CN112016116A - Data management and access method, device, electronic equipment and readable storage medium - Google Patents

Abstract

Embodiments of the present disclosure disclose a data management and access method, apparatus, electronic device, and readable storage medium. The data management method includes establishing a tag corresponding to a preset object in the data, and setting up a tag that is allowed to use the tag. The user performs authorization, and when a data access request using the tag is received from an authorized authorized user, the content of the preset object corresponding to the tag is provided to the authorized user. The technical solution can establish tags corresponding to preset objects, and authorize users based on the tags, refine the granularity level of data management, and improve the security and flexibility of data management.

Description

Data management and access method, apparatus, electronic device and readable storage medium

technical field

The present disclosure relates to the field of computer technologies, and in particular, to a data management and access method, apparatus, electronic device, and readable storage medium.

Background technique

In the current big data environment, the amount of data is growing rapidly, and users' demand for data access is also increasing. On the one hand, data sharing is conducive to improving data utilization and avoiding duplication of work. For example, data sharing between researchers is conducive to promoting the development of disciplines, data sharing between enterprises is conducive to the progress of the industry, and data sharing between cross-fields Sharing is conducive to breakthroughs in various fields. On the other hand, data is often closely related to personal privacy, industry secrets and even national security, and the leakage of these data usually seriously affects social stability, which poses great challenges to the management and use of data. challenge.

SUMMARY OF THE INVENTION

In order to solve the problems in the related art, the embodiments of the present disclosure provide a data management and access method, an apparatus, an electronic device, and a readable storage medium.

In a first aspect, an embodiment of the present disclosure provides a data management method.

Specifically, the data management method includes:

Create labels corresponding to preset objects in the data;

Authorize users who are allowed to use the tags;

When a data access request using the tag is received from an authorized authorized user, the authorized user is provided with the content of the preset object corresponding to the tag.

With reference to the first aspect, in a first implementation manner of the first aspect of the present disclosure, the establishing a label corresponding to the preset object includes, according to an instruction of a user who generates the user set of the data, for the Preset objects generate corresponding labels; and/or

The establishing a label corresponding to the preset object includes establishing a corresponding relationship between the preset object and the corresponding label according to an instruction of a user who generated the user set of the data; and/or

The data management method further includes: receiving an application for using the tag from a user; or receiving an application for using the tag from users of other user sets.

With reference to the first implementation manner of the first aspect, in the second implementation manner of the first aspect of the present disclosure, the tag is initially a private tag visible only to the set of users who generate the data, and the data management method further include:

converting the private label to a public label that is visible to the other set of users; or

Converting the private label into a public label, and the disclosure scope of the public label is set to any one or more of the following: a set of all subordinate users of the user set that generated the data, a selected set of users that generated the data The lower-level user set and the user set that generated the data belong to the same upper-level sibling user set.

With reference to the first aspect, in a third implementation manner of the first aspect of the present disclosure, the label corresponds to multiple preset objects, and the multiple preset objects have the same attribute and belong to different data resources;

the application for using the tag contains an indication of a specific data resource among the different data resources and/or the data access request contains an indication of the specific data resource;

The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource .

With reference to the first aspect, in a fourth implementation manner of the first aspect of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

determine the records that the authorized user is allowed to access;

The authorized user is provided with the content of the preset object corresponding to the tag in a record that the authorized user is allowed to access.

With reference to the first aspect, in a fifth implementation manner of the first aspect of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

If the label is a sensitive label, determine the corresponding desensitization rule;

Process the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitization data;

The first desensitized data is provided to the authorized user.

With reference to the first aspect, in a sixth implementation manner of the first aspect of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

determine the records that the authorized user is allowed to access;

If the label is a sensitive label, determine the corresponding desensitization rule;

Process the content of the preset object corresponding to the label in the record allowing the authorized user to access according to the desensitization rule, to obtain second desensitization data;

The second masked data is provided to the authorized user.

With reference to the fourth implementation manner or the sixth implementation manner of the first aspect, in a seventh implementation manner of the first aspect of the present disclosure, the determining of the records that the authorized user is allowed to access includes:

Determine the records that the authorized user is allowed to access based on the attribute value of the authorized user; or

The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

With reference to the fifth implementation manner or the sixth implementation manner of the first aspect, in the eighth implementation manner of the first aspect of the present disclosure, the determining the corresponding desensitization rule includes:

determining the corresponding desensitization rule according to the level of the tag and/or the attribute value of the authorized user; and/or

In the case that the authorized user belongs to the whitelist user set, no desensitization processing is performed.

In conjunction with the first aspect, in a ninth implementation manner of the first aspect, the data includes a physical table; and/or

the content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field. In a second aspect, an embodiment of the present disclosure provides a data access method.

Specifically, the data access method includes:

Display labels corresponding to preset objects in the data;

After the user obtains the authorization to use the tag and becomes an authorized user, sending a data access request for the authorized user to use the tag;

The content of the preset object corresponding to the tag is received.

In conjunction with the second aspect, in a first implementation manner of the second aspect of the present disclosure, the user does not belong to the user set that generated the data.

In conjunction with the second aspect, in a second implementation manner of the second aspect of the present disclosure, the tag corresponds to multiple fields, and the multiple fields have the same attribute and belong to different data resources;

the application for using the tag contains an indication of a specific data resource among the different data resources and/or the data access request contains an indication of the specific data resource;

The receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

With reference to the second aspect, in a third implementation manner of the second aspect of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

the content of the preset object corresponding to the tag in the record allowing the authorized user to access;

first desensitization data obtained by processing the content of the preset object corresponding to the label according to the desensitization rule;

The second desensitization data obtained by processing the content of the preset object corresponding to the tag in the record that is allowed to be accessed by the authorized user according to the desensitization rule.

With reference to the third implementation manner of the second aspect, in a fourth implementation manner of the second aspect of the present disclosure, the record allowing the authorized user to access is determined according to the attribute value of the authorized user, or according to The category of the label and the attribute value of the authorized user are determined;

The desensitization rule is determined according to the level of the tag and/or the attribute value of the authorized user.

In conjunction with the second aspect, in a fifth implementation manner of the second aspect, the data includes a physical table; and/or

the content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

In conjunction with the second aspect, in a sixth implementation manner of the second aspect, the data access method further includes:

A user request to use the tag is sent.

In a third aspect, an embodiment of the present disclosure provides a data management apparatus.

Specifically, the data management device includes:

an establishment module configured to establish a label corresponding to a preset object in the data;

an authorization module configured to authorize users allowed to use the tag;

A providing module is configured to provide the authorized user with the content of the preset object corresponding to the tag when a data access request using the tag is received from an authorized authorized user.

With reference to the third aspect, in a first implementation manner of the third aspect of the present disclosure, the establishing a label corresponding to the preset object includes, according to an instruction of a user who generates the user set of the data, for the Preset objects generate corresponding labels; and/or

The establishing a label corresponding to the preset object includes establishing a corresponding relationship between the preset object and the corresponding label according to an instruction of a user who generated the user set of the data; and/or

The data management apparatus further includes: an application receiving module configured to receive an application for using the tag from a user; or receiving an application for using the tag from a user group of other users.

With reference to the first implementation manner of the third aspect, in the second implementation manner of the third aspect of the present disclosure, the tag is initially a private tag visible only to the set of users who generate the data, and the apparatus further includes a conversion module, configured as:

converting the private label to a public label that is visible to the other set of users; or

Converting the private label into a public label, and the disclosure scope of the public label is set to any one or more of the following: a set of all subordinate users of the user set that generated the data, a selected set of users that generated the data The lower-level user set and the user set that generated the data belong to the same upper-level sibling user set.

With reference to the third aspect, in a third implementation manner of the third aspect of the present disclosure, the tags correspond to multiple preset objects, and the multiple preset objects have the same attribute and belong to different data resources;

the application for using the tag contains an indication of a specific data resource among the different data resources and/or the data access request contains an indication of the specific data resource;

The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource .

With reference to the third aspect, in a fourth implementation manner of the third aspect of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

determine the records that the authorized user is allowed to access;

The authorized user is provided with the content of the preset object corresponding to the tag in a record that the authorized user is allowed to access.

With reference to the third aspect, in a fifth implementation manner of the third aspect of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

If the label is a sensitive label, determine the corresponding desensitization rule;

Process the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitization data;

The first desensitized data is provided to the authorized user.

With reference to the third aspect, in a sixth implementation manner of the third aspect of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

determine the records that the authorized user is allowed to access;

If the label is a sensitive label, determine the corresponding desensitization rule;

Process the content of the field corresponding to the label in the record that the authorized user is allowed to access according to the desensitization rule, to obtain second desensitization data;

The second masked data is provided to the authorized user.

With reference to the fourth implementation manner or the sixth implementation manner of the third aspect, in a seventh implementation manner of the third aspect of the present disclosure, the determining of the records that the authorized user is allowed to access includes:

Determine the records that the authorized user is allowed to access based on the attribute value of the authorized user; or

The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

With reference to the fifth implementation manner or the sixth implementation manner of the third aspect, in the eighth implementation manner of the third aspect of the present disclosure, the determining the corresponding desensitization rule includes:

determining the corresponding desensitization rule according to the level of the tag and/or the attribute value of the authorized user; and/or

In the case that the authorized user belongs to the whitelist user set, no desensitization processing is performed.

In conjunction with the third aspect, in a ninth implementation manner of the third aspect, the data includes a physical table; and/or

the content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

In a fourth aspect, an embodiment of the present disclosure provides a data access device.

Specifically, the data access device includes:

a display module, configured to display labels corresponding to preset objects in the data;

a first sending module, configured to send a data access request for using the label by the authorized user after the user obtains the authorization to use the label and becomes an authorized user;

The receiving module is configured to receive the content of the preset object corresponding to the tag.

With reference to the fourth aspect, in a first implementation manner of the fourth aspect of the present disclosure, the user does not belong to the user set that generated the data.

With reference to the fourth aspect, in a second implementation manner of the fourth aspect of the present disclosure, the tags correspond to multiple preset objects, and the multiple preset objects have the same attribute and belong to different data resources;

the application for using the tag contains an indication of a specific data resource among the different data resources and/or the data access request contains an indication of the specific data resource;

The receiving the content of the preset object corresponding to the tag includes receiving the content of the field corresponding to the tag in the specific data resource.

With reference to the fourth aspect, in a third implementation manner of the fourth aspect of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

the content of the preset object corresponding to the tag in the record allowing the authorized user to access;

first desensitization data obtained by processing the content of the preset object corresponding to the label according to the desensitization rule;

The second desensitization data obtained by processing the content of the preset object corresponding to the tag in the record that is allowed to be accessed by the authorized user according to the desensitization rule.

With reference to the third implementation manner of the fourth aspect, in the fourth implementation manner of the present disclosure, the record allowing the authorized user to access is determined according to the attribute value of the authorized user, or according to The category of the label and the attribute value of the authorized user are determined;

The desensitization rule of the authorized user is determined according to the level of the tag and/or the attribute value of the authorized user.

In conjunction with the fourth aspect, in a fifth implementation manner of the fourth aspect, the data includes a physical table; and/or

the content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

In conjunction with the fourth aspect, in a sixth implementation manner of the fourth aspect, the data access device further includes:

The second sending module is configured to send the user's application for using the tag.

In a fifth aspect, embodiments of the present disclosure provide an electronic device, including a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are processed by the The controller executes to implement the following method steps:

Create labels corresponding to preset objects in the data;

Authorize users who are allowed to use the tags;

When a data access request using the tag is received from an authorized authorized user, the authorized user is provided with the content of the preset object corresponding to the tag.

With reference to the fifth aspect, in a first implementation manner of the fifth aspect of the present disclosure, the establishing a label corresponding to the preset object includes, according to an instruction of a user who generates the data set of users, for the Preset objects generate corresponding labels; and/or

The establishing a label corresponding to the preset object includes establishing a corresponding relationship between the preset object and the corresponding label according to an instruction of a user who generated the user set of the data; and/or

The one or more computer instructions are also executed by the processor to implement the method steps of: receiving a user application to use the tag; or receiving an application to use the tag from a user of another set of users.

With reference to the first implementation manner of the fifth aspect, in the second implementation manner of the fifth aspect of the present disclosure, the tag is initially a private tag visible only to the set of users who generate the data, and the one or more Computer instructions are executed by the processor to implement the following method steps:

converting the private label to a public label that is visible to the other set of users; or

Converting the private label into a public label, and the disclosure scope of the public label is set to any one or more of the following: a set of all subordinate users of the user set that generated the data, a selected set of users that generated the data The lower-level user set and the user set that generated the data belong to the same upper-level sibling user set.

With reference to the fifth aspect, in a third implementation manner of the fifth aspect of the present disclosure, the tags correspond to multiple preset objects, and the multiple preset objects have the same attribute and belong to different data resources;

the application for using the tag contains an indication of a specific data resource among the different data resources and/or the data access request contains an indication of the specific data resource;

The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the preset object content corresponding to the tag in the specific data resource.

With reference to the fifth aspect, in a fourth implementation manner of the fifth aspect, the providing the authorized user with the content of the preset object corresponding to the tag includes:

determine the records that the authorized user is allowed to access;

The authorized user is provided with the content of the preset object corresponding to the tag in a record that the authorized user is allowed to access.

With reference to the fifth aspect, in a fifth implementation manner of the fifth aspect, the providing the authorized user with the content of the preset object corresponding to the tag includes:

If the label is a sensitive label, determine a corresponding desensitization rule, process the content of the preset object corresponding to the label according to the desensitization rule, and obtain first desensitization data;

The first desensitized data is provided to the authorized user.

With reference to the fifth aspect, in a sixth implementation manner of the fifth aspect, the providing the authorized user with the content of the preset object corresponding to the tag includes:

determine the records that the authorized user is allowed to access;

If the label is a sensitive label, determine the corresponding desensitization rule;

Process the content of the preset object corresponding to the label in the record allowing the authorized user to access according to the desensitization rule, to obtain second desensitization data;

The second masked data is provided to the authorized user.

With reference to the fourth implementation manner or the sixth implementation manner of the fifth aspect, in a seventh implementation manner of the fifth aspect of the present disclosure, the determining of the records that the authorized user is allowed to access includes:

Determine the records that the authorized user is allowed to access based on the attribute value of the authorized user; or

The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

With reference to the fifth implementation manner or the sixth implementation manner of the fifth aspect, in the eighth implementation manner of the fifth aspect of the present disclosure, the determining the corresponding desensitization rule includes:

determining the corresponding desensitization rule according to the level of the tag and/or the attribute value of the authorized user; and/or

In the case that the authorized user belongs to the whitelist user set, no desensitization processing is performed.

In conjunction with the fifth aspect, in a ninth implementation manner of the fifth aspect, the data includes a physical table; and/or

the content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

In a sixth aspect, embodiments of the present disclosure provide an electronic device, including a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are processed by the The controller executes to implement the following method steps:

Display labels corresponding to preset objects in the data;

After the user obtains the authorization to use the tag and becomes an authorized user, sending a data access request for the authorized user to use the tag;

The content of the preset object corresponding to the tag is received.

With reference to the sixth aspect, in a first implementation manner of the sixth aspect of the present disclosure, the user does not belong to the user set that generated the data.

With reference to the sixth aspect, in a second implementation manner of the sixth aspect of the present disclosure, the tags correspond to multiple preset objects, and the multiple preset objects have the same attribute and belong to different data resources;

the application for using the tag contains an indication of a specific data resource among the different data resources and/or the data access request contains an indication of the specific data resource;

The receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

With reference to the sixth aspect, in a third implementation manner of the sixth aspect of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

the content of the preset object corresponding to the tag in the record allowing the authorized user to access;

first desensitization data obtained by processing the content of the preset object corresponding to the label according to the desensitization rule;

The second desensitization data obtained by processing the content of the preset object corresponding to the tag in the record that is allowed to be accessed by the authorized user according to the desensitization rule.

With reference to the third implementation manner of the sixth aspect, in a fourth implementation manner of the sixth aspect of the present disclosure, the record allowing the authorized user to access is determined according to the attribute value of the authorized user, or according to The category of the label and the attribute value of the authorized user are determined;

The desensitization rule is determined according to the level of the tag and/or the attribute value of the authorized user.

In conjunction with the sixth aspect, in a fifth implementation manner of the sixth aspect, the data includes a physical table; and/or

the content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

In conjunction with the sixth aspect, in a sixth implementation manner of the sixth aspect, the one or more computer instructions are further executed by the processor to implement the following method steps:

A user request to use the tag is sent.

In a seventh aspect, an embodiment of the present disclosure provides a readable storage medium on which computer instructions are stored, and when the computer instructions are executed by a processor, implement the first aspect, the first implementation manner of the first aspect to the sixth aspect The method described in any one of the nine implementation manners.

In an eighth aspect, an embodiment of the present disclosure provides a readable storage medium on which computer instructions are stored, and when the computer instructions are executed by a processor, implement the second aspect, the first implementation manner of the second aspect to the sixth aspect The method described in any one of the five implementation manners.

The technical solutions provided by the embodiments of the present disclosure may include the following beneficial effects:

According to the technical solutions provided by the embodiments of the present disclosure, a tag corresponding to a preset object can be established, and a user can be authorized based on the tag, so that the user can obtain the authorization at the granularity level of the preset object, and by refining the granularity of data management This level increases the security and flexibility of data management.

It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure.

Description of drawings

Other labels, objects and advantages of the present disclosure will become more apparent from the following detailed description of non-limiting embodiments, taken in conjunction with the accompanying drawings. In the attached image:

1A shows a flowchart of a data management method according to an embodiment of the present disclosure;

FIG. 1B shows an example of data according to an embodiment of the present disclosure;

Figure 2A illustrates the process of creating, publishing and withdrawing tags according to embodiments of the present disclosure;

FIG. 2B shows a flowchart of applying and using a label according to an embodiment of the present disclosure;

2C shows a schematic diagram of sharing preset objects through tags between two user sets G1 and G2 according to an embodiment of the present disclosure;

FIG. 3 shows a schematic diagram of a user interface for applying tags across data resources according to an embodiment of the present disclosure;

4A shows a flowchart of providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure;

4B shows a schematic diagram of further controlling the records that users are allowed to access on the basis of implementing preset object access control through tags according to an embodiment of the present disclosure;

5A shows a flowchart of providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure;

5B-5D show schematic diagrams of desensitizing the content of preset objects using pseudonymization, masking, and hashing, respectively;

6 shows a schematic flowchart of setting a desensitization rule according to an embodiment of the present disclosure;

7 shows a flowchart of providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure;

8 shows a flowchart of a data access method according to an embodiment of the present disclosure;

9 shows a structural block diagram of a data management apparatus according to an embodiment of the present disclosure;

FIG. 10 shows a structural block diagram of a data access apparatus according to an embodiment of the present disclosure;

11 shows a structural block diagram of an electronic device according to an embodiment of the present disclosure;

FIG. 12 shows a schematic structural diagram of a computer system suitable for implementing the data management method and/or the data access method according to an embodiment of the present disclosure.

Detailed ways

Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. Also, for the sake of clarity, parts unrelated to describing the exemplary embodiments are omitted from the drawings.

In the present disclosure, it should be understood that terms such as "comprising" or "having" are intended to indicate the presence of features, numbers, steps, acts, components, parts, or combinations thereof disclosed in this specification, and are not intended to exclude a or multiple other features, numbers, steps, acts, components, parts, or combinations thereof may exist or be added.

In addition, it should be noted that the embodiments of the present disclosure and the features of the embodiments may be combined with each other under the condition of no conflict. The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

An embodiment of the present disclosure provides a data management method, the data management method includes establishing a label corresponding to a preset object in the data, authorizing a user who is allowed to use the label, and receiving an authorization from the authorized authorized user. When a data access request using the tag is made, the authorized user is provided with the content of the preset object corresponding to the tag.

The embodiments of the present disclosure can authorize users based on tags corresponding to preset objects, realize data management of preset object granularity, facilitate users to access preset objects they need, and prohibit users from accessing unauthorized preset objects. Set objects, thereby improving the security and flexibility of data management.

FIG. 1A shows a flowchart of a data management method according to an embodiment of the present disclosure.

As shown in FIG. 1A, the data management method includes the following steps S101-S103.

In step S101, a label corresponding to a preset object in the data is established.

In step S102, the user who is allowed to use the tag is authorized.

In step S103, when a data access request using the tag is received from an authorized authorized user, the content of the preset object corresponding to the tag is provided to the authorized user.

According to an embodiment of the present disclosure, the data includes physical tables. According to an embodiment of the present disclosure, the content of the preset object is a proper subset of the content of the physical table.

According to an embodiment of the present disclosure, the fact that the content of the preset object is a proper subset of the content of the physical table means that the content of the physical table includes all the content of the preset object, but the content of the preset object is not equal to the content of the preset object. Physical table content. For example, assuming that the physical table includes contents of M rows and N columns, and both M and N are positive integers, the contents of the preset object may be contents of m rows and n columns in the physical table, where m is not greater than M Any positive integer of , n takes any integer not greater than N, but the content of the preset object cannot be the entire content of the physical table, that is, m=M and n=N cannot be established at the same time.

According to the embodiment of the present disclosure, the preset object is a field, wherein the field is column data. Next, the present disclosure will be further explained and illustrated by taking the preset object as a field as an example.

FIG. 1B shows an example of data according to an embodiment of the present disclosure.

Those skilled in the art can understand that although FIG. 1B uses a physical table with three rows and four columns as an example to describe data, the embodiment of the present disclosure is not limited to this, but can also be applied to physical tables with other rows and columns. Or have other data including preset objects.

As shown in FIG. 1B , the data (eg, the physical table Data_s1 ) includes records R1-R3 and fields C1-C4. According to an embodiment of the present disclosure, four labels c1, c2, c3, and c4 corresponding to fields C1-C4 may be established, wherein label c1 corresponds to field C1, label c2 corresponds to field C2, and label c3 corresponds to field C3, Label c4 corresponds to field C4. According to an embodiment of the present disclosure, corresponding tags may also be established only for some fields instead of all four fields.

A user who is allowed to use any one or more of the tags c1-c4 can be authorized, for example, a user who is allowed to use the tag c1 can be authorized so that the user becomes an authorized user of the tag c1. After being authorized to use the label c1 to become an authorized user, the authorized user can use the label c1 to access the content of the field C1 of the data, as shown by the shaded part in FIG. 1B . For example, the data access request may include information related to the tag c1, and according to the information, the field corresponding to the tag c1 may be accessed. According to an embodiment of the present disclosure, the information related to the tag c1 is, for example, any one or a combination of the following: data resource name or storage location, field name or storage location, link to data resource and/or field, etc. , which is not specifically limited in the present disclosure. According to an embodiment of the present disclosure, the establishing a label corresponding to the preset object includes generating a corresponding label for the preset object according to an instruction of a user who generates the user set of the data.

According to an embodiment of the present disclosure, the physical table Data_s1 may be generated by the user set G1, correspondingly, the user set G1 has the management authority of the physical table Data_s1, and the users in the user set G1 can respectively generate the fields C1- One or more tags corresponding to any one or more fields in C4.

According to an embodiment of the present disclosure, the establishing the label corresponding to the preset object includes establishing a corresponding relationship between the preset object and the corresponding label according to an instruction of a user who generates the user set of the data.

According to an embodiment of the present disclosure, the label may be newly generated for the preset object, or it may be an existing one, and by establishing a corresponding relationship, the preset object is made to correspond to the label. For example, after the user set G1 generates the physical table Data_s1, a new label c1 may be generated for the field C1, or a corresponding relationship between the existing label c1 and the field C1 may be established, so that the label c1 corresponds to the field C1.

According to an embodiment of the present disclosure, the data management method further includes: receiving an application for using the tag from a user, or receiving an application for using the tag from users of other user sets.

According to an embodiment of the present disclosure, a user may apply for using any one or more of the tags c1-c4, for example, apply for using the tag c1. Figure 2A illustrates the process of creating, publishing, and withdrawing tags in accordance with an embodiment of the present disclosure.

According to an embodiment of the present disclosure, the label is initially a private label visible only to a set of users who generate the data, and the data management method further includes converting the private label into a public label, the public label being Other user collections are visible. For example, the user U1 in the user set G1 establishes tags for preset objects in the data. This tag is initially a private tag visible only to the set of users G1 that generated the data. The user U1 applies to the administrator of the user set G1 to disclose the private label. After the public application is approved by the administrator, the private label is converted to a public label and thus visible to other user collections. Alternatively, according to an embodiment of the present disclosure, the disclosure scope of the public label may not be visible to all other user sets, but may be set to any one or more of the following: all lower-level user sets of the user set that generated the data , a selected subordinate user set of the user set that generates the data, and a brother user set that belongs to the same superior as the user set that generated the data.

According to an embodiment of the present disclosure, when the user U1 no longer wants to disclose the public label, the user U1 applies to the administrator of the user set G1 to withdraw the public label. After the withdrawal application is approved by the administrator, the public label is converted into a private label, so that it is invisible to other user sets, and other user sets can no longer use the label to access the corresponding preset object.

According to an embodiment of the present disclosure, if a tag is established by the administrator of the user set G1, the administrator can decide whether to publish the tag, omitting the above-mentioned processes of application disclosure, approval disclosure, application withdrawal, and approval withdrawal.

According to an embodiment of the present disclosure, the receiving an application for using the tag from the user includes receiving an application for using the tag from a user in a user set different from the user set G1, for example, from other users who can see the tag. A user of the user set receives an application for using the tag, and a user of the user set who cannot see the tag cannot apply for using the tag. For example, users in another user set G2 different from the user set G1 can apply for using the tags established by the user set G1.

FIG. 2B shows a flowchart of applying and using tags according to an embodiment of the present disclosure.

As shown in FIG. 2B , user U2 in the user set G2 selects a tag in the public tag library, then applies for the selected tag, generates an application form/approval form and records it in the personal center of user U2. If the application for use is approved, the user U2 obtains the authorization to use the tag, and then can use the tag to access the content of the corresponding preset object. If the application for use is not approved, "application failed" is recorded in the personal center, and the user U2 cannot use this tag to access the content of the corresponding preset object. According to the embodiment of the present disclosure, after user U2 obtains the authorization to use the tag, other members of the user set G2 also obtain the authorization to use the tag and receive the notification of tag authorization, realizing one-person application and whole-group authorization, which simplifies user operations.

FIG. 2C shows a schematic diagram of sharing preset objects through tags between two user sets G1 and G2 according to an embodiment of the present disclosure.

As shown in FIG. 2C , the user set G1 establishes a label corresponding to a preset object of data generated by itself, and the label is initially a private label visible only to users in the user set G1 . After approval by the administrator of the user set G1, the private label is converted to a public label and is visible to other user sets. Users of the user set G2 can apply for the use of the public label, and after obtaining authorization, the label can be added to the authorized label library of the user set G2, and the user set G2 can use the label to access corresponding preset objects.

On the other hand, the user set G2 establishes tags corresponding to preset objects of its own generated data, which are initially private tags only visible to the users in the user set G2. After approval by the administrator of user set G2, private labels are converted to public labels and are visible to other user sets. Users of the user set G1 can apply for the use of the public label, and after obtaining authorization, the label can be added to the authorized label library of the user set G1, and the user set G1 can use the label to access corresponding preset objects.

According to an embodiment of the present disclosure, one of the tags may correspond to multiple preset objects, and the multiple preset objects have the same attribute and belong to different data resources, for example, belong to different physical tables, and the physical tables may be the same Different physical tables of different data resource types may also be different physical tables of different data resource types. According to an embodiment of the present disclosure, the data resource may be any resource type, for example, a big data computing service (MaxCompute), a relational database service (Relational Database Service, RDS), an analytical database service (AnalyticDatabase Service, ADS) ), etc., which are not specifically limited in the present disclosure. For example, label c1 may correspond to field C1 in physical table Data_s1, field C1' in physical table Data_s2, field C1" in physical table Data_s3, and field C1, field C1', field C1" have the same attributes, for example, have the same physical or logical meaning. For example, field C1, field C1', field C1" are all "height", or all are "belonging to the community".

According to an embodiment of the present disclosure, the application for using the tag includes an indication of a specific data resource among the different data resources and/or the data access request includes an indication of the specific data resource, the Providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource. For example, the user U2 in the user set G2 can designate any one or more data resources when applying for a tag, or apply for authorization of all data resources for the tag, so as to implement tag use authorization across data resources. In this way, users do not need to apply for authorization repeatedly for data with the same attributes but stored in different data resources, which simplifies user operations and improves the flexibility and convenience of data management and access. Correspondingly, the user U2 can indicate the data resource to be accessed when using the tag to access the content of the preset object. If the user U2 only applies for the label use authorization of one data resource, when using the label to access the content of the preset object, it is not necessary to indicate the data resource to be accessed. At this time, the default user U2 accesses the authorized data resource. .

FIG. 3 shows a schematic diagram of a user interface for applying tags across data resources according to an embodiment of the present disclosure.

As shown in FIG. 3, the tag c1 may correspond to the field C1 in the physical table Data_s1, the field C1' in the physical table Data_s2, and the field C1" in the physical table Data_s3. When the user U2 applies for the use of the tag c1, it can Select the data resource to be used.In Figure 3, the user U2 has selected the data resource Data_s1, Data_s2.In this way, after obtaining authorization, the user U2 can use the label c1 to access the corresponding fields C1 and C1' in the digital resources Data_s1 and Data_s2, Instead, the corresponding field C1" in the digital resource Data_s3 cannot be accessed using the tag c1.

After the user U2 obtains the authorization to use the tag c1 to access the digital resources Data_s1 and Data_s2, the data access request may include an indication of the data resources to be accessed, for example, the data access request may indicate to access the corresponding data of the tag c1 in the data resource Data_s1 field.

Alternatively, if the user U2 only applies to use the data resource Data_s1 in the interface shown in FIG. 3 , the user U2 may not indicate access to the data resource Data_s1 in the data access request, and the user U2 wants to access the data resource Data_s1 by default.

According to an embodiment of the present disclosure, data (eg, a physical table) includes at least one record including at least one preset object (eg, a field), wherein the record is row data. For example, with continued reference to FIG. 1B, the physical table Data_s1 includes records R1-R3, each record including fields C1-C4.

FIG. 4A shows a flowchart of providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure.

As shown in FIG. 4A , according to an embodiment of the present disclosure, providing the authorized user with the content of the preset object corresponding to the tag includes steps S201 to S202 .

In step S201, the records that are allowed to be accessed by the authorized user are determined.

In step S202, the authorized user is provided with the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access.

According to the embodiments of the present disclosure, on the basis of implementing the preset object access control through the tag, the control of the records that the user is allowed to access is further realized.

FIG. 4B shows a schematic diagram of further controlling the records that the user is allowed to access on the basis of implementing preset object access control through tags according to an embodiment of the present disclosure.

For example, for the physical table Data_s1 shown in FIG. 1B, user U2 is allowed to access the data of field C1 by being authorized to use tag c1. However, the authority of user U2 can only access records R1 and R2, but cannot access record R3. Therefore, when receiving a data access request from user U2 using tag c1, the content of field C1 corresponding to tag c1 in records R1 and R2 is provided to user U2, as shown by the shaded part in FIG. 4B .

On the basis of implementing preset object access control through tags, and controlling the records that users are allowed to access, the embodiments of the present disclosure realize further refinement of data management, and realize more flexible and targeted data management.

According to an embodiment of the present disclosure, the determining the records that are allowed to be accessed by the authorized user includes determining the records that are allowed to be accessed by the authorized user according to an attribute value of the authorized user.

According to an embodiment of the present disclosure, the attribute value of the authorized user may include any one or more of the following: user set to which he belongs, administrative division, data source identifier, tax authority code, job number, department code, etc. There is no specific limitation.

According to an embodiment of the present disclosure, records to which an authorized user is allowed to access may be determined according to attribute values of an authorized user. For example, if an authorized user is determined to be a user in province A based on the attribute value of the authorized user, the authorized user can view records in province A but cannot view records in other provinces.

According to an embodiment of the present disclosure, the determining the records that are allowed to be accessed by the authorized user includes determining the records that are allowed to be accessed by the authorized user according to the category of the tag and the attribute value of the authorized user.

According to an embodiment of the present disclosure, tags may be classified into multiple categories, and for the same authorized user, access rights of different categories may be different. For example, tags can be classified into "unrestricted tags", "type I restricted tags", and "type II restricted tags" with increasing record access restrictions. If the tag is an unrestricted tag, it allows authorized users to view all records of the preset object corresponding to the tag. If the tag is a Class I restricted tag, users in city a in province A can view all records in province A, but cannot view records in other provinces. If the tag is a Class II restricted tag, users in city a in province A can only view records in city a in province A, but cannot view records in other cities in province A, nor can they view records in other provinces.

According to an embodiment of the present disclosure, for a restricted label, its record access authority can be defined first, such as "allow users in this province and city to view", "allow users in this province to view", "allow users in tax authorities in this province to view", and so on. Then, for the record access rights for that tag, determine the user attribute value used to determine the rights. For example, for the access permission of "allow users in this province and city to view", the user attribute value used to determine the permission is the province and city to which they belong. For the access permission "Allow users in this province to view", the user attribute value used to determine the permission is the province to which it belongs. For the access permission "Allow users from the tax authority of this province to view", the user attribute values used to determine the permission are their province and unit.

According to an embodiment of the present disclosure, the user attribute value used to determine the authority may have a corresponding preset object in the data resource (for example, a physical table) where the tag corresponds to the preset object, or may have a corresponding preset object in the data where the tag corresponds to the preset object There is no corresponding preset object in the resource. When the user attribute value used to determine the authority does not have a corresponding preset object in the data resource where the preset object corresponding to the label is located, the data resource where the preset object corresponding to the label is located needs to be associated with another data resource, wherein the The user attribute value that determines the authority has a corresponding preset object in the other data resource. This associated data resource can then be used to determine which records the user is allowed to access. For example, Table 1 contains preset objects "Enterprise Name", "Tax Information", "Enterprise ID", and Table 2 contains preset objects "Enterprise ID", "Province", if the preset object to be accessed is "Tax Information" ", the user attribute value used to determine the authority is the province to which it belongs, then it is necessary to associate Table 1 with Table 2 through "Enterprise ID", and determine the enterprise ID that the user is allowed to access through the preset object "Belonging to Province" in Table 2, Then use the enterprise number to identify the records in Table 1 that are allowed to be accessed.

When setting record access permissions, you can generate filter conditions by selecting tags in the data resource, or you can generate filter conditions by adding them manually. Filter conditions can include one or more conditions. Using user attribute values and filter criteria, you can determine which records the user is allowed to access. For example, for the access permission "Allow users in this province and city to view", the filter condition includes the province and city to which the record belongs, which can be generated by selecting the labels "belonging province" and "belonging city". When a user in city a, province A, accesses data, the filter condition is used to obtain the records that the user is allowed to access as the records of city a, province A. Or, for the access right of "Allow users of the tax authority of this province to view", you can manually add the filter conditions "province" (this condition can also be added by selecting the label) and "unit", and the users of the tax authority in province A can perform data processing. When accessing, use this filter condition to obtain the records that the user is allowed to access as records in province A.

FIG. 5A shows a flowchart of providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure.

As shown in FIG. 5A , according to an embodiment of the present disclosure, providing the authorized user with the content of the preset object corresponding to the tag includes steps S301 to S303 .

In step S301, when the label belongs to a sensitive label, a corresponding desensitization rule is determined.

In step S302, the content of the preset object corresponding to the label is processed according to the desensitization rule to obtain first desensitization data.

In step S303, the first desensitization data is provided to the authorized user.

According to the embodiment of the present disclosure, if the label belongs to a non-sensitive label, the content of the preset object corresponding to the label is not desensitized; if the label belongs to a sensitive label, the content of the label corresponding to the label is desensitized according to the desensitization rule. The content of the corresponding preset object is desensitized and provided to the user.

According to an embodiment of the present disclosure, the desensitization rules can be set according to actual needs, for example, including pseudonymization, masking, hashing, custom rules, etc., which are not specifically limited in the present disclosure.

5B-5D show schematic diagrams of desensitizing the content of preset objects using pseudonymization, masking, and hashing, respectively.

Assume that the original data of the field C1 of records R1-R3 is the company name "Cat Cat Food Company", "Dog Clothing Company", and "Tutu Toy Company". As shown in FIG. 5B , the contents of the field C1 after pseudonym desensitization may be “Company A”, “Company B” and “Company C” respectively. As shown in FIG. 5C , the contents of the field C1 after masking and desensitization can be "**food company", "**clothing company", and "**stationery company" respectively.

According to an embodiment of the present disclosure, hashing includes processing the content of a preset object corresponding to the tag according to a hash function, and the hash function can map the content of a preset object of arbitrary length into a A short, fixed-length value (hash). Since the hash equation is a one-way cryptosystem, that is, an irreversible mapping from plaintext to ciphertext, there is only an encryption process and no decryption process, so the content of the preset object can be effectively desensitized. As shown in FIG. 5C , the content of the hashed field C1 is three hash values, and the hash values are provided to the user in place of the original data of the field.

According to the embodiments of the present disclosure, by performing desensitization processing on sensitive data, "available and invisible" of sensitive data can be realized, so that sensitive preset objects can be used by more users, applications and scenarios, while ensuring the security of sensitive data. At the same time, the amount of data available to users is significantly increased, and the efficiency of data utilization is improved.

According to an embodiment of the present disclosure, the determining the corresponding desensitization rule includes determining the corresponding desensitization rule according to the level of the tag and/or the attribute value of the authorized user.

According to the embodiment of the present disclosure, the desensitization rule of the authorized user may be determined according to the level of the tag. For example, tags can be divided into multiple levels with different degrees of sensitivity, and the desensitization rules of different levels can be different. For example, if the label is a level 1 label, mask desensitization is performed, if the label is a level 2 label, pseudonym desensitization is performed, and if the label is a level 3 label, hash desensitization is performed.

According to the embodiment of the present disclosure, the desensitization rule of the authorized user can be determined according to the attribute value of the authorized user. For example, desensitization processing may not be performed for users belonging to the whitelist user set, and desensitization processing is performed for other users.

According to the embodiment of the present disclosure, the desensitization rule of the authorized user can be determined according to the tag level and the attribute value of the authorized user. For example, if the tag is a first-level tag, no desensitization processing is performed for advanced users, and masking and desensitization processing is performed for ordinary users. If the tag is a second-level tag, advanced users are masked and desensitized, and ordinary users are hashed. chemical desensitization treatment, etc.

FIG. 6 shows a schematic flowchart of setting a desensitization rule according to an embodiment of the present disclosure.

As shown in FIG. 6 , according to an embodiment of the present disclosure, when setting a desensitization rule, multiple sensitivity levels can be defined, such as level 1, level 2, level 3, and so on. You can also define multiple desensitization rules, such as pseudonym desensitization, mask desensitization, hash desensitization, and so on. For sensitive labels, you can first define them as level 1, level 2, or level 3 sensitive labels, and then you can select the desensitization rule corresponding to the label, such as pseudonym desensitization for level 1 labels, and mask desensitization for level 2 labels. Sensitization, hash desensitization for level 3 labels, etc. A whitelist user set may also be set for the sensitive label, and no desensitization processing is performed on the users in the whitelist user set.

According to an embodiment of the present disclosure, a preset desensitization template may be applied to the label, for example, a mask template may be applied to the label "name", and the preset object content "cat clothing company" may be desensitized as "** clothing company" ". The desensitization rules and methods of the desensitization template are preset and can be used directly, eliminating the trouble of resetting desensitization rules and writing desensitization methods.

According to the embodiments of the present disclosure, by adopting corresponding desensitization rules for tags of different levels, differentiated data encryption for different user sets or users can be realized at the preset object granularity level, which improves the flexibility and security of data management. .

FIG. 7 shows a flowchart of providing a preset object corresponding to a tag to an authorized user according to an embodiment of the present disclosure.

As shown in FIG. 7 , according to an embodiment of the present disclosure, providing the authorized user with the content of the preset object corresponding to the tag includes steps S401 to S404 .

In step S401, determine the record that the authorized user is allowed to access;

In step S402, in the case that the label belongs to a sensitive label, a corresponding desensitization rule is determined;

In step S403, processing the content of the preset object corresponding to the label in the record allowing the authorized user to access according to the desensitization rule, to obtain second desensitization data;

In step S404, the second desensitization data is provided to the authorized user.

Referring to FIG. 4B, it is assumed that the user U2 uses the label c1 to access the field C1, the authority of the user U2 is to allow access to the record R1 and the record R2, and the desensitization rule of the user U2 is pseudonym desensitization, so the pseudonym desensitized record R1 is provided to the user U2. and the content of the field C1 of R2, such as "Company A" and "Company B" shown in FIG. 5B .

According to the embodiments of the present disclosure, on the basis of realizing data access control with preset object granularity through tags, recording access authority and desensitization control are further performed, and the combination of control means is more diverse and flexible, and is suitable for more applications and scenarios. need.

FIG. 8 shows a flowchart of a data access method according to an embodiment of the present disclosure.

As shown in FIG. 8 , the data access method includes steps S501-S503.

In step S501, the label corresponding to the preset object in the data is displayed;

In step S502, after the user obtains the authorization to use the tag and becomes an authorized user, send a data access request for the authorized user to use the tag;

In step S503, the content of the preset object corresponding to the tag is received.

According to an embodiment of the present disclosure, the data includes physical tables.

According to an embodiment of the present disclosure, the content of the preset object is a proper subset of the content of the physical table.

According to an embodiment of the present disclosure, the preset object is a field.

According to an embodiment of the present disclosure, the data access method further includes sending a user's application for using the tag.

According to an embodiment of the present disclosure, the user does not belong to the set of users that generated the data.

Referring to the description of FIG. 2C above, the public label of user set G1 is visible to user U2 of user set G2. User U2 can send an application for using a public label (eg, label c1), and after obtaining authorization, user U2 can send a data access request using label c1, and receive the content of the field corresponding to label c1.

According to an embodiment of the present disclosure, the tags correspond to multiple preset objects, and the multiple preset objects have the same attribute and belong to different data resources.

According to an embodiment of the present disclosure, the application for using the tag includes an indication of a specific data resource among the different data resources and/or the data access request includes an indication of the specific data resource.

Referring to the description of FIG. 3 above, the tag c1 may correspond to the field C1 in the physical table Data_s1, the field C1' in the physical table Data_s2, and the field C1" in the physical table Data_s3, and the user U2 applies for the use of the tag c1 When, can choose the data resource to be used.In Fig. 3, user U2 has selected data resource Data_s1, Data_s2.In this way, after obtaining authorization, user U2 can use label c1 to visit corresponding field C1 and in Data_s2 in digital resource Data_s1 and Data_s2 C1', while the corresponding field C1" in the digital resource Data_s3 cannot be accessed using the label c1.

After the user U2 obtains the authorization to use the tag c1 to access the digital resources Data_s1 and Data_s2, the data access request may include an indication of the data resources to be accessed, for example, the data access request may indicate to access the corresponding data of the tag c1 in the data resource Data_s1 field.

Alternatively, if the user U2 only applies to use the data resource Data_s1 in the interface shown in FIG. 3 , the user U2 may not indicate access to the data resource Data_s1 in the data access request, and the user U2 wants to access the data resource Data_s1 by default.

According to an embodiment of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

According to an embodiment of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

the content of the preset object corresponding to the tag in the record allowing the authorized user to access;

first desensitization data obtained by processing the content of the preset object corresponding to the label according to the desensitization rule;

The second desensitization data obtained by processing the content of the preset object corresponding to the tag in the record that is allowed to be accessed by the authorized user according to the desensitization rule.

According to an embodiment of the present disclosure, the record allowing the authorized user to access is determined according to the attribute value of the authorized user, or is determined according to the category of the tag and the attribute value of the authorized user.

According to an embodiment of the present disclosure, the desensitization rule of the authorized user is determined according to the level of the tag and/or the attribute value of the authorized user.

According to an embodiment of the present disclosure, when an authorized user uses an authorized tag to access data, a record corresponding to the tag in the record allowing the authorized user to access may be provided according to the attribute value of the authorized user, or according to the tag category and the attribute value of the authorized user. content of the corresponding preset object. Accordingly, the authorized user may receive the content of the preset object corresponding to the tag in the record that the authorized user is allowed to access. On the basis of implementing preset object access control through tags, the records that users are allowed to access are controlled, the embodiments of the present disclosure realize further refinement of data management and access, and realize more flexible and targeted data management.

According to an embodiment of the present disclosure, for a sensitive tag, when an authorized user uses an authorized tag to access data, the desensitization rule of the authorized user can be determined according to the level of the tag and/or the attribute value of the authorized user, providing The first desensitization data obtained by processing the content of the preset object corresponding to the label according to the desensitization rule. Correspondingly, the authorized user may receive the first desensitization data obtained by processing the content of the preset object corresponding to the tag according to the desensitization rule. According to the embodiments of the present disclosure, by performing desensitization processing on sensitive data, "available and invisible" of sensitive data can be realized, so that sensitive preset objects can be used by more users, applications and scenarios, while ensuring the security of sensitive data. At the same time, the amount of data available to users is significantly increased, and the efficiency of data utilization is improved. According to the embodiments of the present disclosure, by adopting corresponding desensitization rules for tags of different levels, differentiated data encryption for different user sets or users can be realized at the preset object granularity level, which improves the flexibility and flexibility of data management and access. safety.

According to an embodiment of the present disclosure, when an authorized user uses an authorized tag to access data, it can be determined according to the attribute value of the authorized user, or according to the tag category and the attribute value of the authorized user, in the records that are allowed to access the authorized user and the tag is determined. The content of the corresponding preset object, and for a sensitive tag, the desensitization rule of the authorized user may be determined according to the level of the tag and/or the attribute value of the authorized user. Then, second desensitization data obtained by processing the content of the preset object corresponding to the tag in the record that is allowed to be accessed by the authorized user according to the desensitization rule may be provided. According to the embodiments of the present disclosure, on the basis of realizing data access control with preset object granularity through tags, recording access authority and desensitization control are further performed, and the combination of control means is more diverse and flexible, and is suitable for more applications and scenarios. need.

FIG. 9 shows a structural block diagram of a data management apparatus 600 according to an embodiment of the present disclosure. Wherein, the apparatus may be realized by software, hardware or a combination of the two to become part or all of the electronic device.

As shown in FIG. 9 , the data management apparatus 600 includes an establishment module 601 , an authorization module 602 and a provision module 603 .

The establishment module 601 is configured to establish a label corresponding to a preset object in the data;

The authorization module 602 is configured to authorize the user allowed to use the tag;

The providing module 603 is configured to provide the authorized user with the content of the preset object corresponding to the tag when receiving a data access request using the tag from an authorized authorized user. According to an embodiment of the present disclosure, the establishing a label corresponding to the preset object includes generating a corresponding label for the preset object according to an instruction of a user who generates the user set of the data; and/or

The data management apparatus further includes an application receiving module 604, which is configured to receive an application for using the tag from a user; or receive an application for using the tag from a user set of other users.

According to an embodiment of the present disclosure, the tag is initially a private tag visible only to the set of users who generate the data, and the apparatus further includes a conversion module 605 .

The conversion module 605 is configured to: convert the private tag into a public tag, and the public tag is visible to the other user sets; or convert the private tag into a public tag, and the public tag's disclosure scope is set be any one or more of the following: all subordinate user sets of the user set that generated the data, selected subordinate user sets of the user set that generated the data, brothers who belong to the same superior as the user set that generated the data User collection.

According to an embodiment of the present disclosure, the label corresponds to a plurality of preset objects, and the plurality of preset objects have the same attribute and belong to different data resources;

the data access request contains an indication of a particular data resource to be accessed;

The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource .

According to an embodiment of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

determine the records that the authorized user is allowed to access;

The authorized user is provided with the content of the preset object corresponding to the tag in a record that the authorized user is allowed to access.

According to an embodiment of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

If the label is a sensitive label, determine the corresponding desensitization rule;

Process the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitization data;

The first desensitized data is provided to the authorized user.

According to an embodiment of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

determine the records that the authorized user is allowed to access;

If the label is a sensitive label, determine the corresponding desensitization rule;

Process the content of the preset object corresponding to the label in the record allowing the authorized user to access according to the desensitization rule, to obtain second desensitization data;

The second masked data is provided to the authorized user.

According to an embodiment of the present disclosure, the determining the records that the authorized user is allowed to access includes:

Determine the records that the authorized user is allowed to access based on the attribute value of the authorized user; or

The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

According to an embodiment of the present disclosure, determining the corresponding desensitization rule includes:

determining the corresponding desensitization rule according to the level of the tag and/or the attribute value of the authorized user; and/or

In the case that the authorized user belongs to the whitelist user set, no desensitization processing is performed.

According to an embodiment of the present disclosure, the data includes a physical table; and/or

the content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

FIG. 10 shows a structural block diagram of a data access apparatus 700 according to an embodiment of the present disclosure. Wherein, the apparatus may be realized by software, hardware or a combination of the two to become part or all of the electronic device.

As shown in FIG. 10 , the data access apparatus 700 includes a presentation module 701 , a first sending module 702 and a receiving module 703 .

The display module 701 is configured to display tags corresponding to preset objects in the data;

The first sending module 702 is configured to send a data access request for using the tag by the authorized user after the user obtains the authorization to use the tag and becomes an authorized user;

The receiving module 703 is configured to receive the content of the preset object corresponding to the tag.

According to an embodiment of the present disclosure, the user does not belong to the set of users that generated the data.

According to an embodiment of the present disclosure, the label corresponds to a plurality of preset objects, and the plurality of preset objects have the same attribute and belong to different data resources;

the data access request contains an indication of a particular data resource to be accessed;

The receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

According to an embodiment of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

the content of the preset object corresponding to the tag in the record allowing the authorized user to access;

first desensitization data obtained by processing the content of the preset object corresponding to the label according to the desensitization rule;

The second desensitization data obtained by processing the content of the preset object corresponding to the tag in the record that is allowed to be accessed by the authorized user according to the desensitization rule.

According to an embodiment of the present disclosure, the record allowing the authorized user to access is determined according to the attribute value of the authorized user, or is determined according to the category of the tag and the attribute value of the authorized user;

The desensitization rule of the authorized user is determined according to the level of the tag and/or the attribute value of the authorized user.

According to an embodiment of the present disclosure, the data includes a physical table; and/or

the content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

According to an embodiment of the present disclosure, the data access apparatus further includes a second sending module 704, and the second sending module 704 is configured to send a user's application for using the tag.

FIG. 11 shows a structural block diagram of an electronic device 800 according to an embodiment of the present disclosure.

As shown in FIG. 11 , the electronic device 800 includes a memory 801 and a processor 802 . The memory 801 is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor 802 to implement the following method steps:

Create labels corresponding to preset objects in the data;

Authorize users who are allowed to use the tags;

When a data access request using the tag is received from an authorized authorized user, the authorized user is provided with the content of the preset object corresponding to the tag.

According to an embodiment of the present disclosure, the establishing a label corresponding to the preset object includes generating a corresponding label for the preset object according to an instruction of a user who generates the user set of the data; and/or

The establishing a label corresponding to the preset object includes establishing a corresponding relationship between the preset object and the corresponding label according to an instruction of a user who generated the user set of the data; and/or

The one or more computer instructions are also executed by the processor 802 to implement the following method steps:

Receive an application for using the tag from a user; or receive an application for using the tag from a user of another set of users.

According to an embodiment of the present disclosure, the tag is initially a private tag visible only to the set of users that generated the data, and the one or more computer instructions are further executed by the processor 802 to implement the following method steps:

converting the private label to a public label that is visible to the other set of users; or

Converting the private label into a public label, and the disclosure scope of the public label is set to any one or more of the following: a set of all subordinate users of the user set that generated the data, a selected set of users that generated the data The lower-level user set and the user set that generated the data belong to the same upper-level sibling user set.

According to an embodiment of the present disclosure, the label corresponds to a plurality of preset objects, and the plurality of preset objects have the same attribute and belong to different data resources;

the data access request contains an indication of a particular data resource to be accessed;

The providing the authorized user with the content of the preset object corresponding to the tag includes providing the authorized user with the content of the preset object corresponding to the tag in the specific data resource .

According to an embodiment of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

determine the records that the authorized user is allowed to access;

The authorized user is provided with the content of the preset object corresponding to the tag in a record that the authorized user is allowed to access.

According to an embodiment of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

If the label is a sensitive label, determine the corresponding desensitization rule;

Process the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitization data;

The first desensitized data is provided to the authorized user.

According to an embodiment of the present disclosure, the providing the authorized user with the content of the preset object corresponding to the tag includes:

determine the records that the authorized user is allowed to access;

If the label is a sensitive label, determine the corresponding desensitization rule;

Process the content of the preset object corresponding to the label in the record allowing the authorized user to access according to the desensitization rule, to obtain second desensitization data;

The second masked data is provided to the authorized user.

According to an embodiment of the present disclosure, the determining the records that the authorized user is allowed to access includes:

Determine the records that the authorized user is allowed to access based on the attribute value of the authorized user; or

The records that the authorized user is allowed to access are determined according to the category of the tag and the attribute value of the authorized user.

According to an embodiment of the present disclosure, the determining the corresponding desensitization rule includes:

determining the corresponding desensitization rule according to the level of the tag and/or the attribute value of the authorized user; and/or

In the case that the authorized user belongs to the whitelist user set, no desensitization processing is performed.

According to an embodiment of the present disclosure, the data includes a physical table; and/or

the content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

According to an embodiment of the present disclosure, the one or more computer instructions are executed by the processor 802 to implement the following method steps:

Display labels corresponding to preset objects in the data;

After the user obtains the authorization to use the tag and becomes an authorized user, sending a data access request for the authorized user to use the tag;

The content of the preset object corresponding to the tag is received.

According to an embodiment of the present disclosure, the user does not belong to the set of users that generated the data.

According to an embodiment of the present disclosure, the label corresponds to a plurality of preset objects, and the plurality of preset objects have the same attribute and belong to different data resources;

the data access request contains an indication of a particular data resource to be accessed;

The receiving the content of the preset object corresponding to the tag includes receiving the content of the preset object corresponding to the tag in the specific data resource.

According to an embodiment of the present disclosure, the receiving the content of the preset object corresponding to the tag includes receiving any one of the following:

the content of the preset object corresponding to the tag in the record allowing the authorized user to access;

first desensitization data obtained by processing the content of the preset object corresponding to the label according to the desensitization rule;

The second desensitization data obtained by processing the content of the preset object corresponding to the tag in the record that is allowed to be accessed by the authorized user according to the desensitization rule.

According to an embodiment of the present disclosure, the record allowing the authorized user to access is determined according to the attribute value of the authorized user, or is determined according to the category of the tag and the attribute value of the authorized user;

The desensitization rule is determined according to the level of the tag and/or the attribute value of the authorized user.

According to an embodiment of the present disclosure, the data includes a physical table; and/or

the content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

According to an embodiment of the present disclosure, the one or more computer instructions are executed by the processor 802 to implement the following method steps:

A user request to use the tag is sent.

FIG. 12 shows a schematic structural diagram of a computer system 900 suitable for implementing a data management method and/or a data access method according to an embodiment of the present disclosure.

As shown in FIG. 12, a computer system 900 includes a central processing unit (CPU) 901, which can be loaded into a random access memory (RAM) 903 according to a program stored in a read only memory (ROM) 902 or a program from a storage section 909 Instead, various processes in the above-described embodiments are performed. In the RAM 903, various programs and data necessary for the operation of the system 900 are also stored. The CPU 901 , the ROM 902 and the RAM 903 are connected to each other through a bus 904 . An input/output (I/O) interface 905 is also connected to bus 904 .

The following components are connected to the I/O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc. ; and a communication section 909 including a network interface card such as a LAN card, a modem, and the like. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I/O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 910 as needed so that a computer program read therefrom is installed into the storage section 908 as needed.

In particular, according to embodiments of the present disclosure, the methods described above may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a readable medium thereof, the computer program containing program code for performing the data management and/or access methods described above. In such an embodiment, the computer program may be downloaded and installed from the network via the communication portion 909, and/or installed from the removable medium 911.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the diagram or block diagram may represent a module, segment, or portion of code that contains one or more functions for implementing the specified logical function. executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented in dedicated hardware-based systems that perform the specified functions or operations , or can be implemented in a combination of dedicated hardware and computer instructions.

The units or modules involved in the embodiments of the present disclosure may be implemented in a software manner, or may be implemented in a programmable hardware manner. The described units or modules may also be provided in the processor, and the names of these units or modules do not constitute a limitation on the units or modules themselves in certain circumstances.

As another aspect, the present disclosure also provides a readable storage medium. The readable storage medium may be the readable storage medium included in the electronic device or computer system in the above-mentioned embodiments; readable storage medium in the device. The readable storage medium stores one or more programs used by one or more processors to perform the methods described in the present disclosure.

The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Developers in the art should understand that the scope of the invention involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above technical features, and should also cover the above technical features without departing from the inventive concept. Other technical solutions formed by any combination of its equivalent features. For example, a technical solution is formed by replacing the above features with the technical features disclosed in the present disclosure (but not limited to) with similar functions.

Claims (36)

1. A method for managing data, comprising:

establishing a label corresponding to a preset object in the data;

authorizing a user allowed to use the tag;

providing the contents of the preset object corresponding to the tag to an authorized user upon receiving a data access request using the tag from the authorized user.

2. The data management method according to claim 1, wherein:

the establishing of the label corresponding to the preset object comprises generating a corresponding label aiming at the preset object according to the indication of the user generating the user set of the data; and/or

The establishing of the label corresponding to the preset object comprises establishing a corresponding relation between the preset object and the corresponding label according to the indication of the user generating the user set of the data; and/or

The data management method further comprises: receiving a user application for using the label; or receiving an application for using the tag from a user of the other user set.

3. The data management method of claim 2, wherein the tag is initially a private tag that is visible only to a set of users that generated the data, the data management method further comprising:

converting the private label to a public label, the public label being visible to the set of other users; or

Converting the private label into a public label, wherein the public range of the public label is set as any one or more of the following: generating all subordinate user sets of the user set of the data, generating a selected subordinate user set of the data, and generating a sibling user set which belongs to the same upper level as the user set of the data.

4. The data management method according to claim 1, wherein:

the tags correspond to a plurality of preset objects, and the preset objects have the same attribute and belong to different data resources;

the application for using the tag comprises an indication of a particular data resource of the different data resources and/or the data access request comprises an indication of the particular data resource;

the providing the content of the preset object corresponding to the tag to the authorized user comprises providing the content of the preset object corresponding to the tag in the specific data resource to the authorized user.

5. The data management method of claim 1, wherein the providing the content of the preset object corresponding to the tag to the authorized user comprises:

determining a record allowing access by the authorized user;

and providing the content of the preset object corresponding to the label in the record allowing the authorized user to access to the authorized user.

6. The data management method of claim 1, wherein the providing the content of the preset object corresponding to the tag to the authorized user comprises:

under the condition that the label belongs to a sensitive label, determining a corresponding desensitization rule, and processing the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitization data;

providing the first desensitization data to the authorized user.

7. The data management method of claim 1, wherein the providing the content of the preset object corresponding to the tag to the authorized user comprises:

determining a record allowing access by the authorized user;

in the case that the tag belongs to a sensitive tag, determining a corresponding desensitization rule;

processing the content of the preset object corresponding to the label in the record which is allowed to be accessed by the authorized user according to the desensitization rule to obtain second desensitization data;

providing the second desensitization data to the authorized user.

8. The data management method of claim 5 or 7, wherein the determining the record that the authorized user is allowed to access comprises:

determining a record allowing the authorized user to access according to the attribute value of the authorized user; or

And determining a record allowing the authorized user to access according to the category of the label and the attribute value of the authorized user.

9. The data management method of claim 6 or 7, wherein the determining the corresponding desensitization rule comprises:

determining the corresponding desensitization rule according to the grade of the label and/or the attribute value of the authorized user; and/or

And in the case that the authorized user belongs to the white list user set, performing no desensitization treatment.

10. The data management method according to claim 1, wherein:

the data comprises a physical table; and/or

The content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

11. A method of data access, comprising:

displaying a label corresponding to a preset object in the data;

after a user obtains authorization to use the tag and becomes an authorized user, sending a data access request of the authorized user for using the tag;

and receiving the content of the preset object corresponding to the label.

12. The data access method of claim 11, wherein the user does not belong to a set of users that generated the data.

13. The data access method of claim 11, wherein:

the tags correspond to a plurality of preset objects, and the preset objects have the same attribute and belong to different data resources;

the application for using the tag comprises an indication of a particular data resource of the different data resources and/or the data access request comprises an indication of the particular data resource;

the receiving the content of the preset object corresponding to the tag comprises receiving the content of the preset object corresponding to the tag in the specific data resource.

14. The data access method of claim 11, wherein the receiving the content of the preset object corresponding to the tag comprises receiving any one of:

allowing the content of the preset object corresponding to the label in the record accessed by the authorized user;

processing the content of the preset object corresponding to the label according to a desensitization rule to obtain first desensitization data;

and processing second desensitization data obtained by allowing the content of the preset object corresponding to the label in the record accessed by the authorized user according to desensitization rules.

15. The data access method of claim 14, wherein:

the record allowing the authorized user to access is determined according to the attribute value of the authorized user or the category of the tag and the attribute value of the authorized user;

the desensitization rule is determined based on the rating of the tag and/or the attribute value of the authorized user.

16. The data access method of claim 11, wherein:

the data comprises a physical table; and/or

The content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

17. The data access method of claim 11, further comprising:

and sending a user application for using the label.

18. A data management apparatus, comprising:

the establishing module is configured to establish a label corresponding to a preset object in the data;

an authorization module configured to authorize a user allowed to use the tag;

a providing module configured to provide the content of the preset object corresponding to the tag to an authorized user when a data access request using the tag is received from the authorized user who obtains authorization.

19. The data management device of claim 18, wherein:

the establishing of the label corresponding to the preset object comprises generating a corresponding label aiming at the preset object according to the indication of the user generating the user set of the data; and/or

The establishing of the label corresponding to the preset object comprises establishing a corresponding relation between the preset object and the corresponding label according to the indication of the user generating the user set of the data; and/or

The data management apparatus further includes: a receiving application module configured to receive a user application for using the tag; or receiving an application for using the tag from a user of the other user set.

20. The data management apparatus of claim 19, wherein the tag is initially a private tag that is visible only to a set of users that generated the data, the apparatus further comprising a conversion module configured to:

converting the private label to a public label, the public label being visible to the set of other users; or

Converting the private label into a public label, wherein the public range of the public label is set as any one or more of the following: generating all subordinate user sets of the user set of the data, generating a selected subordinate user set of the data, and generating a sibling user set which belongs to the same upper level as the user set of the data.

21. The data management device of claim 18, wherein:

the tags correspond to a plurality of preset objects, and the preset objects have the same attribute and belong to different data resources;

the application for using the tag comprises an indication of a particular data resource of the different data resources and/or the data access request comprises an indication of the particular data resource;

the providing the content of the preset object corresponding to the tag to the authorized user comprises providing the content of the preset object corresponding to the tag in the specific data resource to the authorized user.

22. The data management device of claim 18, wherein the providing the content of the preset object corresponding to the tag to the authorized user comprises:

determining a record allowing access by the authorized user;

and providing the content of the preset object corresponding to the label in the record allowing the authorized user to access to the authorized user.

23. The data management device of claim 18, wherein the providing the content of the preset object corresponding to the tag to the authorized user comprises:

in the case that the tag belongs to a sensitive tag, determining a corresponding desensitization rule;

processing the content of the preset object corresponding to the label according to the desensitization rule to obtain first desensitization data;

providing the first desensitization data to the authorized user.

24. The data management device of claim 18, wherein the providing the content of the preset object corresponding to the tag to the authorized user comprises:

determining a record allowing access by the authorized user;

in the case that the tag belongs to a sensitive tag, determining a corresponding desensitization rule;

processing the content of the preset object corresponding to the label in the record which is allowed to be accessed by the authorized user according to the desensitization rule to obtain second desensitization data;

providing the second desensitization data to the authorized user.

25. The data management device of claim 22 or 24, wherein the determining the record that the authorized user is allowed to access comprises:

determining a record allowing the authorized user to access according to the attribute value of the authorized user; or

And determining a record allowing the authorized user to access according to the category of the label and the attribute value of the authorized user.

26. The data management device of claim 23 or 24, wherein the determining the corresponding desensitization rule comprises:

determining the corresponding desensitization rule according to the grade of the label and/or the attribute value of the authorized user; and/or

And in the case that the authorized user belongs to the white list user set, performing no desensitization treatment.

27. The data management device of claim 18, wherein:

the data comprises a physical table; and/or

The content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

28. A data access device, comprising:

a presentation module configured to present a tag corresponding to a preset object in data;

a first transmitting module configured to transmit a data access request of an authorized user using the tag after the user obtains authorization to use the tag to become an authorized user;

a receiving module configured to receive the content of the preset object corresponding to the tag.

29. The data access device of claim 28, wherein the user does not belong to a set of users that generated the data.

30. The data access device of claim 28, wherein:

the tags correspond to a plurality of preset objects, and the preset objects have the same attribute and belong to different data resources;

the application for using the tag comprises an indication of a particular data resource of the different data resources and/or the data access request comprises an indication of the particular data resource;

the receiving the content of the preset object corresponding to the tag comprises receiving the content of the preset object corresponding to the tag in the specific data resource.

31. The data access device of claim 28, wherein receiving the content of the preset object corresponding to the tag comprises receiving any one of:

allowing the content of the preset object corresponding to the label in the record accessed by the authorized user;

processing the content of the preset object corresponding to the label according to a desensitization rule to obtain first desensitization data;

and processing second desensitization data obtained by allowing the content of the preset object corresponding to the label in the record accessed by the authorized user according to desensitization rules.

32. The data access device of claim 31, wherein:

the record allowing the authorized user to access is determined according to the attribute value of the authorized user or the category of the tag and the attribute value of the authorized user;

the desensitization rules of the authorized user are determined based on the rating of the tag and/or the attribute values of the authorized user.

33. The data access device of claim 28, wherein;

the data comprises a physical table; and/or

The content of the preset object is a proper subset of the content of the physical table; and/or

The preset object is a field.

34. The data access device of claim 28, further comprising:

a second sending module configured to send a user application for using the tag.

35. An electronic device comprising a memory and a processor; wherein the memory is to store one or more computer instructions, wherein the one or more computer instructions are to be executed by the processor to implement the method steps of any of claims 1-17.

36. A readable storage medium having stored thereon computer instructions, characterized in that the computer instructions, when executed by a processor, carry out the method steps of any of claims 1-17.

Images