WO2017024956A1

WO2017024956A1 - Database access right processing method, device, and system

Info

Publication number: WO2017024956A1
Application number: PCT/CN2016/092672
Authority: WO
Inventors: 胡南杰
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2015-08-10
Filing date: 2016-08-01
Publication date: 2017-02-16
Also published as: CN106407757B; CN106407757A

Abstract

The application discloses a database access right processing method, device, and system. The method comprises: receiving a permission inherence request for automatically inheriting an access right, wherein generation of the permission inherence request is triggered by reconstruction or deletion of any table; parsing the permission inherence request and obtaining table information of the reconstructed or deleted table; querying and obtaining, according to the table information of the reconstructed or deleted table, a user permission corresponding to the reconstructed or deleted table; and re-issuing the user permission to the reconstructed or deleted table in a database. The application resolves a technical problem of a complicated and low-efficiency user authorization procedure dealing with a user permission loss owing to a reconstructed or deleted table in a database.

Description

Database access authority processing method, device and system

The present application claims the priority of the Chinese Patent Application No. 201510486696.8, filed on Aug. 10, 2015, entitled,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Technical field

The present application relates to the field of data processing, and in particular, to a method, device, and system for processing access rights of a database.

Background technique

In order to secure the data table stored in the database, the user's access to the data table is controlled by the user access authority. However, when the data table in the database is rebuilt or deleted, the user rights of the data table are lost, resulting in abnormal access of the user to the data table.

Taking the data warehouse as an example, the collected data is stored in the data warehouse according to a preset model. However, as the data warehouse data volume becomes larger and larger, and the business becomes more and more complex, the previous model design will change the data tables in the data warehouse continuously due to the continuous changes of various services. Peripheral systems rely on the loss of permissions on the account to affect the normal operation of the peripheral system.

In the related art, the following two solutions can be used to solve the problem that the data table is deleted after the data table is deleted and reconstructed. One is to wait until the user finds that he has lost the permission, and then the user initiates another application for the data table again, and takes a preset. The application process; the second is to query the user rights of the data table to be reconstructed or deleted from the metadata before rebuilding the data table, and then perform the authorization again in batches;

However, in the related art solution, if the user waits until the user finds that the right is lost, and passively waits for the user to re-apply autonomously, it may cause all the jobs that depend on the data table to execute incorrectly, and the repeated application also causes the resource to be wasteful and time-consuming. Power consumption; on the other hand, if the scheme of obtaining user rights of the data table to be reconstructed or deleted from the metadata is adopted, the user authority of the original data table cannot be correctly obtained after the data table has been reconstructed, and, according to each The user rights corresponding to the user are empowered, which increases the workload of the data table owner.

In view of the above-mentioned problem that the user authorization process is cumbersome and inefficient due to the loss of user rights after the table in the data warehouse is deleted or reconstructed, an effective solution has not been proposed yet.

Summary of the invention

The embodiment of the present application provides a method, a device, and a system for processing access rights of a database, so as to at least solve the problem that the authorization process for re-authorizing the user is cumbersome and inefficient due to loss of user rights after the table in the data warehouse is deleted or rebuilt. Technical problem.

According to an aspect of the embodiments of the present application, a method for processing access rights of a database is provided, including: receiving a rights inheritance request for automatically inheriting access rights, wherein the rights inheritance request is any data table in the database being reconstructed or After the deletion, the generated request is triggered; the permission inheritance request is parsed, and the table information of the reconstructed or deleted data table is obtained; and the user authority corresponding to the reconstructed or deleted data table is obtained according to the table information of the reconstructed or deleted data table; Reassign user rights to the rebuilt or deleted data tables in the database.

According to another aspect of the embodiments of the present application, an access authority processing apparatus for a database is further provided, comprising: a receiving module, configured to receive a rights inheritance request for automatically inheriting access rights, where the rights inheritance request is in a database The generated request is triggered after any data table is reconstructed or deleted; the parsing module is configured to parse the permission inheritance request, obtain the table information of the reconstructed or deleted data table; and the query module is configured to be used according to the reconstructed or deleted data table. The table information query obtains the user rights corresponding to the reconstructed or deleted data table; the weighting module is used to re-authorize the user rights to the data table reconstructed or deleted in the database.

According to still another aspect of the embodiments of the present application, a database access authority processing system is further provided, including: a database server, configured to save a database, and after any data table in the database is reconstructed or deleted, trigger generation is used for generating A permission inheritance request that automatically inherits the access authority; the permission processing system is configured to receive and parse the permission inheritance request, obtain the table information of the reconstructed or deleted data table, and rebuild the table according to the table information of the reconstructed or deleted data table After the user rights corresponding to the deleted data table, the user rights are re-granted to the data table in the database that is reconstructed or deleted.

In the embodiment of the present application, the permission inheritance request for automatically inheriting the access right is adopted, wherein the permission inheritance request is a method for triggering the generated request after any data table in the database is reconstructed or deleted, and the request for inheriting the request is resolved by Obtaining the table information of the reconstructed or deleted data table, and achieving the purpose of obtaining the user right corresponding to the reconstructed or deleted data table according to the table information of the reconstructed or deleted data table, thereby realizing the user right The technical effect of empowering the reconstructed or deleted data table in the database, thereby solving the technical problem of re-authorizing the user's authorization process due to the loss of user rights after the table in the data warehouse is deleted or reconstructed. .

DRAWINGS

The drawings described herein are provided to provide a further understanding of the present application and constitute a part of this application. The illustrative embodiments and the description thereof are for explaining the present application and do not constitute an undue limitation of the present application. In the drawing:

1 is a block diagram showing the hardware structure of a computer terminal for processing access rights of a database according to an embodiment of the present application;

2 is a schematic flowchart of a method for processing access rights of a database according to Embodiment 1 of the present application;

3 is a schematic diagram of interaction of an optional access processing method of a database according to Embodiment 1 of the present application;

4 is a flowchart of an optional access processing method of a database according to Embodiment 1 of the present application;

5 is a schematic structural diagram of an access authority processing apparatus of a database according to Embodiment 2 of the present application;

6 is a schematic structural diagram of an optional parsing module according to Embodiment 2 of the present application;

7 is a schematic structural diagram of an optional query module according to Embodiment 2 of the present application;

8 is a schematic structural diagram of an access authority processing apparatus of an optional database according to Embodiment 2 of the present application;

9 is a schematic structural diagram of an optional weighting module according to Embodiment 2 of the present application;

FIG. 10 is a schematic structural diagram of another optional access right processing device of a database according to Embodiment 2 of the present application; FIG.

11 is a schematic structural diagram of an access authority processing system of a database according to Embodiment 3 of the present application;

FIG. 12 is a structural block diagram of a computer terminal according to an embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present application are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present application. It is an embodiment of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope shall fall within the scope of the application.

It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or order. It is to be understood that the data so used may be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "comprises" and "comprises" and "the" and "the" are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to Those steps or units, but may include those that are not clearly listed or Other steps or units inherent to these processes, methods, products or equipment.

The terms referred to in this application are explained below:

Open Data Processing Service (ODPS) is a self-developed Alibaba Cloud that provides distributed processing capabilities for TB/PB-level data. It is suitable for connection data processing, data analysis, data mining, and business intelligence. .

Example 1

According to an embodiment of the present application, a method embodiment of a method for processing access rights of a database is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings may be in a computer system such as a set of computer executable instructions. The steps shown and described may be performed in a different order than the ones described herein, although the logical order is shown in the flowchart.

The method embodiment provided in Embodiment 1 of the present application can be executed in a mobile terminal, a computer terminal or the like. Taking a computer terminal as an example, FIG. 1 is a hardware structural block diagram of a computer terminal for processing access rights of a database according to an embodiment of the present application. As shown in FIG. 1, computer terminal 10 may include one or more (only one shown) processor 102 (processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA) A memory 104 for storing data, and a transmission module 106 for communication functions. It will be understood by those skilled in the art that the structure shown in FIG. 1 is merely illustrative and does not limit the structure of the above electronic device. For example, computer terminal 10 may also include more or fewer components than those shown in FIG. 1, or have a different configuration than that shown in FIG.

The memory 104 can be used to store software programs and modules of the application software, such as program instructions/modules corresponding to the access permission processing method of the database in the embodiment of the present application, and the processor 102 runs the software program and the module stored in the memory 104, thereby Perform various functional applications and data processing, that is, implement the vulnerability detection method of the above application. Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, memory 104 may further include memory remotely located relative to processor 102, which may be coupled to computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

Transmission device 106 is for receiving or transmitting data via a network. The network specific examples described above may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF). A module for communicating wirelessly with the Internet.

In the above operating environment, the present application provides a method for processing access rights of a database as shown in FIG. 2 . 2 is a flowchart of a method for processing access rights of a database according to Embodiment 1 of the present application. It should be noted that, in the embodiment of the present application, the computer terminal 10 shown in FIG. 1 may be a rights server.

As shown in FIG. 2, an optional database access permission processing method includes the following implementation steps;

Step S202: The rights inheritance request for automatically inheriting the access right may be received by the rights server, where the rights inheritance request is a request that is triggered after any data table in the database is reconstructed or deleted;

In the above step S202 of the present application, the database may be any one of the database servers. Any data table in the database may have a preset access permission attribute, wherein the attribute of the access right may include any one or more of the following rights: read permission, write permission, delete permission, or modify permission. Reconstruction and deletion are performed on the data table contained in the database. After the data table is reconstructed or deleted, the access rights set in the database before the data table may be lost, so that the user may be modified or deleted next time. Access to the data table is denied, affecting the normal use of the user.

It should be noted here that the permission inheritance request is designed to automatically initiate the function of obtaining the access rights of the reconstructed or deleted data table, in order to obtain the reconstructed or deleted data by using the access rights of the data table before or after being deleted. The permission of the data table enables the user to access the reconstructed or deleted data table without revisiting the application permission. That is, the permission inheritance request is used to start the reconstructed or deleted data table after the automatic inheritance is reconstructed or deleted. Access to the data table.

It should also be noted here that the rights inheritance request may be issued by a database server for storing a database, and the database server has a communication relationship with the computer terminal 10 shown in FIG. 1, and may trigger the database when operating the data table in the database. The trigger in the trigger causes the trigger to emit information carrying the specific operational content. By listening to the creation, modification, or deletion of the data table in the database, after any data table in the database is reconstructed or deleted, the access permission inheritance for starting the reconstructed or deleted data table is automatically generated. Request.

It should be noted that the database in the embodiment of the present application may include a transactional database in a general sense, such as Oracle, SQL Server, or a subject-type data warehouse; and may include a local storage database. It can also contain a cloud database.

For example, taking Alibaba Cloud's open data processing service as an example, a possible application scenario is illustrated: Suppose that every transaction data in the July Taobao website is obtained from the Taobao database, and then the transaction data is processed and processed to obtain the sales fact. Table, including order number, product key, seller key and buyer key, sales volume and sales time; The product dimension table, the seller dimension table and the buyer dimension table are respectively associated with the sales fact table through the product key, the seller key and the buyer key; the above fact table and the dimension table are uploaded to the ODPS storage, assuming that the product is reconstructed or deleted Dimension table (hereinafter referred to as data table A). After the user opens the ODPS service, the owner of the data table A is requested to access the data table A. After the user applies for the data table A, the user is allowed to access the data table A by setting the content of the data table A. The user can initiate a query request through the ODPS client to access the data table A in the database. When the original data table A in the database is reconstructed, the reconstructed data table A (hereinafter referred to as the new data table A') is obtained, and the access authority information about all users (including the above users) in the new data table A' may also be obtained. Lost with the rebuild operation. At this time, the reconstruction operation of the data table A can be triggered to generate a rights inheritance request to trigger the operation of the new data table A' to inherit the access authority information of all users in the data table A.

Step S204: The rights inheritance request may be parsed by the rights server to obtain the table information of the reconstructed or deleted data table;

In the above step S204 of the present application, the rights inheritance request may be sent by the database server according to a predetermined format, carrying specific operation content for the data table A, and when the operation content carried in the confirmation permission inheritance request is a reconstructed data table or a deleted data table, Then, the table information of the reconstructed or deleted data table is read from the permission inheritance request; when the operation content carried in the permission inheritance request is not reconstructed or deleted, the step of inheriting the access permission of the data table is not performed.

Optionally, the foregoing table information may include: a name of the data table, a creation time of the data table, and a creator of the data table, etc., after the data table is reconstructed or deleted, ensuring that at least one of the table information does not change.

Still taking Alibaba Cloud's open data processing service as an example, when the data table A is reconstructed to obtain the new data table A', the data access request carries the table information of the new data table A', for example, the name of the new data table A'. The rights server parses the rights inheritance request and obtains the table name of the new data table A' included in the rights inheritance request.

Step S206: The user authority corresponding to the reconstructed or deleted data table according to the table information of the reconstructed or deleted data table may be implemented by the rights server;

In the above step S206 of the present application, the pre-stored access right database may be accessed in the rights server, and the access right database is used to save the user rights preset in the data table of the triggered application in the database server, that is, any data in the database server. After the table is applied by the user, the table information of the data table and the corresponding user rights are saved to the access authority database.

Therefore, in an optional solution, the manner in which the user rights corresponding to the data table are created and updated in the access permission database may be: the table information of the data table to be applied after the user applies to access the data table in the database server. And the access rights that have been set in the data table are packaged and sent to the access rights database for storage.

The rights information that has been saved in the database is collected based on the foregoing collection. After the rights server receives the table information of the reconstructed or deleted data table, the traversal query is performed from the access rights database based on the table information, and the corresponding information of the table information is obtained. User rights.

Still taking Alibaba Cloud's open data processing service as an example, the table A is stored in the cloud database, and the user rights of each user set are recorded in the access authority database, that is, after the user applies the table A in the ODPS, the user pair is The user rights for Table A are stored in the access rights database. After the data table A is reconstructed to obtain the new data table A', the table information of the reconstructed or deleted data table, for example, the table name of the new data table A', is parsed from the rights inheritance request. In an application scenario, since the table name does not change during the reconstruction of the data table, all user rights of the recorded new data table A' can be queried from the access authority database according to the table name of the new data table A'. Optionally, the access rights database can be stored locally on the rights server or in the Alibaba Cloud.

Step S208: The user authority can be re-weighted to the data table reconstructed or deleted in the database by the rights server.

In the above step S208 of the present application, the re-established or deleted data table continues to be re-weighted, that is, the rights server returns the user rights of the reconstructed or deleted data table obtained from the access right database to the database server. The data table that is reconstructed or deleted has the same user rights record as the original data table before being reconstructed or deleted.

Still taking Alibaba Cloud's open data processing service as an example, all user rights of the new data table A' queried from the access rights database are sent to the database server, such as the Alibaba Cloud database server, to realize the new use of the query. All user rights of the data table A' are reset to the new data table A' so that the new data table A' has the same effect as the user table setting of the data table A. When the user accesses the new data table A', since the user authority is updated or reset in the new data table A' after the above operation, the user's access can be controlled according to the user authority recorded in the data table A.

As can be seen from the above, in the solution provided in the foregoing Embodiment 1, the user permission of each data table in the database is pre-stored or backed up, so that the data table in the database is reconstructed or deleted, even after being reconstructed or deleted. If the user access right of the data table is lost, the method of generating the permission inheritance request after the rebuilding or deleting may be implemented, and after parsing the permission inheritance request and obtaining the table information of the reconstructed or deleted data table, each data stored from the pre-stored data is obtained. In the user right of the table, the query obtains the purpose of the user right corresponding to the reconstructed or deleted data table; so that the user right is re-weighted to the reconstructed or deleted data table in the database, and the data that is reconstructed or deleted is reached. The technical effect of synchronous recovery of user rights in the table further solves the technical problem that the authorization process of re-authorizing the user is cumbersome and inefficient due to the loss of user rights after the table in the data warehouse is deleted or rebuilt. Finally, one On the other hand, it liberates the owner of the data table from the tedious work of re-emphasizing the data table after being reconstructed and deleted, greatly reducing the workload of the data table owner; on the other hand, also making the user access When the data table is rebuilt or deleted, it is no longer necessary to repeatedly apply for permission, which guarantees a good user experience; in another aspect, it also realizes the timely and efficient re-establishment or deletion of the data table's permission inheritance, ensuring the data table. The security of the data.

In an optional solution provided by the foregoing embodiment, the privilege inheritance request includes a DDL event, where the step S204: parsing the privilege inheritance request, and obtaining the table information of the reconstructed or deleted data table may further include the following specific Implementation steps:

Step S2042: The DDL event can be parsed by the rights server, and the table information of the data table reconstructed or deleted in the database is obtained.

In the above step S2042 of the present application, a trigger may be created in the database, and an event triggering the trigger is specified when the trigger is created. In an alternative approach, trigger events for triggers are generally divided into three categories, data manipulation language (DML) events, data definition language (DDL) events, and database events. The DDL event corresponds to a DDL trigger, which is used to trigger when modifying a data object in the database. Specifically, when a data table is created in the database, a data table is reconstructed, and a data table is deleted, a DDL event is triggered.

Based on the operation of triggering the DDL event, after the rights server receives the permission inheritance request including the DDL event, it is determined whether the operation of triggering the DDL event is an operation of reconstructing the data table or deleting the data table, and if the determination is yes, from the DDL The table information of the data table that was reconstructed or deleted is read in the event.

For example, in the case of Alibaba Cloud's open data processing service, the rights server subscribes to the DDL event in the ODPS and receives the DDL event in the ODPS through the HTTP interface provided by the rights server. When the ODPS execution rebuilds or deletes the data table A, the ODPS issues a rights inheritance request for automatically inheriting the user rights including the DDL event to the rights server, and the rights server resolves the rights inheritance request and parses the DDL event to obtain the DDL event. After the specific operation of the data table A is included, it is further determined that the specific operation is the reconstruction or deletion operation of the data table A, and the table information of the data table A is read from the authority inheritance request. It should be noted here that when the data table A is a newly created dimension table, the user rights for the table A have not been set, and the table A does not need to automatically inherit the user rights.

As can be seen from the above, the above step S2042 of the present application provides an alternative to obtaining table information of the reconstructed or deleted data table. The table information of the data table reconstructed or deleted is read from the permission inheritance request by parsing the permission inheritance request including the DDL event.

In an optional solution provided by the foregoing embodiment of the present application, step S206: querying, according to the table information of the reconstructed or deleted data table, the user right corresponding to the reconstructed or deleted data table, and may further include the following specific Steps:

Step S2062: The permission server is used to determine whether the data table is a data table previously applied by the user according to the table information of the reconstructed or deleted data table;

In the above step S2062 of the present application, the application identifier may be added to the data table previously applied by the user to indicate that the data table has been applied by the user; and the table information of all the data tables applied by the user may be collected. It can be judged by means of querying the table information.

Step S2064: The permission server may be used to implement the historical user authority set by the user for the data table before the data table that is reconstructed or deleted is the data table that the user has applied before;

In the above step S2064 of the present application, the historical user authority is the historically set user access right to the data table. The local relational database can be an access authority database and stored locally on the rights server. Through the corresponding settings, the user can apply for the operation of the data table to trigger the set user's authority on the data table to be stored in the access right database, that is, the access right database records all the permission records previously applied by the user.

Step S2066: The historical user authority set by the user for the data table may be assigned to the reconstructed or deleted data table by using the rights server, and the user authority for re-authorizing the reconstructed or deleted data table is obtained.

In the above step S2066 of the present application, after the historical user authority is obtained from the access right database, the authority server assigns the historical user authority to the data table, that is, the authority server associates the historical user authority of the queried data table with the data table. Get the user rights you need to re-enforce the rebuilt or deleted data table.

It can be seen from the above that the above steps S2062 to S2066 of the present application provide a user right corresponding to obtaining the reconstructed or deleted data table, and firstly determine whether the reconstructed or deleted data table is the data table previously applied by the user. In the method, when it is determined that no user has applied for the data table, the operation of inheriting the rights is not performed; when it is determined that the user has applied for the data table, the historical user right query is performed from the pre-stored access right database, and the query is performed. The obtained historical user authority is assigned to the reconstructed or deleted data table, and the user right corresponding to the reconstructed or deleted data table is obtained.

In an optional solution provided by the foregoing embodiment of the present application, the access permission processing method of the database in the embodiment of the present application is performed before the step S206 is performed to determine whether the data table is the data table that the user has applied before, according to the table information of the data table. You can also perform the following implementation steps:

Step S2052: If any data table that has been saved in the database is applied by the user, and the application is successful, generating and storing a table information set of the data table applied by the user;

If the table information of the reconstructed or deleted data table is successfully matched in the table information set of the data table that has been stored by the user, the data table that is reconstructed or deleted is determined to be the data table that the user has applied for before.

In the above step S2052 of the present application, after any data table in the database is successfully applied by the user, the user may store the access authority, the user identifier, and the table information that the user has, and at least once, the user successfully applies the operation. A collection of table information for a data table that has been requested by a user. The set of table information of the data table applied by the user may be stored in the access authority database.

Based on the obtained set of table information of the data table applied by the user, an optional manner of determining whether the data table is a data table that the user has previously applied includes: obtaining, according to the obtained table information of the reconstructed or deleted data table. From the table information of the data table applied by the user, by traversing the query, it is determined whether there is information that matches the table information of the reconstructed or deleted data table, and if the determination is yes, the The data table that was reconstructed or deleted is a data table that has been previously requested by the user.

Still taking Alibaba Cloud's open data processing service as an example, when the user successfully applies for the data table A in the ODPS, the table information of the data table A, the user identifier, and the access authority of the user to the data table A are stored in the access right database. in. For example, after the data table A is reconstructed, the rights server receives the permission inheritance request that receives the DDL event by receiving the event in the ODPS subscription event, and the rights server parses the table information of the new data table A' and records it from the access rights database. The table information traverses the query. When it is determined that the access authority database has content matching the table information of the new data table A', it can be determined that the data table A is the data table previously requested by the user.

In another possible application scenario, when the data table B in the database is reconstructed to obtain the new data table B', if the user has not applied for the data table B, the historical user who does not record the data table B in the access rights database Permissions. At this time, even if the permission inheritance request including the DDL event sent by the ODPS is received, and the table information of the new data table B' is parsed, the new data table B' cannot be queried from the table information recorded in the access authority database. When the table information matches the content, it can be determined that the data table B has not been applied by the user before.

It can be seen from the above that the above step S2052 of the present application provides a scheme for pre-storing the table information of the data table applied by the user, so that it can be determined by querying the comparison whether the reconstructed or deleted data table is previously applied by the user. In order to facilitate the reading of historical user rights of data tables that have been previously rebuilt or deleted by users.

In an optional solution provided by the foregoing embodiment of the present application, step S208: re-granting the user right to the reconstructed or deleted data table in the database may further include the following specific implementation steps:

Step S2082: The permission information may be used to encapsulate the table information of the reconstructed or deleted data table and the obtained user rights corresponding to the reconstructed or deleted data table, and obtain a permission reset statement that allows the database to be recognized;

In the above step S2082 of the present application, the permission reset statement may be a grant permission statement, and the user permission statement is granted. Different types of permission reset statements may be supported based on different databases. Take SQL as an example, you can use the grant statement to implement permission reset. The rights server generates a rights reset statement according to the obtained user rights and table information corresponding to the reconstructed or deleted data table.

Step S2084: The permission resetting statement can be returned to the server where the database is located by the rights server, so that the user rights are re-granted to the data table in the database that is reconstructed or deleted.

In the above step S2084 of the present application, the role of the rights reset statement is the reconstructed or deleted data table, so the rights server needs to first send the rights reset statement to the database server where the reconstructed or deleted data table is located; After receiving the permission reset statement, the execution permission reset statement is implemented to implement the re-weighting operation on the reconstructed or deleted data table.

It can be seen from the above that the above steps S2082 to S2084 of the present application provide a scheme for re-weighting the reconstructed or deleted data table, and the rights server can use the rights server to identify the obtained table information of the data table according to the database. In the manner, the permission reset statement is generated, and the permission reset statement is sent to the database server, and after the function corresponding to the permission reset statement is executed, the re-weighting of the reconstructed or deleted data table is implemented.

In an optional solution provided by the foregoing embodiment of the present application, before performing the step S202: receiving the permission inheritance request for automatically inheriting the access right, the access permission processing method of the database in the embodiment of the present application may further perform the following implementation steps:

Step S201: After the database server is used to realize that any one of the data tables in the database is reconstructed or deleted, the trigger system automatically generates a permission inheritance request.

In the above step S201 of the present application, when the data table in the database is operated, the trigger in the database may be triggered, so that the trigger sends the information carrying the specific operation content. By monitoring the creation, modification, or deletion of the data table in the database, after any data table in the database is reconstructed or deleted, the database server for storing the database is issued for starting the reconstruction or deletion. The request for access to the data table is inherited.

As can be seen from the above, the foregoing step S201 of the present application provides an optional solution for generating a permission inheritance request by the database server, and uses the operation of the data table in the database to monitor, so that when the data table is reconstructed or deleted, the trigger system automatically generates. Permission inheritance request.

FIG. 3 is a schematic diagram of interaction of an access method for processing an optional database according to Embodiment 1 of the present application; and the functions implemented by applying the solution of the present application in a specific system are described in detail below with reference to FIG. 3:

As shown in FIG. 3, the database server 301 includes a plurality of databases, such as the database 3011, the database 3012, and the database 3013 shown in FIG. 3, and the data tables in any one of the database servers 301 are possible. Rebuild or delete occurred.

The rights server 302 is configured to parse the time after receiving the permission inheritance request, and after querying the corresponding user rights in the local database, reassemble the empowerment statement, obtain the permission reset statement, and then return to the database server for execution.

The local database 303 can be the above-mentioned access rights database for storing user rights of all data tables that the user has previously applied for.

FIG. 4 is a flowchart of an optional access processing method of a database according to Embodiment 1 of the present application; and the method flow in the optional application scenario of the present application, in particular, with reference to FIG. 3 and FIG. Taking the reconstruction data table as an example, the method flow executed by the rights server 302 is described in detail:

When the privilege server receives the privilege inheritance request through the external HTTP protocol interface, taking ODPS as an example, as long as the ODPS subscribes to the event, when the ODPS performs the DDL change, the event notification permission server is sent; and the privilege inheritance request is included in the judgment authority inheritance request. After the DDL event, the following process begins:

Step A: analyzing an event carried in the received permission inheritance request;

Specifically, in the foregoing step A, after receiving the request, first determining the event carried in the request for analysis, and determining whether it is a DDL event,

Step B: parsing the event and determining whether it is a DDL event of the reconstructed table;

Specifically, in the above step B, the DDL event is parsed, and it is determined whether the event triggering the DDL is an event of data table reconstruction. If the determination is yes, the DDL event is determined to be the DDL of the reconstruction table. Further, after determining that the DDL event is a DDL event of the reconstruction table, extracting table information of the reconstructed data table from the DDL event;

Step C: querying related information of the table weight item from the local database;

Specifically, in the above step C, all the records requested by the previous user are recorded in the local database. When parsing and judging that the rebuild table is a data table that the user has applied for before, the user may authorize the user authorization before the table from the local relational database, and obtain the user authority corresponding to the table;

Step D: re-execute the empowerment statement;

Specifically, in the above step D, the user rights set in the table are encapsulated according to the statement that the database server can recognize, the permission reset statement is obtained, and the permission reset statement is returned to the database server, so that the database server performs the permission reset. The statement is re-empowered.

When the DDL event of the non-reconstructed table is determined in step B, and the execution of step D is completed, an authorization process ends.

In summary, the embodiment of the present application receives the DDL change event through the externally provided http interface, and realizes that the permission of the previously applied table can be inherited after the data warehouse table is reconstructed, and does not affect the user and the production, and reaches the table. After being rebuilt, the default user will restore the previous table permissions, be transparent to the user, and do not need to re-apply the technical effect; at the same time, the table owner can no longer pay attention to the downstream dependent jobs of the table, reducing the owner workload.

It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the present application is not limited by the described action sequence. Because certain steps may be performed in other sequences or concurrently in accordance with the present application. In the following, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present application, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present application.

Example 2

According to the embodiment of the present application, there is also provided an access right processing device for a database for implementing the access authority processing method of the above database, and the device provided by the above embodiment of the present application can be run on a computer terminal.

5 is a schematic structural diagram of an access right processing apparatus of a database according to Embodiment 2 of the present application; as shown in FIG. 5, the access authority processing apparatus of the database includes: a receiving module 502, a parsing module 504, a query module 506, and an empowering module. 508, where:

The receiving module 502 is configured to receive a permission inheritance request for automatically inheriting the access right, where the permission inheritance request triggers the generated request after any data table in the database is reconstructed or deleted;

The parsing module 504 is configured to parse the permission inheritance request, and obtain table information of the reconstructed or deleted data table;

The querying module 506 is configured to query, according to the table information of the reconstructed or deleted data table, the user rights corresponding to the reconstructed or deleted data table;

The weighting module 508 is configured to re-authorize the user rights to the data table in the database that is reconstructed or deleted.

As can be seen from the above, in the foregoing receiving module 502, the parsing module 504, the querying module 506, and the weighting module 508, the data table in the database is reconstructed by pre-storing or backing up the user rights of each data table in the database. Or delete, even if the user access rights of the reconstructed or deleted data table are lost, you can pass After the rebuilding or deleting, the method for generating the permission inheritance request is triggered. After the permission inheritance request is resolved, and the table information of the reconstructed or deleted data table is obtained, the query is reconstructed or deleted from the user rights of each pre-stored data table. The purpose of the user rights corresponding to the data table; the user rights are re-weighted to the reconstructed or deleted data table in the database, and the technical effect of synchronously restoring the user rights in the reconstructed or deleted data table is achieved, thereby solving Due to the loss of user rights after the table in the data warehouse is deleted or rebuilt, the technical process of re-authorizing the user is cumbersome and inefficient. Finally, on the one hand, the liberation of the owner of the data table from the re-emphasis of the data table being reconstructed and deleted is greatly reduced, which greatly reduces the workload of the data table owner; When a user accesses a rebuilt or deleted data table, the user does not need to repeatedly apply for permission to ensure a good user experience; in another aspect, the timely and efficient re-establishment or deletion of the data table is inherited.

It should be noted that the foregoing receiving module 502, the parsing module 504, the querying module 506, and the weighting module 508 correspond to the steps S202 to S208 in the first embodiment, and the four modules and the corresponding steps are implemented by the examples and The application scenario is the same, but is not limited to the content disclosed in the first embodiment. It should be noted that the foregoing module may be implemented in the computer terminal 10 provided in the first embodiment as a part of the device, and may be implemented by software or by hardware.

Optionally, FIG. 6 is a schematic structural diagram of an optional parsing module according to Embodiment 2 of the present application; as shown in FIG. 6, when the DDL event is included in the privilege inheritance request, the parsing module 504 according to the embodiment of the present application. The method includes: a parsing unit 602, wherein:

The parsing unit 602 is configured to parse the DDL event to obtain table information of the data table reconstructed or deleted in the database.

As can be seen from the above, the parsing unit 602 of the present application provides an alternative to obtaining table information of the reconstructed or deleted data table. The table information of the data table reconstructed or deleted is read from the permission inheritance request by parsing the permission inheritance request including the DDL event.

It should be noted that the parsing unit 602 corresponds to the step S2042 in the first embodiment, and the module is the same as the example and the application scenario implemented by the corresponding steps, but is not limited to the content disclosed in the first embodiment. It should be noted that the foregoing module may be implemented in the computer terminal 10 provided in the first embodiment as a part of the device, and may be implemented by software or by hardware.

Optionally, FIG. 7 is a schematic structural diagram of an optional query module according to the second embodiment of the present application; as shown in FIG. 7, the query module 506 according to the embodiment of the present application includes: a determining unit 702, a querying unit 704, and An assignment unit 706, wherein:

The determining unit 702 is configured to determine, according to the table information of the reconstructed or deleted data table, whether the data table is a data table that the user has previously applied for;

The querying unit 704 is configured to: if the data table that is reconstructed or deleted is a data table that the user has applied for before, query the local relational database to obtain the historical user authority set by the user for the data table;

The assignment unit 706 is configured to assign the historical user authority set by the user for the data table to the reconstructed or deleted data table, and obtain the user authority for re-giving the reconstructed or deleted data table.

As can be seen from the above, the foregoing determining unit 702, the querying unit 704, and the assigning unit 706 of the present application provide a user right corresponding to obtaining the reconstructed or deleted data table, and first determining whether the reconstructed or deleted data table is the user before The method of applying the data table does not perform the operation of privilege inheritance when it is judged that no user has applied for the data table; when it is determined that the user has applied for the data table, the history is performed from the pre-stored access authority database. The user permission query assigns the queried historical user authority to the reconstructed or deleted data table, and realizes the user right corresponding to the reconstructed or deleted data table.

It should be noted that the foregoing determining unit 702, the querying unit 704, and the assigning unit 706 correspond to steps S2062 to S2066 in the first embodiment, and the three modules are the same as the examples and application scenarios implemented by the corresponding steps, but It is not limited to the contents disclosed in the above embodiment 1. It should be noted that the foregoing module may be implemented in the computer terminal 10 provided in the first embodiment as a part of the device, and may be implemented by software or by hardware.

Optionally, FIG. 8 is a schematic structural diagram of an access permission processing apparatus of an optional database according to Embodiment 2 of the present application; as shown in FIG. 8, the access authority processing apparatus of the database according to the embodiment of the present application further includes: The storage module 802, wherein:

The storage module 802 is configured to generate and store a table information set of a data table applied by the user if any data table has been saved in the database and the application is successful; wherein, if the data table is reconstructed or deleted If the table information is successfully matched in the table information set of the data table that has been stored by the user, the data table that is reconstructed or deleted is determined to be the data table that the user has applied for before.

As can be seen from the above, the foregoing storage module 802 of the present application provides a scheme for pre-storing table information of a data table applied by a user, so that whether the reconstructed or deleted data table is previously used by the user can be determined by querying the comparison manner. It has been applied to facilitate the reading of historical user rights of data tables that have been previously rebuilt or deleted by users.

It should be noted that the foregoing storage module 802 corresponds to the step S2052 in the first embodiment, and the module is the same as the example and the application scenario implemented by the corresponding steps, but is not limited to the content disclosed in the first embodiment. It should be noted that the foregoing module may be implemented in the computer terminal 10 provided in the first embodiment as a part of the device, and may be implemented by software or by hardware.

Optionally, FIG. 9 is a schematic structural diagram of an optional weighting module according to the second embodiment of the present application; as shown in FIG. 9, the weighting module 508 according to the embodiment of the present application includes: a packaging unit 902 and an empowerment Unit 904, wherein:

The encapsulating unit 902 is configured to encapsulate the table information of the reconstructed or deleted data table and the obtained user rights corresponding to the reconstructed or deleted data table, to obtain a permission reset statement that allows the database to be recognized;

The weighting unit 904 is configured to return the permission reset statement to the server where the database is located, so that the user rights are re-granted to the data table in the database that is reconstructed or deleted.

As can be seen from the above, the foregoing encapsulating unit 902 and the entitlement unit 904 of the present application provide a scheme for re-emphasizing the reconstructed or deleted data table, and using the permission server to obtain the obtained permission information and the table information of the data table according to the database. The identifiable way, the privilege reset statement is generated, and the privilege reset statement is sent to the database server, and then the re-empowerment of the reconstructed or deleted data table is implemented after the function corresponding to the privilege reset statement is executed. .

It should be noted that the foregoing encapsulation unit 902 and the entitlement unit 904 correspond to steps S2082 to S2084 in the first embodiment, and the two modules are the same as the examples and application scenarios implemented by the corresponding steps, but are not limited to the above. The content disclosed in the first embodiment. It should be noted that the foregoing module may be implemented in the computer terminal 10 provided in the first embodiment as a part of the device, and may be implemented by software or by hardware.

Optionally, FIG. 10 is a schematic structural diagram of an access permission processing apparatus of another optional database according to Embodiment 2 of the present application; as shown in FIG. 10, the access authority processing apparatus of the database according to the embodiment of the present application further includes : Trigger module 1002, wherein:

The triggering module 1002 is configured to trigger the system to automatically generate a permission inheritance request after any data table in the database is reconstructed or deleted.

As can be seen from the above, the trigger module 1002 of the present application provides an optional solution for generating a permission inheritance request by the database server, and uses the operation of the data table in the database to monitor, so that when the data table is reconstructed or deleted, the trigger system automatically Generate a permission inheritance request.

It should be noted that the triggering module 1002 corresponds to the step S201 in the first embodiment, and the module is the same as the example and the application scenario implemented by the corresponding steps, but is not limited to the content disclosed in the first embodiment. It should be noted that the foregoing module may be implemented in the computer terminal 10 provided in the first embodiment as a part of the device, and may be implemented by software or by hardware.

The preferred embodiment provided by the foregoing embodiment 2 of the present application is the same as the implementation of the method embodiment and the application scenario provided by the first embodiment, but is not limited to the solution provided by the first embodiment.

Example 3

According to the embodiment of the present application, a database access authority processing system is also provided, and FIG. 11 is a schematic structural diagram of a database access authority processing system according to Embodiment 3 of the present application.

As shown in FIG. 11, the access authority processing system of the database includes: a database server 111 and a rights processing system 113, wherein:

The database server 111 is configured to save the database, and after any data table in the database is reconstructed or deleted, triggering a permission inheritance request for automatically inheriting the access right;

The privilege processing system 113 is configured to receive and parse the privilege inheritance request, obtain the table information of the reconstructed or deleted data table, and obtain the data table corresponding to the reconstructed or deleted data table according to the table information of the reconstructed or deleted data table. After the user rights, the user rights are re-assigned to the data tables in the database that are reconstructed or deleted.

Specifically, any data table in the database may have a preset access permission attribute, where the access permission attribute may include any one or more of the following rights: read permission, write permission, delete permission, or modify permission. Reconstruction and deletion are performed on the data table contained in the database. After the data table is reconstructed or deleted, the access rights set in the database before the data table may be lost, so that the user may be modified or deleted next time. Access to the data table is denied, affecting the normal use of the user.

Specifically, the database server 111 has a communication relationship with the computer terminal 10 shown in FIG. 1. When the data table in the database is operated, the trigger in the database may be triggered, so that the trigger sends the information carrying the specific operation content. By listening to the creation, modification, or deletion of the data table in the database, after any data table in the database is reconstructed or deleted, the access permission inheritance for starting the reconstructed or deleted data table is automatically generated. Request.

Specifically, when the rights processing system 113 confirms that the operation content carried in the rights inheritance request is a reconstructed data table or a deleted data table, the table information of the reconstructed or deleted data table is read from the rights inheritance request; If the operation content carried in is not rebuilt or deleted, the steps of inheriting the access rights of the data table are not performed. The privilege processing system 113 accesses the pre-stored user privilege data, and performs traversal query from the pre-stored user privilege data based on the table information of the reconstructed or deleted data table to obtain the corresponding user privilege of the table information.

Specifically, the rights processing system 113 encapsulates the table information of the reconstructed or deleted data table and the obtained user rights corresponding to the reconstructed or deleted data table, and obtains a permission reset statement that allows the database to be recognized; The statement is returned to the server where the database is located, so that the user rights are re-granted to the data table in the database that is reconstructed or deleted.

It should be noted that, in an optional application scenario, in conjunction with FIG. 3 and FIG. 11, the rights processing system 113 shown in FIG. 11 in the embodiment of the present application may include the rights server 302 and the local device shown in FIG. Database 303.

As can be seen from the above, in the solution provided in the foregoing Embodiment 3 of the present application, the user rights of each data table in the database are pre-stored or backed up, so that the data table in the database is reconstructed or deleted, even after being reconstructed or deleted. The user access right of the data table is lost. You can also generate a permission inheritance request after rebuilding or deleting. After parsing the permission inheritance request and obtaining the table information of the reconstructed or deleted data table, each data table is stored from the pre-stored data table. In the user right, the query obtains the purpose of the user right corresponding to the reconstructed or deleted data table; so that the user right is re-weighted to the reconstructed or deleted data table in the database, and the data table that is reconstructed or deleted is reached. The technical effect of synchronous recovery of user rights in the user solves the technical problem that the authorization process of re-authorizing the user is cumbersome and inefficient due to the loss of user rights after the table in the data warehouse is deleted or rebuilt. Finally, on the one hand, the liberation of the owner of the data table from the re-emphasis of the data table being reconstructed and deleted is greatly reduced, which greatly reduces the workload of the data table owner; When a user accesses a rebuilt or deleted data table, the user does not need to repeatedly apply for permission to ensure a good user experience; in another aspect, the timely and efficient re-establishment or deletion of the data table is inherited.

The preferred embodiment provided in the foregoing embodiment 3 of the present application is the same as the implementation and the application scenario provided in the first embodiment, but is not limited to the solution provided in the first embodiment.

Example 4

Embodiments of the present application may provide a computer terminal, which may be any one of computer terminal groups. Optionally, in this embodiment, the foregoing computer terminal may also be replaced with a terminal device such as a mobile terminal.

Optionally, in this embodiment, the computer terminal may be located in at least one network device of the plurality of network devices of the computer network.

In this embodiment, the computer terminal may execute the program code of the following steps in the vulnerability detection method of the application: receiving a permission inheritance request for automatically inheriting the access right, wherein the permission inheritance request is any data table in the database is Retrieve or delete the generated request; resolve the permission inheritance request, obtain the table information of the reconstructed or deleted data table; query the user corresponding to the reconstructed or deleted data table according to the table information of the reconstructed or deleted data table Permissions; reassign user rights to a rebuilt or deleted data table in the database.

Optionally, FIG. 12 is a structural block diagram of a computer terminal according to an embodiment of the present application. As shown in FIG. 12, the computer terminal A may include one or more (only one shown in the figure) processor, memory, and transmission means.

The memory can be used to store the software program and the module, such as the security vulnerability detection method and the program instruction/module corresponding to the device in the embodiment of the present application, and the processor runs the software program and the module stored in the memory. Thereby performing various functional applications and data processing, that is, the detection method for implementing the above system vulnerability attack. The memory may include a high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, the memory can further include memory remotely located relative to the processor, which can be connected to terminal A via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The processor may invoke the memory stored information and the application by the transmission device to perform the following steps: receiving a permission inheritance request for automatically inheriting the access right, wherein the permission inheritance request is reconstructed or deleted for any data table in the database. After triggering the generated request; parsing the permission inheritance request, obtaining the table information of the reconstructed or deleted data table; and querying the user authority corresponding to the reconstructed or deleted data table according to the table information of the reconstructed or deleted data table; User rights are re-assigned to the data tables in the database that are reconstructed or deleted.

Optionally, the foregoing processor may further execute the following program code: parse the DDL event, and obtain table information of the data table that is reconstructed or deleted in the database.

Optionally, the foregoing processor may further execute the following program code: determining, according to the table information of the reconstructed or deleted data table, whether the data table is a data table previously requested by the user; if the reconstructed or deleted data table is a user The previously applied data table is obtained from the local relational database to obtain the historical user authority set by the user for the data table; the historical user authority set by the user for the data table is assigned to the reconstructed or deleted data table, and the data table is obtained. Reauthorized or deleted data table re-authorized user rights. .

Optionally, the foregoing processor may further execute the following program code: if any data table has been saved in the database and is applied by the user, and the application is successful, generating and storing a table information set of the data table applied by the user; If the table information of the reconstructed or deleted data table matches successfully in the table information set of the data table that has been stored by the user, the data table that is reconstructed or deleted is determined to be the data table that the user has previously applied for.

Optionally, the foregoing processor may further execute the following program code: encapsulating the table information of the reconstructed or deleted data table and the obtained user rights corresponding to the reconstructed or deleted data table to obtain the database identification. The permission reset statement; returns the permission reset statement to the server where the database is located, so that the user rights are re-granted to the data table in the database that is reconstructed or deleted.

Optionally, the foregoing processor may further execute the following program code: after any data table in the database is reconstructed or deleted, the trigger system automatically generates a permission inheritance request.

In the embodiment of the present application, the user rights of each data table in the database are pre-stored or backed up, so that after the data table in the database is reconstructed or deleted, even if the user access rights of the reconstructed or deleted data table are lost, Can be used to resolve the permission inheritance request by triggering the permission to inherit the request after rebuilding or deleting. After taking the table information of the reconstructed or deleted data table, querying the user rights corresponding to the reconstructed or deleted data table from the user rights of each pre-stored data table; The data table reconstructed or deleted in the database achieves the technical effect of synchronously restoring user rights in the reconstructed or deleted data table, thereby solving the problem that the user rights are lost after the table in the data warehouse is deleted or reconstructed. The technical problem of re-authorizing the user's authorization process is cumbersome and inefficient. Finally, on the one hand, the liberation of the owner of the data table from the re-emphasis of the data table being reconstructed and deleted is greatly reduced, which greatly reduces the workload of the data table owner; When a user accesses a rebuilt or deleted data table, the user does not need to repeatedly apply for permission to ensure a good user experience; in another aspect, the timely and efficient re-establishment or deletion of the data table is inherited.

Those skilled in the art can understand that the structure shown in FIG. 12 is merely illustrative, and the computer terminal can also be a smart phone (such as an Android mobile phone, an iOS mobile phone, etc.), a tablet computer, an applause computer, and a mobile Internet device (Mobile Internet Devices, MID). ), PAD and other terminal devices. FIG. 12 does not limit the structure of the above electronic device. For example, computer terminal A may also include more or fewer components (such as a network interface, display device, etc.) than shown in FIG. 12, or have a different configuration than that shown in FIG.

A person of ordinary skill in the art may understand that all or part of the steps of the foregoing embodiments may be completed by a program to instruct terminal device related hardware, and the program may be stored in a computer readable storage medium, and the storage medium may be Including: flash disk, read-only memory (ROM), random access memory (RAM), disk or optical disk.

Example 5

Embodiments of the present application also provide a storage medium. Optionally, in this embodiment, the foregoing storage medium may be used to save the program code executed by the access permission processing method of the database provided in the first embodiment.

Optionally, in this embodiment, the foregoing storage medium may be located in any one of the computer terminal groups in the computer network, or in any one of the mobile terminal groups.

Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: receiving a permission inheritance request for automatically inheriting access rights, wherein the rights inheritance request is any one of the data tables in the database The generated request is triggered after being reconstructed or deleted; the permission inheritance request is parsed, and the table information of the reconstructed or deleted data table is obtained; and the data table corresponding to the reconstructed or deleted data table is obtained according to the table information of the reconstructed or deleted data table. User rights; reassign user rights to data tables that are reconstructed or deleted in the database.

Optionally, the storage medium is further configured to store program code for performing the steps of parsing the DDL event to obtain table information of the reconstructed or deleted data table in the database.

Optionally, the storage medium is further configured to store program code for performing the following steps: determining, according to the table information of the reconstructed or deleted data table, whether the data table is a data table previously requested by the user; if reconstructed or deleted The data table is the data table that the user has applied for before, and the historical user authority set by the user for the data table is obtained from the local relational database; the historical user authority set by the user for the data table is assigned to the reconstructed or deleted data table. , get the user rights re-empowered for the rebuilt or deleted data table. .

Optionally, the storage medium is further configured to store program code for performing the following steps: if any of the data tables in the database have been saved by the user and the application is successful, generating and storing a table of data tables requested by the user a set of information; wherein, if the table information of the reconstructed or deleted data table is successfully matched in the table information set of the data table that has been stored by the user, determining that the reconstructed or deleted data table is the data previously requested by the user table.

Optionally, the storage medium is further configured to store program code for performing the following steps: encapsulating the table information of the reconstructed or deleted data table and the obtained user rights corresponding to the reconstructed or deleted data table, Obtain a permission reset statement that allows the database to be recognized; return the permission reset statement to the server where the database is located, so that the user rights are re-granted to the data table in the database that is reconstructed or deleted.

Optionally, the storage medium is further arranged to store program code for performing the following steps: after any one of the data tables in the database is reconstructed or deleted, the triggering system automatically generates a rights inheritance request.

The serial numbers of the embodiments of the present application are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

In the above-mentioned embodiments of the present application, the descriptions of the various embodiments are different, and the parts that are not detailed in a certain embodiment can be referred to the related descriptions of other embodiments.

In the several embodiments provided by the present application, it should be understood that the disclosed technical contents may be implemented in other manners. The device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner. For example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or may be Each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application, in essence or the contribution to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like. .

The above description is only a preferred embodiment of the present application, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present application. It should be considered as the scope of protection of this application.

Claims

A method for processing access rights of a database, comprising:

Receiving a permission inheritance request for automatically inheriting the access right, wherein the permission inheritance request is a request triggered by the reconstruction or deletion of any one of the data tables in the database;

Parsing the permission inheritance request, and obtaining table information of the reconstructed or deleted data table;

Querying, according to the table information of the reconstructed or deleted data table, the user authority corresponding to the reconstructed or deleted data table;

Reassigning the user rights to the reconstructed or deleted data table in the database.
The method according to claim 1, wherein the rights inheritance request includes a DDL event, wherein the step of parsing the rights inheritance request to obtain table information of the reconstructed or deleted data table comprises: parsing the The DDL event obtains table information of the reconstructed or deleted data table in the database.
The method according to claim 2, wherein the user rights corresponding to the reconstructed or deleted data table are obtained according to the table information of the reconstructed or deleted data table, including:

Determining, according to the table information of the reconstructed or deleted data table, whether the data table is a data table previously requested by the user;

If the reconstructed or deleted data table is a data table that the user has previously applied for, the historical user authority set by the user for the data table is obtained from a local relational database;

Assigning the historical user rights previously set by the user for the data table to the reconstructed or deleted data table, and obtaining the user rights re-weighting the reconstructed or deleted data table.
The method according to claim 3, wherein before the determining whether the data table is a data table previously requested by the user according to the table information of the data table, the method further comprises:

If any data table has been saved in the database and is applied by the user, and the application is successful, generating and storing a table information set of the data table previously applied by the user;

Wherein, if the table information of the reconstructed or deleted data table is successfully matched in the already-stored table information set of the data table applied by the user, determining that the reconstructed or deleted data table is the user The data sheet that was previously applied.
The method of claim 1 wherein reassigning the user rights to the rebuilt or deleted data table in the database comprises:

Encapsulating the table information of the reconstructed or deleted data table and the obtained user rights corresponding to the reconstructed or deleted data table to obtain a permission reset statement that allows the database to be recognized;

Returning the rights reset statement to the server where the database is located, such that the user rights are re-granted to the reconstructed or deleted data table in the database.
The method according to any one of claims 1 to 5, wherein before receiving the permission inheritance request for automatically inheriting the access right, the method further comprises:

After any one of the data tables in the database is reconstructed or deleted, the triggering system automatically generates the permission inheritance request.
A database access authority processing device, comprising:

a receiving module, configured to receive a permission inheritance request for automatically inheriting access rights, where the permission inheritance request is a request triggered by any data table in the database after being reconstructed or deleted;

a parsing module, configured to parse the permission inheritance request, and obtain table information of the reconstructed or deleted data table;

a querying module, configured to query, according to the table information of the reconstructed or deleted data table, the user right corresponding to the reconstructed or deleted data table;

And an empowering module, configured to re-grant the user rights to the reconstructed or deleted data table in the database.
The apparatus according to claim 7, wherein the permission inheritance request includes a DDL event, wherein the parsing module comprises: a parsing unit, configured to parse the DDL event, to obtain the quilt in the database Reconstruct or delete table information for the data table.
The apparatus according to claim 8, wherein the query module comprises:

a determining unit, configured to determine, according to the table information of the reconstructed or deleted data table, whether the data table is a data table that the user has previously applied for;

a query unit, configured to: if the data table that is reconstructed or deleted is a data table that the user has applied for before, query, from a local relational database, a historical user right that is previously set by the user for the data table;

An evaluation unit, configured to assign, to the reconstructed or deleted data table, historical user rights previously set by the user for the data table, to obtain the user re-weighted for the reconstructed or deleted data table Permissions.
The device according to claim 9, wherein the device further comprises:

a storage module, configured to generate and store a table information set of a data table applied by the user if any data table in the database has been saved by the user and the application is successful;

Wherein, if the table information of the reconstructed or deleted data table is successfully matched in the table information set of the data table that has been previously applied by the user, it is determined that the reconstructed or deleted data table is the The data sheet that the user has previously applied for.
The apparatus according to claim 7, wherein the weighting module comprises:

a packaging unit, configured to encapsulate the table information of the reconstructed or deleted data table and the obtained user rights corresponding to the reconstructed or deleted data table, to obtain a permission reset statement that allows the database to be recognized ;

And an authorizing unit, configured to return the rights reset statement to a server where the database is located, so that the user rights are re-granted to the reconstructed or deleted data table in the database.
The device according to any one of claims 7-11, wherein the device further comprises:

The triggering module is configured to trigger the system to automatically generate the permission inheritance request after any one of the data tables in the database is reconstructed or deleted.
A database access authority processing system, comprising:

a database server, configured to save a database, and after any data table in the database is reconstructed or deleted, triggering a permission inheritance request for automatically inheriting access rights;

a permission processing system, configured to receive and parse the permission inheritance request, obtain table information of the reconstructed or deleted data table, and obtain the reconstructed or deleted according to the table information query according to the reconstructed or deleted data table After the user rights corresponding to the data table, the user rights are re-granted to the reconstructed or deleted data table in the database.