, administrators can specify that all data subsets stored in the server be authenticated using this authentication keyword. Alternatively, administrators can instruct different types of data subsets to be authenticated using different authentication keys.

In the second determination method, the authentication key may be specified by the user. For example, a user can instruct a data set to be created in the server, and the user can specify an authentication key used to authenticate a data subset in the data set. Moreover, for different data sets, the authentication keywords specified by the user can be the same or different.

In the third determination method, the server can specify the authentication content, the user can specify the attribute keyword used to represent the authentication content, and the server can determine the attribute keyword used to represent the authentication content as the authentication key. Character. For example, the administrator of the server can specify the authentication content and require a subset of data stored in the server to use the authentication content for authentication. Moreover, the administrator can specify that all data subsets stored in the server use this authentication content for authentication, or can instruct different types of data subsets to use different authentication content for authentication. Furthermore, different data may be represented in different ways, so the attribute keywords used by different data to represent the same authentication content may be different. Then the user can specify the attribute keyword used to represent the authentication content, and the server can determine the authentication keyword based on it.

As an implementation method, in the scenario where the server specifies the authentication content, the user can specify the attribute keyword used to represent the authentication content in the maintenance request. Correspondingly, as shown in Figure 5, step 401 may include: step 4011, receiving a maintenance request sent by the second client. The maintenance request is used to request maintenance of the data set, and the maintenance request carries attributes used to represent the authentication content. Keyword; Step 4012: Determine the attribute keyword as the authentication keyword.

Optionally, maintenance requests may include build requests and modification requests. The attribute keyword may be indicated in a create request or modify request. Among them, the create request is used to request the creation of a data set. Modify requests are used to request modifications to attributes of a dataset. Modifying the attributes of the data set may include: adding attributes to the data set and/or modifying the original attributes of the data set to other attributes. For example, the creation request may request to create a data table. The table creation request indicates multiple attributes that the data table needs to have, and one of the multiple attributes is used to represent the authentication content. After receiving the table creation request, the server can determine the attribute keyword used to represent the attribute of the authentication content, and determine the attribute keyword as the authentication keyword. For another example, the creation request only requests the establishment of a data table in the server, without specifying the attributes that the data table needs to have, or it specifies the attributes that the data table needs to have, but does not specify which attribute is used to represent the authentication content. Then the user can specify content not specified in the creation request by modifying the request. At this time, the server can determine the authentication keyword according to the instruction of the modification request. Among them, the table creation request can be a data definition language (DDL) statement.

For example, a table creation request can be:

CREATE TABLE AUDIT_LOG(ACCOUNT INT,TIME_STAMP TIMESTAMP,LOG STRING)TBLPROPERTIES('row.access.user.mapping.columns'='ACCOUNT','row.access.type'='RW');

Alternatively, the table creation request can be:

CREATE TABLE AUDIT_LOG(ACCOUNT INT,TIME_STAMP TIMESTAMP,LOG STRING);

ALTER TABLE AUDIT_LOG SET TBLPROPERTIES('row.access.user.mapping.columns'='ACCOUNT','row.access.type'='RW');

Optionally, the server can authenticate the data read request based on the user information of the access request. Then, after the server determines the attribute keyword used to represent the user information based on the establishment request or modification request, the server can determine the attribute keyword as Authentication keyword. Furthermore, the authentication key may include at least one of a user name, a user group name, and a role of the user. Among them, the user's role can be root user, etc. For example, when the establishment request indicates that the attribute keyword "user group name" is used to represent user information, the server can determine the attribute keyword used to represent the authentication content based on the establishment request and the authentication content that is authenticated based on the user information. is the "user group name", then the "user group name" can be determined as the authentication key. It should be noted that authentication based on user information is an example and is not used to limit the implementation of authentication. For example, authentication can also be performed based on information such as the Internet protocol address (IP) address of the request to access the data set, which is not specifically limited in the embodiments of this application.

In an implementable manner, when the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, completing step 401 requires collaborative implementation of the data reading and writing module and the metadata module. Among them, the data reading and writing module is used to receive a creation request or a modification request, and determine metadata such as the data set name of the data set, the attribute keywords of multiple attributes of the data set, and the owner of the data set according to the creation request or modification request. information and transmit metadata information to the metadata module. The data reading and writing module is also used to determine the authentication keyword based on the establishment request or modification request, and transmit the authentication keyword to the metadata module. The metadata module is used to store the above metadata information and authentication keywords.

Step 402: Receive a target read data request sent by the first client, where the target read data request is used to request to read a data set.

When the user needs to read data in the data set, he or she can send a target data read request to the server through the first client. The target read data request needs to indicate the data set it requests to read, so that after receiving the target read data request, the server can authenticate the target read data request according to the instruction, and authenticate the target read data based on the authentication result. Request a response.

In an implementable manner, when the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, step 402 is executed by the data reading and writing module.

Step 403: Obtain the authentication rules of the data set. The authentication rules indicate: for any read data request requesting to read the data set, when the first attribute value of any read data request matches the value of any data subset in the data set, When the second attribute value satisfies the preset rule, any data read request is given the permission to read any data subset.

The process of obtaining authentication rules for a data set is the process of determining common rules that apply to all data subsets in the data set. For example, when the authentication rules of a data set indicate authentication based on the authentication keyword "user group name", then all data subsets in the data set need to be authenticated based on the authentication keyword "user group name" . In this embodiment of the present application, the server configures authentication rules for each data set managed by the server based on the authentication keyword of the data set. After determining the data set requested by the target read data request, the server can query based on the data set to obtain the authentication rules configured by the server for the data set. It should be noted that for multiple data sets managed by the server, the authentication rules of different data sets may be the same or different, which is not specifically limited in the embodiments of this application.

Authentication rules are used to authenticate read data requests. Optionally, the authentication rules can perform authentication based on the user information of the read data request and the data subset involved in the read data request. For example, the authentication rules may indicate that when the user information of the read data request and the data subset involved in the read data request satisfy the preset rules, the read data request shall be given the right to read the corresponding data subset. limit. In an implementable manner, the authentication rule may indicate: for any read data request requesting to read the data set, when the first attribute value of any read data request is consistent with any data sub-item involved in any read data request, When the second attribute value of the set meets the preset rules, any read data request is given the permission to read any data subset. The first attribute value is the attribute value of the authentication keyword corresponding to the user information of any data read request. The second attribute value is the attribute value corresponding to the authentication key of any data subset in the data set. The authentication key is used to indicate one or more of multiple attributes of the data set. The preset rule is the condition that the first attribute value and the second attribute value need to meet when the read data request has read permission. For example, the preset rule may be that the first attribute value and the second attribute value are equal.

Optionally, the authentication rules can also limit different control permissions for access requests. The control permissions for access requests include: write permission, read permission, and read-write permission. Authentication rules can limit different control rights of access requests through different authentication keywords. In an implementable manner, the authentication rule may indicate: for a read data request, when the first attribute value A of the read data request is the same as the second attribute value A of any data subset in the data set requested by the read data request, When the preset rules are met, the read data request is given permission to read any data subset. When the first attribute value B of the write data request and the second attribute value B of the data subset requested to be written into the data set satisfy the preset rules, the write data request is given the ability to write the data subset into the data set. permissions. When the first attribute value A of the access request and the second attribute value A of any data subset involved in the access request satisfy the preset rules, and the first attribute value B of the access request is consistent with the second attribute value A of any data subset involved in the access request, When the second attribute value B satisfies the preset rules, the access request is given the permission to read and write the data subset.

Alternatively, the authentication rules can also limit different control rights of access requests through preset rules. For example, when the preset rule includes a first preset rule and a second preset rule, when the first attribute value of the read data request and the second attribute value of any data subset in the data set requested by the read data request satisfy the first When a preset rule is set, the read data request is given permission to read a subset of the data. When the first attribute value of the write data request and the second attribute value of the data subset requested to be written into the data set by the write data request satisfy the second preset rule, the write data request is given the permission to write the data subset into the data set. . When the first attribute value of the access request and the second attribute value of any data subset involved in the access request satisfy the second preset rule, and the first attribute value of the access request and the second attribute value of the data subset involved in the access request When the value satisfies the second preset rule, the access request is given permission to read and write the data subset.

When the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, step 403 is executed by the data reading and writing module.

Step 404: Obtain the first attribute value of the target data read request based on the user information of the target data read request.

The authentication rules of a data set are general rules that apply to all data subsets in the data set. However, for different data subsets in the data set, the attribute values corresponding to the authentication keywords they carry are different. Therefore, after determining the general rules of the data set, the general rules need to be instantiated to obtain the information involved in the access request. Instantiation rules that apply to subsets of data.

Authentication of an access request is to determine whether the user who sends the access request has the authority to access the data subset involved in the access request. Specifically, it is to determine the first attribute value corresponding to the user information and the second attribute corresponding to the data subset. The process of checking whether the values match. Since the accurate correspondence between users and attributes of the data set can be collected in advance through legal channels, general rules can be instantiated based on user information. At this time, the process of instantiating general rules is the process of establishing applicable authentication rules for each user. Correspondingly, the process of establishing general rules can be regarded as the process of establishing rules for "authentication using the authentication keyword as the key". The process of instantiating general rules can be seen as the process of assigning "key" to "value" and obtaining the instantiation rule of "key=value" (that is, authentication key=first attribute value).

In an implementable manner, as shown in Figure 6, the implementation process of instantiating general rules based on user information includes:

Step 4041: Query the pre-stored relationship information based on the user information requested by the target data read, and obtain the third attribute value in the relationship information corresponding to the user information requested by the target data read and the authentication keyword.

The pre-stored relationship information includes information about all users who may initiate access to the data set in the server. Corresponding to the data set having multiple attributes, the relationship information records the standard attribute values corresponding to the multiple attributes for each user. After receiving the target read data request, the server can query the relationship information according to the user information of the target read data request, and obtain the third attribute value that belongs to the user who sent the target read data request and is used to indicate the authentication keyword. For example, assume that the attribute keys of the data set are "user name", "user number", "user group name", "date", "working time" and "off duty time", and the authentication key is "user group" Name", the correspondence recorded in the relationship information includes: the relationship between the user's user name, user number, user group name of the user group to which the user belongs, and other standard attribute values of attribute keywords. After receiving the target data read request sent by the client, the server can query the relationship information according to the user information of the target data read request, and obtain the third attribute value of the "user group name" corresponding to the user. The fact that the relationship information records standard attribute values means that the attribute values recorded in the relationship information are all accurate attribute values corresponding to the user. Therefore, after determining the first attribute value based on the standard attribute value, if the second attribute value of the data subset requested by the user to read matches the first attribute value, it can be considered that the user has the permission to read the data subset, otherwise The user does not have permission to read this subset of data. The content recorded in the relationship information can be obtained through pre-collection (such as filing), and its content has high credibility.

In an implementable manner, the implementation process of step 4041 can be implemented by authenticating the target read data request. After the target read data request is authenticated according to the user information of the target read data request, the relationship information corresponding to the user information can be obtained, and then the third attribute value corresponding to the user information is determined based on the relationship information, and then the first attribute value is obtained. In an implementation scenario, when the data management method provided by the embodiment of this application is applied to a big data engine such as Hive or Spark, the server can be the corresponding engine server. Correspondingly, this step 4041 can be implemented by the engine server through user authentication modules such as lightweight directory access protocol (lightweight directory access protocol, LDAP) and Kerberos.

Moreover, when the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, completing step 4041 requires collaborative implementation of the data reading and writing module and the user authentication module. The user authentication module is used to authenticate the target data read request, obtain the third attribute value, and transmit the third attribute value to the data reading and writing module.

Step 4042: Determine the third attribute value as the first attribute value of the target read data request.

Since the relationship information records the standard attribute values corresponding to multiple attributes of the user and the data set, after the third attribute value is obtained based on the relationship information, the third attribute value can be determined as the first attribute value.

Table 4

For example, assume that Table 3 is part of the data table read by the target read data request, Table 4 is the relationship information corresponding to the data table, and the authentication key is "user group name". After receiving the target read data request sent by the user "Zhang**", the server queries the relationship information shown in Table 4 based on the user information used to indicate the user "Zhang**", and obtains the corresponding data for the user "Zhang**" If the third attribute value of "User Group Name" is "Development Department", then "Development Department" can be determined as the first attribute value.

When the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, the data reading and writing module performs step 4042.

Step 405: Obtain the second attribute value of the target data subset from the target data subset of the data set read by the target read data request.

After obtaining the first attribute value of the target read data request, the instantiation rule applicable to the data subset involved in the target read data request is obtained. Then the target read data request can be authenticated according to the instantiation rule, that is, based on the authentication rules, the target data subset of the data set read by the target read data request request, and the first attribute value, the target read data request can be authenticated. Authentication. When authenticating the target read data request, you can first obtain the second attribute value of each target data subset in the data set read by the target read data request request, and then authenticate the target read data request based on the second attribute value. . In an implementable manner, after determining the authentication keyword, the attribute value of each target data subset of the data set corresponding to the authentication keyword can be determined, and the attribute value can be determined as the corresponding target data subset. Two attribute values. For example, assuming that the authentication keyword is "user group name" and the data table requested by the target read data request is Table 3, then you can obtain based on the authentication keyword: The number of the data row corresponding to the user name "Zhang**" The second attribute value is "Development Department", the second attribute value of the data row corresponding to the user name "Li**" is "Process Department", and the second attribute value of the data row corresponding to the user name "Wang**" is "Personnel" department".

When the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, completing step 405 requires collaborative implementation of the data reading and writing module, the metadata module and the data storage module. Among them, the data reading and writing module needs to obtain the metadata information of the data set from the metadata module. According to the metadata information, read the data set requested by the target read data request from the data storage module, and obtain each target in the data set. The second attribute value of the data subset. In one implementation, when the data management method provided by the embodiment of the present application is applied to a big data engine such as Hive or Spark, the data reading and writing module can obtain the metadata information of the data set from the table AUDIT_LOG of the metadata module, And the data storage module can be implemented through Hadoop distributed file system (hadoop distributed file system, HDFS).

Step 406: Authenticate the target read data request based on the first attribute value of the target data read request and the second attribute value of the target data subset, and return a response to the target read data request.

The authentication results include two types: the second attribute value of the target data subset and the first attribute value of the target read data request satisfy the preset rules; and the second attribute value of the target data subset matches the first attribute value of the target read data request. The attribute value does not meet the preset rules. Correspondingly, responding to the read data request includes: when the second attribute value of the target data subset and the first attribute value of the target read data request satisfy the preset rules, determining that the target read data request has the ability to read the target data subset. Permission: When the second attribute value of the target data subset and the first attribute value of the target data read request do not meet the preset rules, it is determined that the target data read request does not have the permission to read the target data subset. Moreover, since the target read data request requests to read a data set, and the data set includes one or more target data subsets, the server needs to authenticate all target data in the data set during the process of authenticating the target read data request. subset for authentication. And when the target read data request has the permission to read any target data subset, the target data subset is loaded into the memory. When the target read data request does not have permission to read any target data subset, the target data subset is prohibited from being loaded into memory. Then, after completing the authentication process for all target data subsets in the data set, all target data subsets loaded in the memory and belonging to the data set are fed back to the first client to complete the target read data request. The process of responding.

When the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, the data reading and writing module performs step 406.

As shown in Figure 7, for a write data request, the implementation process of the data management method includes the following steps:

Step 701: Obtain the authentication keyword of the data set.

Please refer to the corresponding content in step 401 for the implementation process of step 701, which will not be described again here.

Step 702: Receive a target write data request sent by the first client. The target write data request is used to request to write a target data subset into the data set.

When the user needs to write a data subset into the data set, the user can send a target data writing request to the server through the first client. The target write data request needs to indicate the data set it requests to write, so that after the server receives the target write data request, it can authenticate the target write data request according to the instruction, and write the target data according to the authentication result. Request a response. In an implementable manner, when the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, step 702 is executed by the data reading and writing module.

Step 703: Obtain the authentication rules of the data set. The authentication rules indicate: for any write data request requesting to write data to the data set, when the first attribute value of any write data request matches any data requested to be written, When the second attribute value of the subset satisfies the preset rule, any write data request is given the permission to write any data subset to the data set.

The first attribute value is the attribute value of the authentication keyword corresponding to the user information of any write data request. The second attribute value is the attribute value corresponding to the authentication key of any data subset requested to be written. An authentication key is used to indicate one or more of multiple attributes.

When the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, step 403 is executed by the data reading and writing module. Moreover, please refer to the corresponding content in step 403 for the implementation process of step 703, which will not be described again here.

Step 704: Based on the target write data request, obtain the first attribute value of the target write data request.

As shown in Figure 8, the implementation process of step 704 includes: Step 7041: Based on the user information of the target write data request, query the pre-stored relationship information, and obtain the user information and authentication keywords in the relationship information related to the target write data request. The corresponding third attribute value. Step 7042: Determine the third attribute value as the first attribute value of the target write data request. When the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, completing step 7041 requires collaborative implementation of the data reading and writing module and the user authentication module. Similarly, the data reading and writing module performs step 7042. For the implementation process of step 704, please refer to the corresponding content in step 404, which will not be described again here.

Step 705: Obtain the second attribute value of the target data subset from the target data subset written by the target write data request.

After the authentication keyword is determined, an attribute keyword indicating the authentication keyword in the target data subset to be written can be determined, and the attribute value of the attribute keyword is determined as the second attribute value of the target data subset. When the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, completing step 705 requires collaborative implementation of the data reading and writing module, the metadata module and the data storage module. Please refer to the corresponding content in step 405 for the implementation process of step 705, which will not be described again here.

Step 706: Authenticate the target write data request based on the first attribute value of the target data write request and the second attribute value of the target data subset, and return a response to the target write data request.

When the second attribute value of the target data subset and the first attribute value of the target write data request satisfy the preset rule, it is determined that the target write data request has the permission to write the target data subset. At this time, responding to the target write data request includes: writing the target data subset into the data set. When the second attribute value of the target data subset and the first attribute value of the target read data request do not satisfy the preset rules, it is determined that the target write data request does not have the permission to write the target data subset. At this time, the response to the target write data request includes: refusing to write the target data subset into the data set. When the functions of the server are collaboratively implemented through multiple functional modules in Figure 3, the data reading and writing module performs step 706.

To sum up, in the data management method provided by the embodiment of the present application, after obtaining the authentication rules of the data set, the server also needs to obtain the first attribute value of the target access request based on the user information of the target access request. And authenticate the target access request based on the authentication rules and the first attribute value. It can be seen that the authentication rules are applicable to all data subsets in the data set. Use general rules rather than user-bound rules. Therefore, there is no need for the security administrator to configure authentication rules for each user, which effectively improves the efficiency of configuring authentication rules, thereby improving the efficiency of data management. At this time, when this data management method is applied to scenarios such as databases, big data SQL engines, or business intelligence, it can effectively improve the user experience of the corresponding scenarios, such as improving the ease of use of the SQL engine. Moreover, during the authentication process, authentication is based on the authentication rules of the data set requested by the target access request. There is no need to match a large number of authentication rules, which reduces the complexity of data management and helps improve data reading. Write performance.

It should be noted that the sequence of the steps of the data management method provided by the embodiments of the present application can be adjusted appropriately, and the steps can also be increased or decreased accordingly according to the situation. Any person familiar with the technical field can easily think of changing methods within the technical scope disclosed in this application, which should be covered by the protection scope of this application, and therefore will not be described again.

An embodiment of the present application also provides a data management device. As shown in Figure 9, the data management device 90 includes:

The receiving module 901 is used to receive a target access request sent by the first client. The target access request is used to request access to a data set. The data set has multiple attributes. The data subset in the data set includes attribute values corresponding to the multiple attributes. , the access type of the target access request includes writing data and/or reading data.

The acquisition module 902 is used to obtain the authentication rules of the data set. The authentication rules indicate: for any access request requesting access to the data set, when the first attribute value of any access request matches any data involved in any access request When the second attribute value of the subset meets the preset rules, any access request is given the permission to access any data subset. The first attribute value is the attribute value of the authentication keyword corresponding to the user information of any access request. The second attribute value is the attribute value corresponding to the authentication key of any data subset, and the authentication key is used to indicate one or more of multiple attributes.

The obtaining module 902 is also configured to obtain the first attribute value of the target access request based on the user information of the target access request.

The processing module 903 is configured to authenticate the target access request based on the authentication rules, the target data subset involved in the target access request, and the first attribute value, and return a response to the target access request.

Optionally, the processing module 903 is specifically configured to: obtain the second attribute value of the target data subset from the target data subset; when the first attribute value of the target access request and the second attribute value of the target data subset satisfy a predetermined When setting up a rule, grant the target access request permission to access a subset of the target data.

Optionally, the acquisition module 902 is specifically configured to: query pre-stored relationship information based on the user information of the target access request, and obtain the third attribute value corresponding to the user information and authentication keyword of the target access request in the relationship information; The third attribute value is determined as the first attribute value of the target access request.

Optionally, the receiving module 901 is also configured to: receive a maintenance request sent by the second client, the maintenance request is used to request maintenance of the data set, the maintenance request carries an attribute keyword indicating the authentication content; determine the attribute keyword is the authentication key.

To sum up, in the data management device provided by the embodiment of the present application, after obtaining the authentication rules of the data set, the acquisition module also needs to obtain the first attribute value of the target access request based on the user information of the target access request. In order to facilitate the processing module to authenticate the target access request based on the authentication rule and the first attribute value, it can be seen that the authentication rule is a general rule applicable to all data subsets in the data set, rather than a rule bound to the user. Therefore, there is no need for a security administrator to User configuration of authentication rules effectively improves the efficiency of configuration of authentication rules, thereby improving the efficiency of data management. At this time, when the data management device is applied to scenarios such as databases, big data SQL engines, or business intelligence, it can effectively improve the user experience of the corresponding scenarios, such as improving the ease of use of the SQL engine. Moreover, during the authentication process, authentication is based on the authentication rules of the data set requested by the target access request. There is no need to match a large number of authentication rules, which reduces the complexity of data management and helps improve data reading. Write performance.

Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the above-described devices and modules can be referred to the corresponding content in the foregoing method embodiments, and will not be described again here.

An embodiment of the present application provides a computer device. The computer device can implement some or all of the functions in the data management method provided by the embodiments of the present application. Figure 10 is a schematic structural diagram of a computer device provided by an embodiment of the present application. As shown in Figure 10, the computer device 1000 includes a processor 1001, a memory 1002, a communication interface 1003 and a bus 1004. Among them, the processor 1001, the memory 1002, and the communication interface 1003 implement communication connections between each other through the bus 1004.

Processor 1001 may include a general-purpose processor and/or a special-purpose hardware chip. General-purpose processors can include: central processing unit (CPU), microprocessor or graphics processing unit (GPU). The CPU is, for example, a single-core processor (single-CPU) or a multi-core processor (multi-CPU). A dedicated hardware chip is a high-performance processing hardware module. Specialized hardware chips include at least one of a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a network processor (NP) One item. The processor 1001 may also be an integrated circuit chip with signal processing capabilities. During the implementation process, part or all of the functions of the data management method of the present application can be completed by instructions in the form of hardware integrated logic circuits or software in the processor 1001 .

The memory 1002 is used to store computer programs, which include an operating system 1002a and executable codes (ie, program instructions) 1002b. The memory 1002 is, for example, a read-only memory or other type of static storage device that can store static information and instructions, or a random access memory or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable memory device. Read memory, read-only disc or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store Without limitation, any other medium that represents the desired executable code in the form of instructions or data structures and can be accessed by a computer. For example, the memory 1002 is used to store outbound port queues, etc. The memory 1002 exists independently, for example, and is connected to the processor 1001 through a bus 1004. Or the memory 1002 and the processor 1001 are integrated together. The memory 1002 can store executable code. When the executable code stored in the memory 1002 is executed by the processor 1001, the processor 1001 is used to perform part or all of the functions of the data management method provided by the embodiment of the present application. For example, the processor 1001 performs the following process: receives a target access request sent by the first client, the target access request is used to request access to the data set; obtains the authentication rule of the data set, and the authentication rule indicates: for requesting access to the data set For any access request, when the first attribute value of any access request and the second attribute value of any data subset involved in any access request satisfy the preset rules, any access request is granted access to any data subset. set of permissions; based on the user information of the target access request, obtain the first attribute value of the target access request; based on the authentication rules, the target data subset involved in the target access request, and the first attribute value, authenticate the target access request, and returns a response to the target access request. Please refer to the relevant descriptions in the foregoing method embodiments for how the processor 1001 executes this process. The memory 1002 may also include operating systems and other software modules and data required for running processes.

The communication interface 1003 uses a transceiver module such as but not limited to a transceiver to implement communication with other devices or communication networks. For example, the communication interface 1003 may be any one or any combination of the following devices: a network interface (such as an Ethernet interface), a wireless network card, and other devices with network access functions.

Bus 1004 is any type of communication bus used to interconnect internal components of a computer device (eg, memory 1002, processor 1001, communication interface 1003). For example, system bus. The embodiment of the present application takes the interconnection of the above-mentioned devices inside the computer device through the bus 1004 as an example. Optionally, the above-mentioned devices inside the computer device 1000 may also communicate with each other using other connection methods besides the bus 1004. For example, the above-mentioned devices inside the computer device 1000 are interconnected through internal logical interfaces.

It should be noted that the above-mentioned plurality of devices can be respectively arranged on independent chips, or at least part or all of them can be arranged on the same chip. Whether each device is independently installed on different chips or integrated on one or more chips often depends on the needs of product design. The embodiments of this application do not limit the specific implementation forms of the above devices. The descriptions of the processes corresponding to each of the above drawings have different emphases. For parts that are not detailed in a certain process, you can refer to the relevant descriptions of other processes.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product that provides a program development platform includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer device, the processes or functions of the data management method provided by the embodiments of the present application are fully or partially implemented.

Furthermore, computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions may be transmitted over a wired connection from a website, computer, server or data center. (such as coaxial cable, optical fiber, digital subscriber line or wireless (such as infrared, wireless, microwave, etc.) to transmit to another website, computer, server or data center. The computer-readable storage medium stores information that provides a program development platform Computer program instructions.

An embodiment of the present application also provides a computer cluster. The computer cluster includes multiple computer devices. The multiple computer devices include multiple processors and multiple memories. Program instructions are stored in the multiple memories. The multiple processors run the program instructions, so that the computer cluster executes as provided in the embodiments of the present application. data management methods. For the implementation method of each computer device in the computer cluster, please refer to the implementation method of the aforementioned computer equipment accordingly, which will not be described again here.

Embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium is a non-volatile computer-readable storage medium. The computer-readable storage medium includes program instructions. When the program instructions are run on a computer device When, the computer device is caused to execute the data management method provided by the embodiment of the present application.

Embodiments of the present application also provide a computer program product containing instructions. When the computer program product is run on a computer, it causes the computer to execute the data management method provided by the embodiments of the present application.

Those of ordinary skill in the art can understand that all or part of the steps to implement the above embodiments can be completed by hardware, or can be completed by instructing relevant hardware through a program. The program can be stored in a computer-readable storage medium. The above-mentioned The storage media mentioned can be read-only memory, magnetic disks or optical disks, etc.

It should be noted that the information involved in this application (including but not limited to user equipment information, user personal information, etc.), Data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals are authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant national regulations. and relevant regional laws, regulations and standards. For example, the relationship information and attribution information involved in this application were obtained with full authorization.

In the embodiments of the present application, the terms "first", "second" and "third" are only used for description purposes and cannot be understood as indicating or implying relative importance. The term "at least one" refers to one or more, and the term "plurality" refers to two or more, unless expressly limited otherwise.

The term "and/or" in this application is just an association relationship describing related objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, alone There are three situations B. In addition, the character "/" in this article generally indicates that the related objects are an "or" relationship.

The above are only optional embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the concepts and principles of the present application shall be included in the protection of the present application. within the range.

Claims

A data management method, characterized in that the method includes:

Receive a target access request sent by the first client. The target access request is used to request access to a data set. The data set has multiple attributes. The data subset in the data set includes the data corresponding to the multiple attributes. Attribute value, the access type of the target access request includes writing data and/or reading data;

Obtain the authentication rules of the data set, the authentication rules indicate: for any access request requesting access to the data set, when the first attribute value of the any access request is related to the any access request When the second attribute value of any data subset satisfies the preset rules, the permission to access the any data subset is given to any access request, and the first attribute value is the first attribute value of any access request. The user information corresponds to the attribute value of the authentication keyword. The second attribute value is the attribute value of any data subset corresponding to the authentication keyword. The authentication keyword is used to indicate the multiple attributes. one or more of;

Based on the user information of the target access request, obtain the first attribute value of the target access request;

Based on the authentication rule, the target data subset involved in the target access request, and the first attribute value, the target access request is authenticated, and a response to the target access request is returned.
The method according to claim 1, characterized in that authenticating the target access request based on the authentication rules, the target data subset involved in the target access request and the first attribute value includes: :

Obtain the second attribute value of the target data subset from the target data subset;

When the first attribute value of the target access request and the second attribute value of the target data subset satisfy the preset rule, the target access request is granted permission to access the target data subset.
The method according to claim 1 or 2, characterized in that the authentication keyword includes at least one of a user name, a user group name and a user role.
The method according to any one of claims 1 to 3, characterized in that, based on the user information of the target access request, obtaining the first attribute value of the target access request includes:

Based on the user information of the target access request, query the pre-stored relationship information to obtain the third attribute value corresponding to the user information of the target access request and the authentication keyword in the relationship information;

The third attribute value is determined as the first attribute value of the target access request.
The method according to any one of claims 1 to 4, characterized in that, before receiving the target access request sent by the first client, the method further includes:

Receive a maintenance request sent by the second client, where the maintenance request is used to request maintenance of the data set, and the maintenance request carries an attribute keyword indicating the authentication content;

The attribute key is determined as the authentication key.
The method according to claim 5, characterized in that the maintenance request includes a creation request and a modification request, an attribute key representing the authentication content is indicated in the creation request or the modification request, and the creation request is The request is to create the data set, and the modification request is used to request to modify the attributes of the data set.
The method according to any one of claims 1 to 6, characterized in that the data set is a data table, and the data subset is a data row in the data table.
A data management device, characterized in that the device includes:

A receiving module, configured to receive a target access request sent by the first client. The target access request is used to request access to a data set. The data set has multiple attributes. The data subset in the data set includes the Corresponding to multiple attributes Attribute value, the access type of the target access request includes writing data and/or reading data;

Obtaining module, used to obtain the authentication rules of the data set, the authentication rules indicate: for any access request requesting access to the data set, when the first attribute value of any access request is the same as the When the second attribute value of any data subset involved in any access request satisfies the preset rules, the permission to access the any data subset is granted to any access request, and the first attribute value is the The user information of any access request corresponds to the attribute value of the authentication keyword, and the second attribute value is the attribute value of any data subset corresponding to the authentication keyword. The authentication keyword is used to indicate one or more of the plurality of attributes;

The acquisition module is also configured to obtain the first attribute value of the target access request based on the user information of the target access request;

A processing module configured to authenticate the target access request based on the authentication rule, the target data subset involved in the target access request, and the first attribute value, and return a response to the target access request.
The device according to claim 8, characterized in that the processing module is specifically used for:

Obtain the second attribute value of the target data subset from the target data subset;

When the first attribute value of the target access request and the second attribute value of the target data subset satisfy the preset rule, the target access request is granted permission to access the target data subset.
The device according to claim 8 or 9, characterized in that the authentication keyword includes at least one of a user name, a user group name and a user role.
The device according to any one of claims 8 to 10, characterized in that the acquisition module is specifically used for:

Based on the user information of the target access request, query the pre-stored relationship information to obtain the third attribute value corresponding to the user information of the target access request and the authentication keyword in the relationship information;

The third attribute value is determined as the first attribute value of the target access request.
The device according to any one of claims 8 to 11, characterized in that the receiving module is also used for:

Receive a maintenance request sent by the second client, where the maintenance request is used to request maintenance of the data set, and the maintenance request carries an attribute keyword indicating the authentication content;

The attribute key is determined as the authentication key.
The device according to claim 12, characterized in that the maintenance request includes a creation request and a modification request, an attribute key representing the authentication content is indicated in the creation request or the modification request, and the creation request is The request is to create the data set, and the modification request is used to request to modify the attributes of the data set.
The device according to any one of claims 8 to 13, characterized in that the data set is a data table, and the data subset is a data row in the data table.
A computer device, characterized in that it includes a memory and a processor, the memory stores program instructions, and the processor runs the program instructions to perform the method described in any one of claims 1 to 7.
A computer cluster is characterized in that it includes a plurality of computer devices, the plurality of computer devices include a plurality of processors and a plurality of memories, the plurality of memories store program instructions, and the plurality of processors run The program instructions cause the computer cluster to execute the method described in any one of claims 1 to 7.
A computer-readable storage medium, characterized by comprising program instructions, which when the program instructions are run on a computer device, cause the computer device to execute the method according to any one of claims 1 to 7.
A computer program product, characterized in that, when the computer program product is run on a computer, it causes the computer to execute the method according to any one of claims 1 to 7.