CN108416230B - Data access method based on data isolation model - Google Patents

Abstract

The present invention provides a data access method based on a data isolation model, which uses the data isolation model to distinguish and isolate the scope of business databases organized at different levels, and establishes access roles for corresponding data access rights for different data services, and for different operation tasks Establish the sub-roles of corresponding data access rights, and use the attribution relationship between sub-roles and access roles to construct the data access rights of sub-roles, and implement data business between different levels of organizations in a multi-level organizational hierarchy. While managing different requirements, it not only ensures the data isolation between the business database ranges of different organizations at different levels, but also ensures the security of access authority authorization between the business database ranges of different organizations at different levels, thereby achieving the The combination of design simplification and access control security requirements provides better security guarantees for the execution of operational tasks different from data services.

Description

A Data Access Method Based on Data Isolation Model

technical field

The invention relates to the technical field of big data information security management, in particular to a data access method based on a data isolation model.

Background technique

At present, the deep integration of new generation information technology and manufacturing industry is triggering a new round of industrial transformation. my country's manufacturing industry should focus on intelligent manufacturing based on "Internet + manufacturing", improve the level of comprehensive integration, and follow the development path of ecological civilization. The rapid development of Internet-based information technology has greatly accelerated the informatization process of manufacturing enterprises. Construction waste recycling aims to transform construction waste and other waste resources into renewable resources through targeted and harmless disposal, and further process them into a variety of end products, creating a new circular economic model. The recycling of construction waste involves the entire construction industry chain, supply chain, and value chain, and "Internet +" is also needed to improve the intelligent level of resource regeneration and recycling, which provides an important opportunity and development space for the promotion of construction waste recycling projects. Through the implementation of a group ERP system, from the generation, transportation, disposal, recycling of construction waste to the quality supervision of terminal recycled products, digital management is carried out on the entire industrial chain, and the forecast analysis of the amount of construction waste resources in the region is carried out. Monitoring, to accurately judge and grasp the status of industrial development, implement precise allocation and dynamic management, and improve the comprehensive competitiveness of the entire industrial chain. With the acceleration of the intelligent development of the construction waste resource industry and the development of Internet information technology, the Web-based information management system has become the mainstream of enterprise information management system development, and its information security issues have also become the focus of attention. Management is an important means to ensure the security of information systems. Access control is a defense measure against unauthorized use of system resources. It ensures controlled and legal use of system resources by restricting the behavior and operations of users in the system. It is a key technology to ensure enterprise information security.

The Role-based Access Control (RBAC) model is a security access control method maturely applied in large commercial systems. It completes the granting and canceling of user rights by assigning and canceling roles, and provides role assignment rules. Security managers define various roles as needed and set appropriate access rights, while users are assigned to different roles according to their responsibilities and seniority. Because the authorization method and authorization model maintenance of the RBAC model is convenient and efficient, it becomes an ideal choice for the authority management model in an open environment.

However, the existing role-based access control model (that is, the RBAC model) does not have good applicability to the needs of group companies for data business management. Since group companies often have a multi-level organizational structure, there is not only a relationship between the upper and lower levels of the organization in the organizational structure, but also the emphasis on independence and relevance between different levels of organizations, so different There are also belonging and crossing relationships between business database scopes in hierarchical organizations, but independent and isolated access rights restriction requirements are required, which makes the rights management of the ERP system (Enterprise Resource Planning, Enterprise Resource Planning) complex and dynamic In the existing RBAC model, the control of access rights is static, that is, the access rights of each role in the scope of the business database are statically set. If the existing RBAC model is directly applied to the group Under the company's ERP system, it is easy to cause the roles whose access rights are statically controlled to be difficult to adapt to the access rights requirements of the business databases of different levels of organizations, resulting in rigid access mechanisms or insufficient granularity of permissions (that is, the minimum range of access rights is not enough); and if In order to meet the different needs of different levels of organizations for data business management, a large number of roles need to be constructed under the existing RBAC model, and the data access rights of many roles will overlap, which not only makes the workload of role creation huge , and it is easy to cause errors in role assignment and improper allocation of data access rights due to cross-issues of data access rights among different roles, which is not conducive to effective control of data isolation and access authorization security.

Therefore, how to provide a suitable data access control scheme for the needs of group companies for data business management, and ensure data isolation and access authorization security between business databases of different levels of organization are problems to be solved.

Contents of the invention

Aiming at the above-mentioned deficiencies in the prior art, the purpose of the present invention is to provide a data access method based on a data isolation model to solve the problem of how to meet the requirements of data service management between different hierarchical organizations in a multi-level organizational hierarchy. Issues of data isolation and access authorization security between business databases with different requirements and ensuring different levels of organization.

In order to achieve the above object, the present invention adopts the following system technical scheme:

A data access method based on a data isolation model, comprising:

According to the limitation of the range of business databases of different levels of organization in the organizational hierarchy of data business management, a data isolation model for differentiating and isolating the scope of different business databases is constructed, thereby using the data isolation model to distinguish and isolate the business databases of different levels of organization scope;

According to the restriction requirements of different data services on the data access rights in the business database in data business management, an access role with corresponding data access rights is constructed for each data business; and the data in the business database is also controlled according to different operational tasks in different data businesses. Requirements for restricting access rights: For each access role in each data business that has the right to perform corresponding operation tasks, construct a sub-role that belongs to the access role and has data access rights to perform corresponding operation tasks; and, construct each access role Role permission labels for roles and their subroles;

When accessing data, use the data isolation model to distinguish the scope of the business database accessed by the isolation restriction according to the hierarchical organization to which the access user belongs, and configure the corresponding access user for the access user according to the accessed data business or/and operation tasks The role permission label, and then realize the data access permission control to the accessing user according to the corresponding access role or/and sub-role of the configured role permission label.

In the above data access method based on the data isolation model, as a preferred solution, the organizational hierarchy of the data service management is a tree structure;

At the root node of the organization hierarchy, organize the data access scope corresponding to all data services and the data access scope of all operation tasks; for other hierarchical organizations, select the corresponding hierarchical organization from the data business corresponding to the parent node hierarchical organization of the corresponding hierarchical organization The data access scope of the data services that can be accessed, and determine the data access scope corresponding to different operation tasks in each data service, and then determine the data access scope of different data services corresponding to the corresponding hierarchical organization and the data access scope of each data service. Requirements for restricting the scope of data access for different operational tasks.

In the above data access method based on the data isolation model, as a preferred solution, the data access authority of each access role is the data access authority of the minimum data access scope necessary for the access role to access its corresponding data service.

In the above data access method based on the data isolation model, as a preferred solution, each of the sub-roles has all the data access rights of the access role to which it belongs, and also has at least one access role that the access role to which it belongs does not have. Data access rights.

In the above-mentioned data access method based on the data isolation model, as a preferred solution, during data access, after distinguishing the scope of the business database accessed by the isolation restriction, first, according to the role permission label of the access role corresponding to the accessed data business, for the access user Grant data access rights to the corresponding access roles to control data access rights; if and only when the operation tasks in the data business are being executed and the corresponding operation tasks are activated and executed, the corresponding sub-roles are configured according to the corresponding operation tasks The role permission label of the corresponding sub-role is given to the access user to control the data access permission; when the operation task in the data business is completed, the role permission of the sub-role corresponding to the corresponding operation task is immediately revoked label to revoke the access user's data access permission to the corresponding sub-role, and control the data access permission of the access user with the data access permission of the access role to which the sub-role belongs.

Compared with the prior art, the present invention has the following beneficial effects:

1. The data access method based on the data isolation model of the present invention uses the data isolation model to distinguish and isolate the range of business databases organized at different levels, and establishes corresponding data access roles for different data services, and establishes corresponding data access roles for different operation tasks. The sub-roles of access rights, and use the attribution relationship between sub-roles and access roles to construct the data access rights of sub-roles, and to meet the needs of different levels of organization in the multi-level organizational hierarchy. The difference in data business management At the same time, it not only ensures the data isolation between the business database scopes of different hierarchical organizations, but also avoids building a large number of different access roles with repeated data access rights and avoids building a large number of sub-roles with overlapping data access rights. In this way, it can also ensure the security of access authority authorization between business databases of different levels of organization, thereby achieving both the simplification of access authority design and the security requirements of access authority control.

2. The data access method based on the data isolation model of the present invention can also flexibly allocate and control the data access rights of access roles and sub-roles when performing operation tasks in the data business, so that both system management configuration and operation task execution stages are prevented. Fraudulent behavior occurs due to the expansion of access user rights, which provides better security for the execution of operational tasks different from data services.

Description of drawings

FIG. 1 is a schematic diagram of a data access method based on a data isolation model in the present invention.

Detailed ways

Aiming at the needs of group companies for data business management, because different levels of organizations in its multi-level organizational structure have different requirements for data business management, the present invention provides a data isolation model-based data management system. An access method, the method includes the following steps:

Step A: Construct a data isolation model for differentiating and isolating the scope of different business databases according to the limitations of the scope of business databases of organizations at different levels in the organizational hierarchy of data business management, so as to use the data isolation model to distinguish and isolate organizations at different levels business database scope;

Step B: According to the restriction requirements of different data services on data access rights in the business database in data business management, construct access roles with corresponding data access rights for each data business; Restrictions on data access rights in the database, for each access role in each data business that has the right to perform corresponding operation tasks, construct a sub-role that belongs to the access role and has data access rights to perform corresponding operation tasks; and, Build role permission labels for each access role and its sub-roles;

Step C: During data access, use the data isolation model to distinguish the scope of the business database accessed by the isolation restriction according to the hierarchical organization to which the access user belongs, and configure the access user according to the accessed data business or/and operation tasks The corresponding role permission label, and then according to the corresponding access role or/and sub-role of the configured role permission label, the data access permission control of the accessing user is realized.

In the data access method based on the data isolation model of the present invention, since the data isolation model is used to distinguish and isolate the scope of business databases of different hierarchical organizations, during data access, it is necessary to use the data isolation model to distinguish isolation restrictions according to the hierarchical organization to which the access user belongs The range of business databases accessed, thus ensuring the data isolation between the ranges of business databases organized at different levels. On the premise of ensuring data isolation, for the data business management needs of group companies, the data business management of different levels of organizations often has the same data business, but the scope of business databases corresponding to different levels of organizations is different. Therefore, In the data service management requirements of organizations at different levels, the business database objects accessed by the same data service are different, so that in the data service management of organizations at different levels, the same access role is used for the same data service to perform independent data access control , is feasible; therefore, when establishing access roles, it is not necessary to consider the differences in the scope of business databases at different levels of organization, but only to consider the restriction requirements of different data businesses on data access rights in business databases in data business management , to build access roles with corresponding data access rights for each data business, that is to say, even for the range of business databases organized at different levels, according to the restrictions on data access rights in business databases by different data businesses When accessing roles, if an access role with the data access rights of the corresponding data business already exists, it is not necessary to repeat the construction; in this way, it is avoided to build a large number of different access roles with repeated data access rights for data business management of different levels of organizations. Not only that, in the data access method based on the data isolation model of the present invention, according to the restriction requirements of different operation tasks in different data services on the data access rights in the business database, each data business has the corresponding operation task authority For each access role, a sub-role belonging to the access role with the data access authority to perform the corresponding operation task is constructed; in specific implementation, each sub-role can be designed to have all the data of the access role to which it belongs access rights, and also has at least one data access right that the access role it belongs to does not have. Of course, the data access rights that each sub-role has that the access role it belongs to does not have, it should be the sub-role to perform its own The data access rights necessary for the corresponding operation tasks; in this way, it is easier to distinguish and analyze the distribution of data access rights between different sub-roles for performing different operation tasks in each data business, and because data access rights can be avoided There are a large number of different access roles that are repeated. As a premise, the attribution relationship between sub-roles and access roles is used to construct the data access rights of sub-roles, which largely avoids data services for different levels of organization. Manage the problem of building large amounts of data access permissions with intersecting subroles. Therefore, during data access, after using the data isolation model to distinguish the scope of business databases accessed by the data isolation model according to the hierarchical organization to which the access user belongs, according to the accessed data business or/and operation tasks, configure the corresponding database for the access user. The corresponding role permission label, and then according to the corresponding access role or/and sub-role of the configured role permission label, the data access permission control of the access user is realized, and the data business between different hierarchical organizations in the multi-level organizational hierarchy At the same time, it not only ensures the data isolation between the business database ranges of different hierarchical organizations, but also avoids building a large number of data access rights that overlap different access roles and avoids building a large number of data access rights that have crossed sub- On the premise of role, it can also ensure the security of access authority authorization between business databases of different levels of organization, thus achieving both the simplification of access authority design and the security requirements of access authority control.

In the data access method based on the data isolation model of the present invention, the order of the above steps A and B is not limited and can be interchanged; step C needs to be implemented depending on steps A and B.

For a conglomerate company, there is usually an upper-lower attribution relationship between different organizations in its organizational hierarchy. For such an organizational hierarchy, the organizational hierarchy of its data business management should be designed as a tree structure ; and the organization at the root node level of the organizational hierarchy is often the head office of the group company, so the root node level organization of the organizational hierarchy should correspond to the data access scope of all data services and the data access scope of all operational tasks; while the rest of the Hierarchical organizations, because they have an upper-lower affiliation relationship with their parent node hierarchical organizations, the rest of the hierarchical organizations except the root node hierarchical organization should be designed to select the corresponding hierarchical organization from the data services corresponding to the parent node hierarchical organization of the corresponding hierarchical organization to be able to access The data access range of the data business, and determine the data access range corresponding to the different operation tasks in each data business, and then determine the data access range of different data services corresponding to the corresponding hierarchical organization and the different operations in each data business Requirements for restricting the scope of data access by tasks. This kind of data access scope distinguishes and isolates the design method, which can better meet the data isolation management requirements of group companies for data business management.

In the specific implementation, if in order to provide better security guarantee for task execution in some cases, such as the processing of confidential information, etc., when designing the data access rights of each access role, it can be designed that the access role only It has the data access rights of the minimum data access scope necessary to access its corresponding data business, and the data access rights of other requirements, which can be realized through its attributable sub-roles. On the other hand, in order to improve the data security protection of task execution, during data access, after distinguishing the scope of the business database accessed by isolation and restriction, it is also possible to first base on the role permission label of the access role corresponding to the data business being accessed, for the access user Grant data access rights to the corresponding access roles to control data access rights; if and only when the operation tasks in the data business are being executed and the corresponding operation tasks are activated and executed, the corresponding sub-roles are configured according to the corresponding operation tasks The role permission label of the corresponding sub-role is given to the access user to control the data access permission; when the operation task in the data business is completed, the role permission of the sub-role corresponding to the corresponding operation task is immediately revoked label to revoke the access user's data access permission to the corresponding sub-role, and control the data access permission of the access user with the data access permission of the access role to which the sub-role belongs. In this way, before performing an operation task, even if the access user is qualified to perform the operation task, he cannot obtain the actual data access permission. Only after the operation task is activated, the data access permission of the corresponding sub-role is actually granted to the access user ; After the operation task is completed, the data access rights of the corresponding sub-role will be revoked immediately, so that the access user no longer has the data access rights required to perform the operation task, but only has the access role corresponding to the current data business. The data access authority, that is, the data access authority of the minimum data access scope necessary for the data business, so that the expansion of access user authority and fraudulent behavior are prevented during the system management configuration and operation task execution stages, which is different from the data The execution of operational tasks under business provides better security.

To sum up, the data access method based on the data isolation model of the present invention uses the data isolation model to distinguish and isolate the scope of business databases organized at different levels, and establishes access roles with corresponding data access rights for different data services, and for different operation tasks. Establish the sub-roles of corresponding data access rights, and use the attribution relationship between sub-roles and access roles to construct the data access rights of sub-roles, and implement data business between different levels of organizations in a multi-level organizational hierarchy. At the same time, it not only ensures the data isolation between the business database ranges of different hierarchical organizations, but also avoids building a large number of data access rights that overlap different access roles and avoids building a large number of data access rights that have crossed sub- On the premise of roles, it can also ensure the security of access authority authorization between business databases organized at different levels, thereby achieving both the simplification of access authority design and the security requirements of access authority control; and the present invention is based on the data isolation model The data access method can also flexibly allocate and control the data access rights of access roles and sub-roles when performing operational tasks in the data business, so that the expansion of access user rights and fraud can be prevented during the system management configuration and operation task execution stages Behavior provides a better security guarantee for the execution of operational tasks different from data services.

Finally, it is noted that the above embodiments are only used to illustrate the technical solutions of the present invention without limitation. Although the present invention has been described in detail with reference to the embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or Equivalent replacements without departing from the spirit and scope of the technical solutions of the present invention shall be covered by the scope of the claims of the present invention.

Claims (4)

1. A data access method based on a data isolation model, comprising: According to the limitation of the range of business databases of different levels of organization in the organizational hierarchy of data business management, a data isolation model for differentiating and isolating the scope of different business databases is constructed, thereby using the data isolation model to distinguish and isolate the business databases of different levels of organization scope; According to the restriction requirements of different data services on the data access rights in the business database in data business management, an access role with corresponding data access rights is constructed for each data business; and the data in the business database is also controlled according to different operational tasks in different data businesses. Requirements for restricting access rights: For each access role in each data business that has the right to perform corresponding operation tasks, construct a sub-role that belongs to the access role and has data access rights to perform corresponding operation tasks; and, construct each access role The role permission label of the role and its sub-roles; each sub-role has all the data access rights of the access role to which it belongs, and also has at least one data access permission that the access role to which it belongs does not have; When accessing data, use the data isolation model to distinguish the scope of the business database accessed by the isolation restriction according to the hierarchical organization to which the access user belongs, and configure the corresponding access user for the access user according to the accessed data business or/and operation tasks The role permission label, and then realize the data access permission control to the accessing user according to the corresponding access role or/and sub-role of the configured role permission label. 2. The data access method based on the data isolation model according to claim 1, wherein the organizational hierarchy of the data service management is a tree structure; At the root node of the organization hierarchy, organize the data access scope corresponding to all data services and the data access scope of all operation tasks; for other hierarchical organizations, select the corresponding hierarchical organization from the data business corresponding to the parent node hierarchical organization of the corresponding hierarchical organization The data access scope of the data services that can be accessed, and determine the data access scope corresponding to different operation tasks in each data service, and then determine the data access scope of different data services corresponding to the corresponding hierarchical organization and the data access scope of each data service. Requirements for restricting the scope of data access for different operational tasks. 3. The data access method based on the data isolation model according to claim 1, wherein the data access authority of each access role is the minimum data access necessary for the access role to access its corresponding data service scoped data access permissions. 4. The data access method based on the data isolation model according to claim 1, characterized in that, during data access, after distinguishing the scope of the business database accessed by isolation and restriction, firstly, according to the role of the access role corresponding to the data service to be accessed Permission label, which grants the access user the data access permission of the corresponding access role to control the permission of data access; if and only when the operation task in the data service is being executed and the corresponding operation task is activated, the corresponding operation The role permission label of the sub-role corresponding to the task configuration, grants the access user the data access permission of the corresponding sub-role, and controls the permission of data access; when the operation task in the data business is completed, the corresponding operation task will be withdrawn immediately The role permission label corresponding to the sub-role revokes the data access permission of the access user to the corresponding sub-role, and controls the data access permission of the access user with the data access permission of the access role to which the sub-role belongs.