CN102063479A - Method and system for controlling data access right - Google Patents

Abstract

The present invention discloses a method and system for controlling data access rights. The method includes: establishing a data resource type table for a database table in advance, and setting filter conditions for specified fields in the data resource table; according to the data resource type table, Filter out the data records that meet the filtering conditions of the fields, establish the association relationship between the data records and the user, and save the association relationship to the user's access authority table; receive the user's access request to the data table, Query the user's access authority table, and obtain the user's access authority according to the association relationship; filter the database table according to the access authority, and display records that meet the filtering conditions under specified fields for the user. The invention can realize access authority control with finer granularity than field-level authority.

Description

A method and system for controlling data access rights

technical field

The present invention relates to database management technology, and more specifically relates to a method and system for controlling data access authority.

Background technique

With the development of information technology and network technology, information security has become a common concern of people. Any enterprise or institution does not want the data resources and other information stored on the information website to be seen by its competitors, nor does it want internal users of the enterprise to have unauthorized access to the website information or arbitrarily change the data resources in the database. Therefore, almost every enterprise has to set up permission management for the data resources in its system. The so-called authority management means that according to the security rules or security policies set by the system, users can access and only access the resources they are authorized to.

Existing access control on data resources can be controlled to the field level, that is, it can control whether a certain field is hidden or visible. Taking the employee table of a company as an example, you can set the "job title" in the employee table to be hidden or visible, and authorize the user. When a user is set to have access to the "job title" field, the user can see the employee In the table, the professional title of each employee; but for unauthorized users, when accessing the employee table, they cannot see the professional title of any employee.

However, in system applications, more fine-grained permission control on data resources is often required, and the existing field-level permission control cannot meet the requirements. Still taking the employee table above as an example, it may be necessary to set some users who have access to the "Professional Title" field, but only have access to the relevant information of employees whose "Professional Title" is "Professor". Through this field-level Permission control cannot implement this kind of permission setting. Existing field-level access control methods cannot achieve finer-grained access control.

Contents of the invention

In view of this, the present invention provides a method and system for controlling data access rights, through which more fine-grained rights control can be realized.

To achieve the above object, the present invention provides the following technical solutions:

A method of controlling access to data comprising:

Establishing a data resource type table for the database table in advance, setting filter conditions for specified fields in the data resource type table;

According to the data resource type table, filter out data records that meet the field filtering conditions, establish an association relationship between the data record and the user, and save the association relationship to the user's access authority table;

receiving a user's access request to the data table, querying the user's access authority table, and obtaining the user's access authority according to the association relationship;

According to the access authority, the database table is filtered, and the records meeting the filtering conditions under the specified field are displayed for the user.

Preferably, the filter conditions for setting specified fields in the data resource table include:

According to the data resource type of the specified field in the database table, a condition for filtering the data resource type specified in the field is set.

Preferably, the filter conditions for setting specified fields in the data resource type table include:

Set filter conditions for multiple fields in the data resource type table;

And/or, set multiple filters for the same specified field.

Preferably, the establishment of the association relationship between the data record and the user includes:

Add the filtered records that meet the conditions to the user permission table to establish an association relationship between the user and the data records.

Preferably, the establishment of the association relationship between the data record and the user includes:

Establishing an association relationship between all the filtered data records and users;

Or establish an association relationship between some data records in the filtered data records and users.

A system for controlling access to data, including:

A type table establishment unit, configured to establish a data resource type table for a database table, and set filter conditions for specified fields in the data resource table;

A rights management unit, configured to filter out data records that meet the field filter conditions according to the data resource type table, establish an association relationship between the data record and the user, and save the association relationship to the user's access Permissions table;

An authority judging unit, configured to receive a user's access request to the data table, query the user's access authority table, and obtain the user's access authority according to the association relationship in the access authority table;

The data presentation unit is configured to filter the database table according to the access authority, and present records meeting the filtering conditions under specified fields for the user.

Preferably, the type table establishment unit sets filter conditions in the following manner:

According to the data resource type of the specified field in the database table, a condition for filtering the data resource type specified in the field is set.

Preferably, the type table establishment unit includes:

A condition setting unit, configured to set filter conditions for multiple fields in the data resource type table;

And/or, set multiple filters for the same specified field.

Preferably, the authority management unit sets authority in the following manner:

According to the data resource type table, the qualified data records are screened out, and the data records are added to the user permission table, so as to establish an association relationship between the user and the data records.

Preferably, the authority management unit includes:

A first authority management unit, configured to establish an association relationship between all data records screened out and users;

The second authority management unit is configured to establish an association relationship between some data records in the filtered data records and users.

It can be known from the above-mentioned technical solutions that, compared with the prior art, the present invention discloses a method and system for controlling data access rights, by establishing a data resource type table for a certain database table in advance, and setting in the data resource table Specify the filter condition of the field, and establish the association relationship between the data record and the user that meet the field filter condition. When the user accesses the data table, according to the association relationship, the access authority of the user is obtained, and the The database table is filtered, and the records that meet the filter conditions under the specified field are displayed for the user, so as to achieve finer-grained permission control than field-level permission control.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

Fig. 1 is a flow chart of an embodiment of a method for controlling data access authority in the present invention;

FIG. 2 is a schematic structural diagram of an embodiment of a system for controlling data access rights in the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Referring to Fig. 1, it is a flowchart of a method embodiment of the present invention, the method includes:

Step S101: establish a data resource type table for the database table in advance, and set filter conditions for specified fields in the data resource type table;

Wherein, the established data resource type table includes the source of the database table to indicate the location of the specified database table, and may also include description information of the specified database table. When it is necessary to set finer-grained permissions on the fields of the specified database table, you can fill in the source of the database table in the resource type table to achieve finer-grained filtering of the fields in the database table;

For the fields in the specified database table, you can set the corresponding permissions, and you can set the filter conditions for the fields, so as to obtain the records that meet the conditions in the fields. Specifically, setting the filter condition for the specified field in the data resource table may be: according to the data resource type of the specified field in the database table, setting the condition for filtering the data resource type specified in the field.

Wherein, the data resource type of a field refers to feature information that distinguishes different records under the same field. For example, taking the employee table of a unit as an example, the "employee position" field in the employee table may include information such as workshop director, department manager, operator, etc. These different information belong to different data resource types. When it is necessary to set the permission to access the data records of "Operator" in "Employee Position", the filter condition for this setting is: the data resource type of "Operator" in "Employee Position".

Among them, filter conditions for data resource types for multiple fields can be set respectively. At the same time, multiple filter conditions can also be set for a field in the database table. For example, still taking the above-mentioned employee table as an example, while setting the filter condition for "employee position", you can also set the filter condition for "employee's length of service" in the employee table. In addition, for the field of "employee position", it is possible to set the filtering condition for the data resource type of "workshop supervisor" while setting the filtering condition for the data resource type of "operator".

In the present invention, the data resource type of the field can also be customized, and then the data resource type of the field can be filtered. Other forms of filter conditions can also be set for the fields as required.

Step S102: According to the data resource type table, filter out data records that meet the field filtering conditions, establish an association relationship between the data records and the user, and save the association relationship in the user's access authority table;

After the data resource type table is established for the database table, the operation of setting user access rights can be performed. When it is necessary to authorize the user's access right, add or delete a certain access right for the user by modifying the user's access right table.

When performing the operation of user authority authorization, by querying the resource type table, filter out the data records that meet the filter conditions of the field, and establish the association between the user and the data record, so that the user has access to the field that meets the The permission of the data record of the filter condition. For example, when a resource type table is created for the employee table above, and the filter condition is set for "title" in the resource type table: when the "title" field is "department director" records are filtered. When performing permission authorization operations for users, according to the resource type table, filter out the records with "Department Director" in the "Professional Title" field in the employee table, and establish the association relationship between the filtered records and users, then the user The user has the permission to access the record of "Department Director" in the "Professional Title" field in the employee table, but the user who has not established this relationship does not have the permission to access the related records of "Department Director".

Wherein, establishing the association relationship between the data record and the user may be: adding the records meeting the screening conditions to the user authority table, so as to establish the association relationship between the user and the data record.

Further, the establishment of the association relationship between the data records and users may be: establishment of the association relationship between all the selected data records and users; or establishment of partial data in the selected data records Records are associated with users.

When the records that meet the filtering conditions in this field are met, some records can also be selected as required to authorize the user. When performing user authorization, the scope of authority granted to different users can be different.

Step S103: receiving a user's access request to the data table, querying the user's access authority table, and obtaining the user's access authority according to the association relationship;

When a user accesses the data table library, first query the user's access authority table, and determine the user's access authority according to the association relationship in the access authority table.

Step S104: According to the access authority, filter the database table, and display records meeting the filtering conditions under specified fields for the user.

After obtaining the user's access authority, you can filter the database tables that the user needs to access according to the authority, filter out the specified fields that meet the filter conditions, and display the data records that meet the user authority to the user, so that the user can access data .

The method of the present invention establishes a data resource type table for a certain database table in advance, sets the filter condition of the specified field in the data resource table, and establishes the association relationship between the data record and the user that meets the filter condition of the field, when When a user accesses the data table, according to the association relationship, the access authority of the user is obtained, the database table is filtered, and the records meeting the filter conditions in the specified fields are displayed for the user. This enables finer-grained permission access that cannot be controlled by field-level permission control.

Corresponding to the method of the present invention, the present invention also provides a system for controlling data access rights, referring to Figure 2, the system includes:

A type table establishment unit 201, configured to establish a data resource type table for a certain database table, and set a filter condition for a specified field in the data resource table;

The authority management unit 202 is configured to filter out data records that meet the field filtering conditions according to the data resource type table, establish an association relationship between the data record and the user, and save the association relationship to the user's access table;

The authority judging unit 203 is configured to receive a user's access request to the data table, query the user's access authority table, and obtain the user's access authority according to the association relationship in the access authority table;

The data presenting unit 204 is configured to filter the database table according to the access authority, and present records meeting the filtering conditions under specified fields for the user.

There can be multiple filter conditions, and the filter conditions can be set according to the data resource type of the field. Correspondingly, the type table establishment unit can set the filter condition in the following manner: according to the data resource type of the specified field in the database table, Sets the criteria for filtering the data resource type specified in the field.

Further, there may be multiple filter conditions to be set, and a setting method may be selected according to needs. Therefore, the type table establishment unit includes:

The condition setting unit is used for setting filter conditions of multiple fields in the data resource type table; and/or, setting multiple filter conditions of the same specified field.

When managing user permissions, there are many ways to grant access permissions to users. Preferably, the permission management unit sets permissions in the following way: according to the data resource type table, select qualified data records, and store the data A record is added to the user permission table to establish an association between the user and the data record.

Of course, the authority granted to the user can be different. Preferably, the authority management unit includes:

A first authority management unit, configured to establish an association relationship between all data records screened out and users;

The second authority management unit is configured to establish an association relationship between some data records in the filtered data records and users.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (10)

1. A method for controlling data access authority, comprising: Establishing a data resource type table for the database table in advance, setting filter conditions for specified fields in the data resource type table; According to the data resource type table, filter out data records that meet the field filtering conditions, establish an association relationship between the data record and the user, and save the association relationship to the user's access authority table; receiving a user's access request to the data table, querying the user's access authority table, and obtaining the user's access authority according to the association relationship; According to the access authority, the database table is filtered, and the records meeting the filtering conditions under the specified field are displayed for the user. 2. The method according to claim 1, wherein the filter condition for setting a specified field in the data resource table comprises: According to the data resource type of the specified field in the database table, a condition for filtering the data resource type specified in the field is set. 3. The method according to claim 1, wherein the filter condition for setting a specified field in the data resource type table comprises: Set filter conditions for multiple fields in the data resource type table; And/or, set multiple filters for the same specified field. 4. The method according to claim 1, wherein said establishing the association between the data record and the user comprises: Add the filtered records that meet the conditions to the user permission table to establish an association relationship between the user and the data records. 5. The method according to claim 1, wherein said establishing the association between the data record and the user comprises: Establishing an association relationship between all the filtered data records and users; Or establish an association relationship between some data records in the filtered data records and users. 6. A system for controlling access to data, characterized in that it comprises: A type table establishment unit, configured to establish a data resource type table for a database table, and set filter conditions for specified fields in the data resource table; A rights management unit, configured to filter out data records that meet the field filter conditions according to the data resource type table, establish an association relationship between the data record and the user, and save the association relationship to the user's access Permissions table; An authority judging unit, configured to receive a user's access request to the data table, query the user's access authority table, and obtain the user's access authority according to the association relationship in the access authority table; The data presentation unit is configured to filter the database table according to the access authority, and present records meeting the filtering conditions under specified fields for the user. 7. The system according to claim 6, wherein the type table establishment unit sets filter conditions in the following manner: According to the data resource type of the specified field in the database table, a condition for filtering the data resource type specified in the field is set. 8. The system according to claim 6, wherein the type table establishment unit comprises: A condition setting unit, configured to set filter conditions for multiple fields in the data resource type table; And/or, set multiple filters for the same specified field. 9. The system according to claim 6, wherein the authority management unit sets authority in the following manner: According to the data resource type table, the qualified data records are screened out, and the data records are added to the user permission table, so as to establish an association relationship between the user and the data records. 10. The system according to claim 6, wherein the authority management unit comprises: A first authority management unit, configured to establish an association relationship between all data records screened out and users; The second authority management unit is configured to establish an association relationship between some data records in the filtered data records and users.

Images