[go: up one dir, main page]

CN109815717A - Data permission management method, data access method, device, equipment and medium - Google Patents

Data permission management method, data access method, device, equipment and medium Download PDF

Info

Publication number
CN109815717A
CN109815717A CN201910042526.9A CN201910042526A CN109815717A CN 109815717 A CN109815717 A CN 109815717A CN 201910042526 A CN201910042526 A CN 201910042526A CN 109815717 A CN109815717 A CN 109815717A
Authority
CN
China
Prior art keywords
data
permission
feature
target
obtains
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201910042526.9A
Other languages
Chinese (zh)
Inventor
曾维刚
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ping An Technology Shenzhen Co Ltd
Original Assignee
Ping An Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ping An Technology Shenzhen Co Ltd filed Critical Ping An Technology Shenzhen Co Ltd
Priority to CN201910042526.9A priority Critical patent/CN109815717A/en
Publication of CN109815717A publication Critical patent/CN109815717A/en
Pending legal-status Critical Current

Links

Landscapes

  • Storage Device Security (AREA)

Abstract

The invention discloses a kind of data permission management method, data access method, device, equipment and medium, the data permission management method includes: acquisition data set, carries out data cleansing to each basic data in the data set, obtains valid data collection;Feature extraction is carried out to each basic data that the valid data are concentrated, obtains data characteristics collection, each corresponding data characteristics of the basic data;The feature scoring of each data characteristics is obtained using preset data grade form;The feature deciding grade and level of each data characteristics is determined according to feature scoring;It is that each data characteristics distributes permission according to feature deciding grade and level, obtains the target permission of the corresponding basic data of each data characteristics.Above-mentioned right management method improves data management efficiency, and ensure that data access safety by handling the data characteristics of extraction.

Description

Data permission management method, data access method, device, equipment and medium
Technical field
The present invention relates to data processing field more particularly to a kind of data permission management methods, data access method, dress It sets, equipment and medium.
Background technique
The data such as production, technology, client, cost and the strategical planning of enterprise are all that enterprise depends on for existence all the time Vital strategic secrets data, the loss or leakage of these data, often cause huge loss to enterprise, in system operation It includes many sensitive informations that many daily record datas, which can be exported,.Such as: user password, user bank card number, home address are System communication key etc., if these data, which are exposed to log without processing, checks personnel, disclosure risk is very high, and business Production system has accumulated a large amount of data comprising sensitive informations such as accounts and can not only give if these data are leaked and damage Enterprise brings economic loss, and can bring a negative impact to the reputation of enterprise.Therefore, how to have to these data The security protection of effect has become the emphasis of most enterprises concern.
Traditionally, by manually formulating safety regulation, the experience for the people that places one's entire reliance upon is easy the leakage of sensitive data, together When impose uniformity without examining individual cases to data, data safety is difficult to ensure.
Summary of the invention
The embodiment of the present invention provides a kind of data permission management method, device, equipment and medium, to solve Information Security Lower problem.
In addition, the embodiment of the present invention provides a kind of data access method, device, equipment and medium, to solve data access The lower problem of safety.
A kind of data permission management method, comprising:
Data set is obtained, data cleansing is carried out to each basic data in the data set, obtains valid data collection;
Feature extraction is carried out to each basic data that the valid data are concentrated, obtains data characteristics collection, it is described Data characteristics collection includes N number of data characteristics, and N is positive integer, each corresponding data characteristics of the basic data;
The feature scoring of each data characteristics is obtained using preset data grade form;
The feature deciding grade and level of each data characteristics is determined according to feature scoring;
It is that each data characteristics distributes permission according to feature deciding grade and level, it is corresponding obtains each data characteristics The target permission of the basic data.
A kind of data authority management device, comprising:
Valid data collection obtains module and counts for obtaining data set to each basic data in the data set According to cleaning, valid data collection is obtained;
Data characteristics collection obtains module, mentions for carrying out feature to each basic data that the valid data are concentrated It takes, obtains data characteristics collection, the data characteristics collection includes N number of data characteristics, and N is positive integer, each basic data pair Answer the data characteristics;
Feature scoring obtains module, and the feature for obtaining each data characteristics using preset data grade form is commented Point;
Feature deciding grade and level determining module, for determining that the feature of each data characteristics is defined the level according to feature scoring;
Target authority acquiring module is obtained for being that each data characteristics distributes permission according to feature deciding grade and level The target permission of the corresponding basic data of each data characteristics.
A kind of data access method, comprising:
Data access request is obtained, the data access request includes the data mark of current account information and data to be visited Know;
From presetting database, the corresponding access authority of the current account information is obtained, as current accessed permission, and The target permission for obtaining the corresponding basic data of Data Identification of the data to be visited, as target access permission, wherein institute Target permission is stated to obtain using the described in any item data permission management methods of such as Claims 1-4;
It verifies whether the target access permission exceeds the current accessed permission, is verified result;
If the verification result is the target access permission without departing from the current accessed permission, from described preset In database, the corresponding basic data of the Data Identification is obtained, as data to be displayed;
According to the corresponding preset data conversion regime of the Data Identification, data conversion is carried out to the data to be displayed, It obtains target and shows data.
A kind of data access device, comprising:
Data access request obtains module, and for obtaining data access request, the data access request includes current account The Data Identification of family information and data to be visited;
Access authority obtains module, for obtaining the corresponding access right of the current account information from presetting database Limit, as current accessed permission, and obtains the target permission of the corresponding basic data of Data Identification of the data to be visited, makees For target access permission, wherein the target permission is obtained using data permission management method;
Authority Verification module is tested for verifying whether the target access permission exceeds the current accessed permission Demonstrate,prove result;
Data to be displayed obtains module, for being that the target access permission is current without departing from described in the verification result When access authority, then from the preset database, the corresponding basic data of the Data Identification is obtained, as number to be shown According to;
Target shows data acquisition module, is used for according to the corresponding preset data conversion regime of the Data Identification, to institute It states data to be displayed and carries out data conversion, obtain target and show data.
A kind of computer equipment, including memory, processor and storage are in the memory and can be in the processing The computer program run on device, the processor realize above-mentioned data permission management method when executing the computer program Step, alternatively, the step of processor realizes above-mentioned data access method when executing the computer program.
A kind of computer readable storage medium, the computer-readable recording medium storage have computer program, the meter The step of calculation machine program realizes above-mentioned data permission management method when being executed by processor, alternatively, described in processor execution The step of above-mentioned data access method is realized when computer program.
In above-mentioned data permission management method, device, equipment and medium, firstly, obtaining data set, data are concentrated every One basic data carries out data cleansing, obtains valid data collection, avoids subsequent data are further processed and generates interference, Improve data-handling efficiency;Then, feature extraction is carried out to each basic data that valid data are concentrated, obtains data characteristics Collection, by carrying out feature extraction to each basic data, so that basic data is simplified, so as to subsequent more convenient rapidly right Data are further processed;Then, it is scored, is realized using the feature that preset data grade form obtains each data characteristics Quantization to data characteristics, to more intuitively reflect the safety of the sensitivity and data itself of data characteristics;Again Then, it determines that the feature of each data characteristics is defined the level according to feature scoring, reduces the redundant operation to data characteristics, with after an action of the bowels Continue so that data characteristics is able to efficient Classification Management;Finally, being that each data characteristics distributes permission according to feature deciding grade and level, obtain every The target permission of the corresponding basic data of one data characteristics realizes self evolving for the safety regulation of data set and concentrates with data Data Access Security personalization.And the high risk that data are carried out with single solution for diverse problems generation is effectively prevented, data are improved The efficiency of management ensure that the safety of data.
In above-mentioned data access method, device, equipment and medium, firstly, obtaining data access request;Then, from default In database, the corresponding access authority of current account information is obtained, as current accessed permission, and obtains the number of data to be visited According to the target permission for identifying corresponding basic data, as target access permission so that the target permission of basic data more subject to Really;Then, whether verifying target access permission exceeds current accessed permission, is verified as a result, so as to subsequent based on the verifying As a result data are had secure access to next, if verification result is target access permission without departing from current accessed permission, from In preset database, the corresponding basic data of Data Identification is obtained, as data to be displayed;Finally, according to Data Identification pair The preset data conversion regime answered carries out data conversion to data to be displayed, obtains target and shows data, to ensure that target Show the safety of data.
Detailed description of the invention
In order to illustrate the technical solution of the embodiments of the present invention more clearly, below by institute in the description to the embodiment of the present invention Attached drawing to be used is needed to be briefly described, it should be apparent that, the accompanying drawings in the following description is only some implementations of the invention Example, for those of ordinary skill in the art, without any creative labor, can also be according to these attached drawings Obtain other attached drawings.
Fig. 1 is the application environment schematic diagram of data permission management method provided in an embodiment of the present invention, data access method;
Fig. 2 is one exemplary diagram of data permission management method provided in an embodiment of the present invention;
Fig. 3 is a functional block diagram of data authority management device provided in an embodiment of the present invention;
Fig. 4 is an exemplary diagram of data access method provided in an embodiment of the present invention;
Fig. 5 is a functional block diagram of data access device provided in an embodiment of the present invention;
Fig. 6 is a schematic diagram of computer equipment provided in an embodiment of the present invention.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete Site preparation description, it is clear that described embodiments are some of the embodiments of the present invention, instead of all the embodiments.Based on this hair Embodiment in bright, every other implementation obtained by those of ordinary skill in the art without making creative efforts Example, shall fall within the protection scope of the present invention.
Data permission management method provided by the present application, can be applicable in the application environment such as Fig. 1, wherein client is logical It crosses network to be communicated with server-side, server-side receives the data set that client is sent, each basic data for concentrating data Data cleansing is carried out, valid data collection is obtained;Then feature extraction is carried out to each basic data that valid data are concentrated, obtained Data characteristics collection;Then, it is scored using the feature that preset data grade form obtains each data characteristics;And then it is commented according to feature Divide the feature deciding grade and level for determining each data characteristics;Finally, being that each data characteristics distributes permission according to feature deciding grade and level, obtain each The target permission of the corresponding basic data of data characteristics.Wherein, client can be, but not limited to be various personal computers, notes This computer, smart phone, tablet computer and portable wearable device.Server-side can be either multiple with independent server The server cluster of server composition is realized.
In one embodiment, as shown in Fig. 2, being applied to be illustrated for the server-side in Fig. 1 in this way, including Following steps:
S10: obtaining data set, carries out data cleansing to each basic data that data are concentrated, obtains valid data collection.
Wherein, data set refers to the set of different types of data, and illustratively, data set may include structuring number According to, binary data or text data etc..Specifically, data set can be the log number that server-side is run from the system of client According to being acquired in library, it is also possible to be directly obtained data set in the system database by client, can also be and pass through Third party's metadata acquisition tool of client obtains data set from system data interface, which can be with It is octopus collector, is also possible to Boston ivy collector etc..
Wherein, data cleansing, which refers to, is filtered specific data, for reducing the interference to data analysis.Specifically Ground, data cleansing may include the exception for concentrating specified unwanted basic data to be cleaned, concentrated to data data Basic data is cleaned, carries out cleaning to the repetition basic data that data are concentrated and carry out basic data relevance to data set Verification is cleaned to there is no associated data in turn.
Illustratively, if removal it is specified do not need data, can be by the basic data in inquiry data set, when this Exist in data set and when identical basic data, removes corresponding basic data, keyword therein in preset keyword library Library refers to include specified data and the data with specified data characteristics.It, can be with if the basic data that removal is abnormal Carry out data check by string comparison method, obtain data format do not meet preset format or data content do not meet it is pre- If the abnormal basic data of content.For example, Chinese person name number occurs and alphabetic character or year occur in letter, ID card No. Age is more than 200 years old abnormal basic data etc..If to being associated property of basic data verify, can by regular expression into The verification of row relevance, such as the ID card No. and date of birth is inconsistent or the situations such as identification card number and gender are inconsistent.It can To understand ground, data cleansing is carried out by each basic data, the basic data of wrong exception is removed, avoids subsequent logarithm Interference is generated according to being further processed, improves data-handling efficiency.
S20: feature extraction is carried out to each basic data that valid data are concentrated, obtains data characteristics collection, data characteristics Collection includes N number of data characteristics, and N is positive integer, the corresponding data characteristics of each basic data.
Wherein, feature extraction is the operation that a kind of pair of data carry out key message extraction.For obtaining the pass of basic data Key information.Data characteristics is the critical data for referring to embody data attribute, for the characteristic to characterize data.Feature extraction Specific implementation process are as follows: first basic data is split, one or more basic data vocabulary is formed, then to each base Plinth data vocabulary carries out part-of-speech tagging using part-of-speech tagging tool (such as ictclas), obtains part of speech data characteristics.Finally by word Frequency statistical tool carries out word frequency statistics to the corresponding basic data of each part of speech data characteristics, obtains data characteristics according to word frequency. For example, a basic data is that " my identification card number is 534232323232323, my password is 754312, and my family address is wide The Shenzhen Dong Sheng ", by carrying out feature extraction to the basic data, obtained data characteristics is { " identity card ", " password ", " Location " }.Feature extracting method in this step can be the feature extracting method of participle, be also possible to the spy based on Brief algorithm Extracting method is levied, can also be the feature extracting method of structured language inquiry.
It is to be appreciated that by carrying out feature extraction to each basic data, so that basic data is simplified, so as to subsequent It is more convenient that rapidly data are further processed.It should be noted that a data characteristics includes one or more Subdata feature continues the data characteristics packet by taking the data characteristics { " identity card ", " password ", " address " } in this step as an example Containing 3 sub- data characteristicses, respectively " identity card " subdata feature, " password " subdata feature and " address " subdata feature.
S30: the feature scoring of each data characteristics is obtained using preset data grade form.
Wherein, preset data grade form refers to the pre-set table given a mark to data.For mapping data Sensitivity.In data grade form, score value is higher, and it is higher to represent data sensitive degree.Feature scoring is according to data The score value that sensitivity is evaluated, for reflecting the sensitivity of data.Illustratively, in an Enterprise Resources Plan In (Enterprise Resource Planning, ERP) system, which is used for in ERP system database Data score, and are managed so as to subsequent to data.For example, data characteristics is { " address " }, feature scoring is 3 points, Data characteristics is { " telephone number " }, and feature scoring is 4 points, and data characteristics is { " password " }, and feature scoring is 10 points.Tool Body, using data characteristics as querying condition, score value corresponding with data characteristics can be inquired in the scoring of preset data, The as data scoring of the data characteristics.It is to be appreciated that being realized by scoring data characteristics to data characteristics Quantization, to more intuitively reflect the safety of the sensitivity and data itself of data characteristics.
It should be noted that preset data grade form can be used when data characteristics includes multiple subdata features It scores each subdata feature, then scoring is summarized, data characteristics scoring can be obtained.The side of summarizing therein Formula can be the summarized manner that the scoring of each subdata feature is overlapped to rear averaged, be also possible to each son Data characteristics assigns corresponding weight, is weighted the summarized manner of summation.Specific weight setting can according to actual needs into Row selection, herein with no restriction.
S40: determine that the feature of each data characteristics is defined the level according to feature scoring.
Wherein, feature deciding grade and level is the rank for characterize data feature, each feature deciding grade and level corresponding feature scoring area Between.Wherein, feature deciding grade and level and the corresponding relationship in feature scoring section can be set according to actual needs.Specifically, pass through The scoring section that judging characteristic scoring is fallen in, and then data characteristics is determined with the table that compares of characteristic relation according to scoring section Feature deciding grade and level.For example, the corresponding scoring section in 1 grade of position of feature deciding grade and level is [0,1.5], the corresponding scoring area in 2 grades of position of feature deciding grade and level Between be [1.6,3], the feature deciding grade and level corresponding scoring in 10 grades of position that the feature corresponding scoring section in 2 grades of position of defining the level is [3.1,4.5] ... Section is [13.6,15].When the scoring of a certain data characteristics is 1.4, the feature deciding grade and level of the data characteristics is 1 grade.It can manage Xie Di, the scoring of its feature of different data characteristicses is also different, since the data characteristics quantity that valid data are concentrated is various, feature The quantity of scoring also can be very much, are not easy to subsequent processing, therefore, determine that the feature of each data characteristics is fixed according to feature scoring Grade, reduces the redundant operation to data characteristics, so as to subsequent so that data characteristics is able to efficient Classification Management.
S50: it is that each data characteristics distributes permission according to feature deciding grade and level, obtains the corresponding basic data of each data characteristics Target permission.
Wherein, the permission in the step refers to access authority, for the identity according to the user in various predefined groups Mark and its member identities carry out the mechanism of limited-access data, prevent data from imposing uniformity without examining individual cases, that is, are completely exposed to user or complete Restricting user access.Specifically, it is defined the level according to feature, authority distribution is carried out to the corresponding basic data of data characteristics, is easy reason Xie Di, the relationship between feature scoring and feature deciding grade and level are to be positively correlated, and being also between feature deciding grade and level and target permission is in positive It closes, therefore, feature deciding grade and level is higher, and the target permission of distribution is bigger, i.e. the access authority of basic data needs is bigger.Further Ground can preset an authority distribution table, according to the corresponding relationship of feature deciding grade and level and target permission, to each data characteristics Permission is distributed, target permission is obtained.The authority distribution table can empirically be set by data rule domain expert, can also To be set according to actual needs.
It is to be appreciated that can only be accessed when client accesses data less than or equal to own target Permission Levels Data.For example, the target Permission Levels of the corresponding basic data of a certain data characteristics are minimum, then the basic data access mode is For the corresponding access mode of minimum target permission.
In the step, by being that each data characteristics distributes permission according to feature deciding grade and level, it is corresponding to obtain each data characteristics Basic data target permission, realize the safety regulation of data set self evolve and data concentrate Data Access Security Personalization.And the high risk that data are carried out with single solution for diverse problems generation is effectively prevented, the efficiency of data management is improved, is guaranteed The safeties of data.
In the present embodiment, firstly, obtaining data set, data cleansing is carried out to each basic data that data are concentrated, is obtained Valid data collection avoids subsequent data are further processed and generates interference, improves data-handling efficiency;Then, to having The each basic data imitated in data set carries out feature extraction, obtains data characteristics collection, special by carrying out to each basic data Sign is extracted, to simplify basic data, more convenient rapidly data is further processed so as to subsequent;Then, it adopts The feature scoring that each data characteristics is obtained with preset data grade form, realizes the quantization to data characteristics, thus more Intuitively reflect the safety of the sensitivity and data itself of data characteristics;Followed by each according to feature scoring determination The feature of data characteristics is defined the level, and the redundant operation to data characteristics is reduced, so as to subsequent so that data characteristics is able to efficiently divide Class management;Finally, being that each data characteristics distributes permission according to feature deciding grade and level, the corresponding basic data of each data characteristics is obtained Target permission, realize the safety regulation of data set self evolve and data concentrate Data Access Security personalization. And the high risk that data are carried out with single solution for diverse problems generation is effectively prevented, the efficiency of data management is improved, ensure that data Safety.
In one embodiment, in step S30, feature extraction is carried out to valid data collection, obtains data characteristics collection, specifically Are as follows:
S31: if the data type that valid data integrate is divided as text-type, to valid data collection using participle technique Word obtains phrase as data characteristics collection.
Wherein, the valid data collection of text-type refers to the data set of the data composition of text formatting, such as text " the Chinese people Republic ".Phrase obtains after referring to the progress word segmentation processing of the data in the data set of text type and computer can be known automatically The not unit text data of semantic text.For example, " People's Republic of China (PRC) " obtains " China ", " people " by participle technique " republic " three phrases.For another example: such as " my identity card " " identity card of Zhang San ", the data of the two text-types are total to Same feature " identity card ", therefore, by " identity card " this phrase as data characteristics.
Wherein, participle refer in the data set by text type text sequence be cut into computer can automatic identification it is semantic Phrase.And participle technique is the key that search engine is inquired after the query processing that word string carries out for user's submission according to user A kind of technology for being carried out with various matching process of crucial word string.The participle technique can be the segmenting method based on character string, It is also possible to can also be the segmenting method based on statistics based on ground segmenting method is understood.Preferably, base is used in the present embodiment Word segmentation processing is carried out in the segmentation methods of string matching.Specifically, the basic data that valid data are concentrated is divided first After cutting, multiple character strings are obtained, it, will then by the key character String matching in multiple character string and preset key character library Data characteristics is arrived as phrase with the matched character string of key-strings.
In the present embodiment, feature extraction is carried out to valid data collection by participle technique, to realize to valid data collection In basic data optimization, acquisition more accurately have data characteristics.
In one embodiment, in step S30, feature extraction is carried out to valid data collection, obtains data characteristics collection, specifically Are as follows:
S31 ': if the data type that valid data integrate as binary data types, uses Brief algorithm to binary number Feature extraction is carried out according to type, obtains binary string as data characteristics collection.
Wherein, binary data types refer to numeric type data, and the data of value type, example are concentrated for mark data Such as: the binary data etc. for including in the binary system text of phone number, ID card No. or image, video etc..Brief algorithm (Binary Robust Independent Elementary Features) is if be to randomly select to do near characteristic point It is right, by the size of the gray value of these points pair, it is combined into a binary string, and using this binary string as this feature point The algorithm of Feature Descriptor, for extracting the data characteristics of binary string.Specifically, the data of binary data types are had The binary data of linked character is as data characteristics collection.For example, 18 bit digitals of ID card No., have eight-digit number word to represent The raw date, the feature of identity card can be embodied, therefore, use Brief algorithm special as data set for number by therein 8 Sign, for example, when there is an eight-digit binary number data, as the binary string of ID card No..
It is to be appreciated that for example, a data set includes the ID card information of 10000 people, wherein ID card No. is One 18 floating numbers, ID card information is more in the database of enterprise management system, certainly will occupy a large amount of memory headroom And mean the match time more grown.For this purpose, being carried out by valid data collection of the Brief algorithm to binary data types special Sign is extracted, and information storage space is reduced.Be conducive to subsequent be further processed characteristic feature.
In one embodiment, in step S30, feature extraction is carried out to valid data collection, obtains data characteristics collection, specifically Are as follows:
S31 ": if the data type that valid data integrate as structured data type, uses query sentence of database to knot Structure data are inquired, and obtain data dimension as data characteristics collection.
Wherein, structural data refers to the data in the tables of data of database scope, such as the field and attribute in tables of data Deng.For example, if field the user name username, password password etc. inside user's table t_user are the number of structuring According to.Wherein, data dimension refers to the data attribute of structural data.For example, password password embodies the structural data Data characteristics be { " password " }.
Specifically, query sentence of database refers to that structured query language (SQL) is instructed, and extracts the number of structural data According to dimension, and then obtain the data characteristics collection of structural data.
In the present embodiment, structural data is inquired using query sentence of database, obtains data dimension as number According to feature set, data characteristics can be rapidly and accurately extracted, improves the acquisition efficiency of data characteristics.
It is to be appreciated that feature extraction plays very crucial effect in improving Information Security.To valid data collection Feature extraction method carry out inducing classification, be beneficial to improve valid data feature set accuracy and integrality.Step In S31, step S31 ' and step S31 ", feature extracting method can be the feature extracting method of participle, be also possible to be based on The feature extracting method of Brief algorithm can also be the feature extracting method of structured language inquiry.By to valid data collection In data type judged, feature extraction is carried out using corresponding method to the data of each data type, it is so efficient that obtain The data characteristics of data set has been taken, to be efficiently obtained valid data feature set, security protection is carried out to data so as to subsequent.
It should be understood that the size of the serial number of each step is not meant that the order of the execution order in above-described embodiment, each process Execution sequence should be determined by its function and internal logic, the implementation process without coping with the embodiment of the present invention constitutes any limit It is fixed.
In one embodiment, a kind of data authority management device is provided, the data authority management device and above-described embodiment Middle data permission management method corresponds.As shown in figure 3, being somebody's turn to do the text analyzing device based on deep learning includes valid data Collection, which obtains module 10, data characteristics collection obtains module 20, feature scores obtains module 30, feature deciding grade and level determining module 40 and target Authority acquiring module 50.Detailed description are as follows for each functional module:
Valid data collection obtains module 10, for obtaining data set, carries out data to each basic data that data are concentrated Cleaning, obtains valid data collection;
Data characteristics collection obtains module 20, and each basic data for concentrating to valid data carries out feature extraction, obtains To data characteristics collection, data characteristics collection includes N number of data characteristics, and N is positive integer, the corresponding data spy of each basic data Sign;
Feature scoring obtains module 30, and the feature for obtaining each data characteristics using preset data grade form is commented Point;
Feature deciding grade and level determining module 40, for determining that the feature of each data characteristics is defined the level according to feature scoring;
Target authority acquiring module 50 obtains each number for being that each data characteristics distributes permission according to feature deciding grade and level According to the target permission of the corresponding basic data of feature.
Preferably, it includes the first data characteristics acquiring unit that data characteristics collection, which obtains module, in valid data collection When data type is text-type, then valid data collection is segmented using participle technique, obtain phrase as data characteristics collection.
Preferably, it further includes the second data characteristics acquiring unit that data characteristics collection, which obtains module, in valid data collection Data type be binary data types when, then using Brief algorithm to binary data types carry out feature extraction, obtain Binary string is as data characteristics collection.
Preferably, it further includes third data characteristics acquiring unit that data characteristics collection, which obtains module, in valid data collection Data type when being structured data type, then structural data is inquired using query sentence of database, is counted According to dimension as data characteristics collection.
In one embodiment, a data access method is provided, which can also apply the application in such as Fig. 1 In environment, wherein client is communicated by network with server-side.Server-side receives the data access that client is sent and asks It asks;Then, from presetting database, the corresponding access authority of current account information is obtained, as current accessed permission, and is obtained The target permission of the corresponding basic data of the Data Identification of data to be visited, as target access permission;Then, if verification result It is target access permission without departing from current accessed permission, then from preset database, obtains the corresponding basic number of Data Identification According to as data to be displayed;Finally, being counted according to the corresponding preset data conversion regime of Data Identification to data to be displayed According to conversion, obtains target and show data.Wherein, client can be, but not limited to be various personal computers, laptop, intelligence It can mobile phone, tablet computer and portable wearable device.Server-side can use independent server either multiple server groups At server cluster realize.
In one embodiment, as shown in figure 4, being applied to be illustrated for the server-side in Fig. 1 in this way, including Following steps:
S60: data access request is obtained, data access request includes the data mark of current account information and data to be visited Know.
Wherein, data access request is the request to access to data that client is initiated.Specifically, user passes through visitor Family end inputs corresponding instruction or information to trigger the data access request.Data access request request is sent to by client Server-side, server-side get data access request.Current account information refers to the account information of access data, such as account and Password.The Data Identification of data to be visited is to go out different data characteristicses for unique identification.In one embodiment, data Mark can be database-name or data logging title etc..
S70: from presetting database, obtaining the corresponding access authority of current account information, as current accessed permission, and The target permission for obtaining the corresponding basic data of Data Identification of data to be visited, as target access permission, wherein target power Limit is obtained using data permission management method.
Wherein, presetting database refers to preset for storing the data of account information Yu access authority mapping relations Library.Current accessed permission refers to access authority corresponding with current account information.Such as: when account information is " administrator ", when Preceding access authority is the permission of highest level, and when account information is " ordinary user ", current accessed permission is the other power of lower level Limit.Target access permission refers to the target permission of the corresponding basic data of the Data Identification of data to be visited, since the target is weighed Limit is obtained using data permission management method, so that the target permission of basic data is more accurate.
S80: whether verifying target access permission exceeds current accessed permission, is verified result.
Specifically, the level relation for comparing target access permission and current accessed permission obtains size between the two and closes System, as verification result.Optionally, target access permission and current accessed permission can be reflected by numerical value, then More corresponding Digital size is tested if the corresponding numerical value of target access permission is greater than the corresponding numerical value of current accessed permission Demonstrate,proving result is that target access permission exceeds current accessed permission, when the corresponding numerical value of target access permission is less than or equal to currently The corresponding numerical value of access authority, verification result are target access permission without departing from current accessed permission, are tested so as to subsequent based on this Card result has secure access to data.
S90: if verification result is that target access permission is obtained from preset database without departing from current accessed permission The corresponding basic data of Data Identification is taken, as data to be displayed.
Specifically, when target access permission is without departing from current accessed permission, i.e. the rank of current accessed permission be greater than or Person is equal to the rank of target access permission, obtains the corresponding basic data of Data Identification at this point, can get, i.e., from preset In database, the corresponding basic data of Data Identification is obtained, as data to be displayed.
S100: according to the corresponding preset data conversion regime of Data Identification, data conversion is carried out to data to be displayed, is obtained Target shows data.
Wherein, preset data conversion regime refers to preset for carrying out conversion process mode to data mode, such as Data are deformed, mosaic processing or hide processing etc., guarantee the safety of data.Specifically, it is getting to aobvious For registration after, server-side carries out data conversion according to the corresponding preset data conversion regime of Data Identification, to data to be displayed, obtains Data are shown to target, to ensure that target shows the safety of data.
In the present embodiment, firstly, obtaining data access request;Then, from presetting database, current account information is obtained Corresponding access authority, as current accessed permission, and the mesh for the corresponding basic data of Data Identification for obtaining data to be visited Permission is marked, as target access permission, so that the target permission of basic data is more accurate;Then, target access permission is verified Whether exceed current accessed permission, be verified as a result, so as to it is subsequent based on the verification result to data carry out secure access connect Get off, if verification result is target access permission without departing from current accessed permission, from preset database, obtains data mark Corresponding basic data is known, as data to be displayed;Finally, being treated according to the corresponding preset data conversion regime of Data Identification It shows that data carry out data conversion, obtains target and show data, to ensure that target shows the safety of data.
In one embodiment, in step S100, data conversion is carried out to data to be displayed, target is obtained and shows data, tool Body are as follows:
Data to be displayed is converted with the conversion regime of transformation of data, alternatively, to data to be displayed with image watermarking Conversion regime converted, obtain target show data.
Wherein, deformation is carried out to target data to refer to the conversion side for showing data in a manner of being different from itself Method.Data are hidden and refers to data some in target data is removed, the conversion method without display.It is specific real one It applies in mode, data to be displayed is that " my identification card number is 534232323232323, my password is 754312, my family address It is Shenzhen City, Guangdong Province ", when deforming to data to be displayed, obtained target shows that data are as follows: " my identification card number It is 534232323232323, my password is * * * * * *, and my family address is Shenzhen City, Guangdong Province ".It is carried out when to data to be displayed When hiding, target shows that data are as follows: " my identification card number is 534232323232323, my password is that my family address is Shenzhen City, Guangdong Province ".
It is not only simple and convenient by being deformed or being hidden to data to be displayed in the present embodiment, but also to access User can more intuitive carry out data access, while also improving the safety of data access.
This provides a kind of data access device in one embodiment, data in the data access device and above-described embodiment Right management method corresponds.As shown in figure 5, the data access device includes that data access request obtains module 60, access Authority acquiring module 70, Authority Verification module 80, data to be displayed obtain module 90 and target shows data acquisition module 100. Detailed description are as follows for each functional module:
Data access request obtains module 60, and for obtaining data access request, data access request includes current account The Data Identification of information and data to be visited;
Access authority obtains module 70, for from presetting database, obtaining the corresponding access authority of current account information, As current accessed permission, and the target permission for the corresponding basic data of Data Identification for obtaining data to be visited, as target Access authority, wherein target permission is obtained using data permission management method;
Authority Verification module 80 is verified result for verifying whether target access permission exceeds current accessed permission;
Data to be displayed obtains module 90, for being target access permission without departing from current accessed permission in verification result When, then from preset database, the corresponding basic data of Data Identification is obtained, as data to be displayed;
Target shows data acquisition module 100, for treating aobvious according to the corresponding preset data conversion regime of Data Identification Registration obtains target and shows data according to data conversion is carried out.
Preferably, target shows that data acquisition module includes target display data conversion unit, for data to be displayed It is converted with the conversion regime of transformation of data, alternatively, being converted to data to be displayed with the conversion regime of image watermarking, is obtained Data are shown to target.
Specific about data authority management device limits the limit that may refer to above for data permission management method Fixed, details are not described herein.Modules in above-mentioned data authority management device can fully or partially through software, hardware and its Combination is to realize.Above-mentioned each module can be embedded in the form of hardware or independently of in the processor in computer equipment, can also be with It is stored in the memory in computer equipment in a software form, in order to which processor calls the above modules of execution corresponding Operation.
In one embodiment, a kind of computer equipment is provided, which can be server, internal junction Composition can be as shown in Figure 6.The computer equipment include by system bus connect processor, memory, network interface and Database.Wherein, the processor of the computer equipment is for providing calculating and control ability.The memory packet of the computer equipment Include non-volatile memory medium, built-in storage.The non-volatile memory medium is stored with operating system, computer program and data Library.The built-in storage provides environment for the operation of operating system and computer program in non-volatile memory medium.The calculating Data of the database of machine equipment for being used in data permission management method.The network interface of the computer equipment be used for External terminal passes through network connection communication.To realize a kind of data permission manager when the computer program is executed by processor Method.
In one embodiment, a kind of computer equipment is provided, including memory, processor and storage are on a memory And the computer program that can be run on a processor, processor realize the data power in above-described embodiment when executing computer program Limit management method or processor realize the data access method in above-described embodiment when executing computer program.
In one embodiment, a kind of computer readable storage medium is provided, computer program is stored thereon with, is calculated Machine program realizes that data permission management method or processor in above-described embodiment execute the calculating when being executed by processor The data access method in above-described embodiment is realized when machine program.
Those of ordinary skill in the art will appreciate that realizing all or part of the process in above-described embodiment method, being can be with Relevant hardware is instructed to complete by computer program, the computer program can be stored in a non-volatile computer In read/write memory medium, the computer program is when being executed, it may include such as the process of the embodiment of above-mentioned each method.Wherein, To any reference of memory, storage, database or other media used in each embodiment provided herein, Including non-volatile and/or volatile memory.Nonvolatile memory may include read-only memory (ROM), programming ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM) or flash memory.Volatile memory may include Random access memory (RAM) or external cache.By way of illustration and not limitation, RAM is available in many forms, Such as static state RAM (SRAM), dynamic ram (DRAM), synchronous dram (SDRAM), double data rate sdram (DDRSDRAM), enhancing Type SDRAM (ESDRAM), synchronization link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic ram (DRDRAM) and memory bus dynamic ram (RDRAM) etc..
It is apparent to those skilled in the art that for convenience of description and succinctly, only with above-mentioned each function Can unit, module division progress for example, in practical application, can according to need and by above-mentioned function distribution by different Functional unit, module are completed, i.e., the internal structure of described device is divided into different functional unit or module, more than completing The all or part of function of description.
Embodiment described above is merely illustrative of the technical solution of the present invention, rather than its limitations;Although referring to aforementioned reality Applying example, invention is explained in detail, those skilled in the art should understand that: it still can be to aforementioned each Technical solution documented by embodiment is modified or equivalent replacement of some of the technical features;And these are modified Or replacement, the spirit and scope for technical solution of various embodiments of the present invention that it does not separate the essence of the corresponding technical solution should all It is included within protection scope of the present invention.

Claims (10)

1. a kind of data permission management method, which is characterized in that the data permission management method includes:
Data set is obtained, data cleansing is carried out to each basic data in the data set, obtains valid data collection;
Feature extraction is carried out to each basic data that the valid data are concentrated, obtains data characteristics collection, the data Feature set includes N number of data characteristics, and N is positive integer, each corresponding data characteristics of the basic data;
The feature scoring of each data characteristics is obtained using preset data grade form;
The feature deciding grade and level of each data characteristics is determined according to feature scoring;
It is that each data characteristics distributes permission according to feature deciding grade and level, it is corresponding described obtains each data characteristics The target permission of basic data.
2. data permission management method as described in claim 1, which is characterized in that described to carry out spy to the valid data collection Sign is extracted, and data characteristics collection is obtained, comprising:
If the data type that the valid data integrate is divided as text-type, to the valid data collection using participle technique Word obtains phrase as the data characteristics collection.
3. data permission management method as described in claim 1, which is characterized in that described to carry out spy to the valid data collection Sign is extracted, and data characteristics collection is obtained, comprising:
If the data type that the valid data integrate is binary data types, using Brief algorithm to the binary number Feature extraction is carried out according to type, obtains binary string as the data characteristics collection.
4. data permission management method as described in claim 1, which is characterized in that described to carry out spy to the valid data collection Sign is extracted, and data characteristics collection is obtained, comprising:
If the data type that the valid data integrate is structured data type, using query sentence of database to the structure Change data to be inquired, obtains data dimension as the data characteristics collection.
5. a kind of data access method, which is characterized in that the data access method includes:
Data access request is obtained, the data access request includes the Data Identification of current account information and data to be visited;
From presetting database, the corresponding access authority of the current account information is obtained, as current accessed permission, and is obtained The target permission of the corresponding basic data of Data Identification of the data to be visited, as target access permission, wherein the mesh Mark permission is obtained using the described in any item data permission management methods of such as Claims 1-4;
It verifies whether the target access permission exceeds the current accessed permission, is verified result;
If the verification result is the target access permission without departing from the current accessed permission, from the preset data In library, the corresponding basic data of the Data Identification is obtained, as data to be displayed;
According to the corresponding preset data conversion regime of the Data Identification, data conversion is carried out to the data to be displayed, is obtained Target shows data.
6. data access method as claimed in claim 5, which is characterized in that described to carry out data turn to the data to be displayed It changes, obtains target and show data, comprising:
The data to be displayed is converted with the conversion regime of transformation of data, alternatively, to the data to be displayed with data Hiding conversion regime is converted, and is obtained the target and is shown data.
7. a kind of data permission management method device, which is characterized in that the data authority management device includes:
Valid data collection obtains module, and for obtaining data set, it is clear to carry out data to each basic data in the data set It washes, obtains valid data collection;
Data characteristics collection obtains module, for carrying out feature extraction to each basic data that the valid data are concentrated, Data characteristics collection is obtained, the data characteristics collection includes N number of data characteristics, and N is positive integer, each basic data corresponding one A data characteristics;
Feature scoring obtains module, for obtaining the feature scoring of each data characteristics using preset data grade form;
Feature deciding grade and level determining module, for determining that the feature of each data characteristics is defined the level according to feature scoring;
Target authority acquiring module obtains each for being that each data characteristics distributes permission according to feature deciding grade and level The target permission of the corresponding basic data of the data characteristics.
8. a kind of data access device, which is characterized in that the Data Data access mechanism includes:
Data access request obtains module, and for obtaining data access request, the data access request includes current account letter The Data Identification of breath and data to be visited;
Access authority obtains module, for obtaining the corresponding access authority of the current account information from presetting database, makees For current accessed permission, and the target permission of the corresponding basic data of Data Identification of the data to be visited is obtained, as mesh Mark access authority, wherein the target permission is using such as the described in any item data permission management methods of Claims 1-4 It obtains;
Authority Verification module is verified knot for verifying whether the target access permission exceeds the current accessed permission Fruit;
Data to be displayed obtains module, for being the target access permission without departing from the current accessed in the verification result When permission, then from the preset database, the corresponding basic data of the Data Identification is obtained, as data to be displayed;
Target shows data acquisition module, for according to the corresponding preset data conversion regime of the Data Identification, to it is described to It shows that data carry out data conversion, obtains target and show data.
9. a kind of computer equipment, including memory, processor and storage are in the memory and can be in the processor The computer program of upper operation, which is characterized in that the processor realized when executing the computer program as claim 1 to Any one of 4 data permission management methods or the processor realize such as claim when executing the computer program Data access method described in 5-6.
10. a kind of computer readable storage medium, the computer-readable recording medium storage has computer program, and feature exists In, the data permission management method as described in any one of Claims 1-4 is realized when the computer program is executed by processor, Or the processor realizes the data access method as described in claim 5-6 when executing the computer program.
CN201910042526.9A 2019-01-17 2019-01-17 Data permission management method, data access method, device, equipment and medium Pending CN109815717A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910042526.9A CN109815717A (en) 2019-01-17 2019-01-17 Data permission management method, data access method, device, equipment and medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910042526.9A CN109815717A (en) 2019-01-17 2019-01-17 Data permission management method, data access method, device, equipment and medium

Publications (1)

Publication Number Publication Date
CN109815717A true CN109815717A (en) 2019-05-28

Family

ID=66604502

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910042526.9A Pending CN109815717A (en) 2019-01-17 2019-01-17 Data permission management method, data access method, device, equipment and medium

Country Status (1)

Country Link
CN (1) CN109815717A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113468115A (en) * 2021-07-23 2021-10-01 腾讯科技(深圳)有限公司 Log processing method, device, equipment and medium

Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102024006A (en) * 2009-09-23 2011-04-20 上海杉达学院 Method and device for conducting data access operation based on WEB
CN103530568A (en) * 2012-07-02 2014-01-22 阿里巴巴集团控股有限公司 Authority control method, device and system
CN105302845A (en) * 2014-08-01 2016-02-03 华为技术有限公司 Data information transaction method and system
CN105787064A (en) * 2016-03-01 2016-07-20 广州铭诚计算机科技有限公司 Mining platform establishment method based on big data
CN105912950A (en) * 2016-04-13 2016-08-31 国信优易数据有限公司 Data sharing and publishing system and method
CN106202400A (en) * 2016-07-11 2016-12-07 广东聚联电子商务股份有限公司 A kind of big data collection and analysis method complaining behavior
CN106547914A (en) * 2016-11-25 2017-03-29 国信优易数据有限公司 A kind of data acquisition management system and its method
CN107045503A (en) * 2016-02-05 2017-08-15 华为技术有限公司 The method and device that a kind of feature set is determined
CN107103245A (en) * 2016-02-23 2017-08-29 中兴通讯股份有限公司 The right management method and device of file
CN107369120A (en) * 2017-07-21 2017-11-21 上海润吧信息技术有限公司 A kind of smart business's management, service system and enterprise's activity assays
CN108491388A (en) * 2018-03-22 2018-09-04 平安科技(深圳)有限公司 Data set acquisition methods, sorting technique, device, equipment and storage medium
CN108833328A (en) * 2018-03-27 2018-11-16 博彦科技(上海)有限公司 Cloud management method, apparatus, storage medium and processor
CN108875356A (en) * 2018-05-29 2018-11-23 努比亚技术有限公司 A kind of data access method, terminal and computer readable storage medium

Patent Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102024006A (en) * 2009-09-23 2011-04-20 上海杉达学院 Method and device for conducting data access operation based on WEB
CN103530568A (en) * 2012-07-02 2014-01-22 阿里巴巴集团控股有限公司 Authority control method, device and system
CN105302845A (en) * 2014-08-01 2016-02-03 华为技术有限公司 Data information transaction method and system
CN107045503A (en) * 2016-02-05 2017-08-15 华为技术有限公司 The method and device that a kind of feature set is determined
CN107103245A (en) * 2016-02-23 2017-08-29 中兴通讯股份有限公司 The right management method and device of file
CN105787064A (en) * 2016-03-01 2016-07-20 广州铭诚计算机科技有限公司 Mining platform establishment method based on big data
CN105912950A (en) * 2016-04-13 2016-08-31 国信优易数据有限公司 Data sharing and publishing system and method
CN106202400A (en) * 2016-07-11 2016-12-07 广东聚联电子商务股份有限公司 A kind of big data collection and analysis method complaining behavior
CN106547914A (en) * 2016-11-25 2017-03-29 国信优易数据有限公司 A kind of data acquisition management system and its method
CN107369120A (en) * 2017-07-21 2017-11-21 上海润吧信息技术有限公司 A kind of smart business's management, service system and enterprise's activity assays
CN108491388A (en) * 2018-03-22 2018-09-04 平安科技(深圳)有限公司 Data set acquisition methods, sorting technique, device, equipment and storage medium
CN108833328A (en) * 2018-03-27 2018-11-16 博彦科技(上海)有限公司 Cloud management method, apparatus, storage medium and processor
CN108875356A (en) * 2018-05-29 2018-11-23 努比亚技术有限公司 A kind of data access method, terminal and computer readable storage medium

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113468115A (en) * 2021-07-23 2021-10-01 腾讯科技(深圳)有限公司 Log processing method, device, equipment and medium

Similar Documents

Publication Publication Date Title
US11574077B2 (en) Systems and methods for removing identifiable information
US11334635B2 (en) Domain specific natural language understanding of customer intent in self-help
WO2020147238A1 (en) Keyword determination method, automatic scoring method, apparatus and device, and medium
US20190332673A1 (en) Methods, devices, and systems for constructing intelligent knowledge base
US20230079326A1 (en) Identifying legitimate websites to remove false positives from domain discovery analysis
CN111797214A (en) Question screening method, device, computer equipment and medium based on FAQ database
CN110377900A (en) Checking method, device, computer equipment and the storage medium of Web content publication
WO2021120587A1 (en) Method and apparatus for retina classification based on oct, computer device, and storage medium
MY194497A (en) Biometric based user identity verification
CN112634017A (en) Remote card opening activation method and device, electronic equipment and computer storage medium
CN109815717A (en) Data permission management method, data access method, device, equipment and medium
CN114064893A (en) A kind of abnormal data auditing method, device, equipment and storage medium
CN111597453B (en) User image drawing method, device, computer equipment and computer readable storage medium
US12197865B2 (en) Learning framework for processing communication session transcripts
CN109727142A (en) Insuring method, system, equipment and storage medium
CN115269765A (en) Account identification method and device, electronic equipment and storage medium
CN113505293A (en) Information pushing method and device, electronic equipment and storage medium
CN112699348A (en) Method and device for verifying nuclear body information, computer equipment and storage medium
CN113987309B (en) Personal privacy data identification method and device, computer equipment and storage medium
CN118588228B (en) Stroke data reporting method, device, storage medium and program product
CN118484834B (en) Safe operation method based on data access relation
CN116599666B (en) Method, device, computer equipment and storage medium for generating password dictionary
CN113723524B (en) Data processing method based on prediction model, related equipment and medium
CN116244740B (en) Log desensitization method and device, electronic equipment and storage medium
CN116665668A (en) Audio data processing method, device and server

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20190528

RJ01 Rejection of invention patent application after publication