[go: up one dir, main page]

WO2018126380A1 - Système de contrôle d'accès à une base de données - Google Patents

Système de contrôle d'accès à une base de données Download PDF

Info

Publication number
WO2018126380A1
WO2018126380A1 PCT/CN2017/070237 CN2017070237W WO2018126380A1 WO 2018126380 A1 WO2018126380 A1 WO 2018126380A1 CN 2017070237 W CN2017070237 W CN 2017070237W WO 2018126380 A1 WO2018126380 A1 WO 2018126380A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
module
information
database
user
Prior art date
Application number
PCT/CN2017/070237
Other languages
English (en)
Chinese (zh)
Inventor
王志全
Original Assignee
深圳市前海中康汇融信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市前海中康汇融信息技术有限公司 filed Critical 深圳市前海中康汇融信息技术有限公司
Priority to PCT/CN2017/070237 priority Critical patent/WO2018126380A1/fr
Publication of WO2018126380A1 publication Critical patent/WO2018126380A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present invention relates to the field of database access control, and in particular to a database access control system based on user rights.
  • Database is an important part of modern computer applications, and it is a tool for people to effectively store, share and process data.
  • the database access technology abstracts the process of communicating with the outside of the database, and simplifies the process of the client accessing the database by providing an access interface.
  • the data in the database may be more confidential. If the user's access to the database is not managed effectively, and the user is allowed to obtain the desired data at will, the security of the database is not guaranteed.
  • the present invention provides a database access control system, including: a transceiver module configured to receive access request information of a user and send access result information to the user, wherein the access request information includes a user's account, password, and a target resource; an access permission module configured to store a plurality of access rights information corresponding to a plurality of users, wherein the plurality of access rights information are stored in the form of a permission list of roles and resource rights; a matching module coupled to the Transceiver module and the access The privilege module is configured to match the access request information in the transceiver module with the access privilege information in the access privilege module, and generate a matching result; the processing module is coupled to the matching module, configured to be configured according to the Matching the result to obtain the target resource in the database, and correspondingly sending the access result information to the transceiver module.
  • a transceiver module configured to receive access request information of a user and send access result information to the user, wherein the access request information includes a user's account, password, and
  • the processing module is configured to: if the matching result indicates that the access request information matches the access right information, acquire the target resource, and send the access that includes the target resource related information correspondingly The result information is sent to the transceiver module.
  • the transceiver module includes: a receiving unit configured to receive the access request information of the user, where the access request information includes an account, a password, and a target resource of the user; and a sending unit configured to The user sends the access result information, wherein the access result information includes information related to the target resource.
  • the database access control system further includes: a server coupled to the access permission module, configured to back up multiple access rights information corresponding to multiple users online.
  • the database access control system further includes: a data storage module coupled to the processing module, configured to include a plurality of database resources of the target resource, the plurality of database resources forming a resource tree.
  • the processing module is configured to: obtain the target resource from the resource tree search according to a domain name or a keyword.
  • the plurality of access rights information includes administrator rights information, and if the matching result indicates that the user is an administrator, the user has access rights to all database resources.
  • the plurality of access rights information includes creator rights information, and if the matching result indicates that the user is a creator, the user has modification and access rights to all database resources.
  • the database access control system of the embodiment of the present invention can efficiently and quickly access target resources in the database, and perform access control according to the user's authority, thereby effectively securing the database.
  • FIG. 1 is a block diagram of a database access control system in accordance with an embodiment of the present invention.
  • FIG. 2 is a block diagram of a database access control system in accordance with another embodiment of the present invention.
  • FIG. 3 is a block diagram of a database access control system in accordance with yet another embodiment of the present invention.
  • the database access control system 100 can include a transceiver module 102, a matching module 104, an access authority module 106, and a processing module 108.
  • the transceiver module 102 can be configured to receive the user's access request information and send the access result information to the user, wherein the access request information includes the user's account, password, and target resources.
  • the transceiver module 102 may include: a receiving unit configured to receive the access request information of the user, where the access request information includes an account, a password, and a target resource of the user; and a sending unit configured to Transmitting the access result information to the user, wherein the access result information includes information related to the target resource.
  • the access rights module 106 can be configured to store a plurality of access rights information corresponding to a plurality of users, wherein the plurality of access rights information is stored in the form of a rights list of roles and resource rights.
  • the plurality of access rights information may include administrator rights information, and if the matching result indicates that the user is an administrator, the user has access rights to all database resources.
  • the plurality of access rights information includes creator rights information, and if the matching result indicates that the user is a creator, the user has modification and access rights to all database resources.
  • the matching module 104 is coupled to the transceiver module 102 and the access rights module 106, and is configurable to access the access request information in the transceiver module 102 and the access rights module 106.
  • the permission information matches and produces a matching result (for example, the match is successful or the match is unsuccessful).
  • the processing module 108 is coupled to the matching module 104, configured to acquire the target resource in the database according to the matching result, and send the access result information to the transceiver module 102 correspondingly.
  • processing module 108 may be configured to: if the matching result indicates that the access request information matches the access right information, acquire the target resource, and correspondingly send the information including the target resource related information
  • the access result information is described to the transceiver module 102.
  • FIG. 2 is a block diagram of a database access control system 200 in accordance with another embodiment of the present invention.
  • the database access control system 200 of FIG. 2 is similar to the database access control system 100 of FIG. 1 except for the user 210 and the server 220. For the sake of simplicity, similar parts are not described here.
  • Server 220 may be coupled to the access rights module 106 and configured to back up multiple access rights information corresponding to a plurality of users (eg, user 210) online.
  • FIG. 3 is a block diagram of a database access control system 300 in accordance with yet another embodiment of the present invention.
  • the database access control system 300 of FIG. 3 is similar to the database access control system 100 of FIG. 1 except for the data storage module 310. For the sake of simplicity, similar parts are not described here.
  • Data storage module 310 can be coupled to the processing module 108, configured to include a plurality of database resources of the target resource, the plurality of database resources forming a resource tree.
  • the processing module 108 can be configured to: obtain the target resource from the resource tree search according to a domain name or a keyword.
  • the database access control system of the embodiment of the present invention can efficiently and quickly access target resources in the database, and perform access control according to the user's authority, thereby effectively securing the database.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Storage Device Security (AREA)

Abstract

L'invention porte sur un système de contrôle d'accès (100) à une base de données, comprenant : un module d'émission-réception (102) configuré pour recevoir des informations de demande d'accès d'un utilisateur et envoyer des informations de résultat d'accès audit utilisateur, les informations de demande d'accès incluant un compte d'utilisateur, un mot de passe et une ressource cible ; un module d'autorisation d'accès (106) configuré pour mémoriser de multiples éléments d'informations d'autorisation d'accès correspondant à de multiples utilisateurs, les multiples éléments d'informations d'autorisation d'accès étant mémorisés sous la forme d'une liste d'autorisations de rôles et d'autorisations de ressources ; un module de rapprochement (104) couplé au module d'émission-réception (102) et au module d'autorisation d'accès (106) et configuré pour rapprocher les informations de demande d'accès dans le module d'émission-réception (102) des éléments d'informations d'autorisation d'accès dans le module d'autorisation d'accès (106) afin de générer un résultat de rapprochement ; et un module de traitement (108) couplé au module de rapprochement (104) et configuré pour acquérir la ressource cible dans la base de données selon le résultat de rapprochement, et envoyer des informations de résultat d'accès correspondantes au module d'émission-réception (102). Le système de contrôle d'accès (100) à une base de données selon la présente invention peut assurer efficacement la sécurité d'accès d'une base de données.
PCT/CN2017/070237 2017-01-05 2017-01-05 Système de contrôle d'accès à une base de données WO2018126380A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/070237 WO2018126380A1 (fr) 2017-01-05 2017-01-05 Système de contrôle d'accès à une base de données

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/070237 WO2018126380A1 (fr) 2017-01-05 2017-01-05 Système de contrôle d'accès à une base de données

Publications (1)

Publication Number Publication Date
WO2018126380A1 true WO2018126380A1 (fr) 2018-07-12

Family

ID=62788908

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/070237 WO2018126380A1 (fr) 2017-01-05 2017-01-05 Système de contrôle d'accès à une base de données

Country Status (1)

Country Link
WO (1) WO2018126380A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111427618A (zh) * 2020-02-18 2020-07-17 国网辽宁省电力有限公司信息通信分公司 一种信息资源双系统融合方法
CN111859328A (zh) * 2020-07-30 2020-10-30 中国民航信息网络股份有限公司 一种权限控制方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101034990A (zh) * 2007-02-14 2007-09-12 华为技术有限公司 权限管理方法及装置
CN101064609A (zh) * 2007-05-25 2007-10-31 上海众恒信息产业有限公司 一种信息系统的访问控制方法及装置
CN101588242A (zh) * 2008-05-19 2009-11-25 北京亿企通信息技术有限公司 一种实现权限管理的方法及系统
US8402514B1 (en) * 2006-11-17 2013-03-19 Network Appliance, Inc. Hierarchy-aware role-based access control
CN104216907A (zh) * 2013-06-02 2014-12-17 上海贝尔股份有限公司 一种用于提供数据库访问控制的方法、装置与系统
CN104484617A (zh) * 2014-12-05 2015-04-01 中国航空工业集团公司第六三一研究所 一种基于多策略融合的数据库访问控制方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8402514B1 (en) * 2006-11-17 2013-03-19 Network Appliance, Inc. Hierarchy-aware role-based access control
CN101034990A (zh) * 2007-02-14 2007-09-12 华为技术有限公司 权限管理方法及装置
CN101064609A (zh) * 2007-05-25 2007-10-31 上海众恒信息产业有限公司 一种信息系统的访问控制方法及装置
CN101588242A (zh) * 2008-05-19 2009-11-25 北京亿企通信息技术有限公司 一种实现权限管理的方法及系统
CN104216907A (zh) * 2013-06-02 2014-12-17 上海贝尔股份有限公司 一种用于提供数据库访问控制的方法、装置与系统
CN104484617A (zh) * 2014-12-05 2015-04-01 中国航空工业集团公司第六三一研究所 一种基于多策略融合的数据库访问控制方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111427618A (zh) * 2020-02-18 2020-07-17 国网辽宁省电力有限公司信息通信分公司 一种信息资源双系统融合方法
CN111859328A (zh) * 2020-07-30 2020-10-30 中国民航信息网络股份有限公司 一种权限控制方法及系统

Similar Documents

Publication Publication Date Title
CN111488598B (zh) 访问控制方法、装置、计算机设备和存储介质
EP2731041B1 (fr) Système informatique permettant de stocker et d'extraire des éléments de données chiffrées, ordinateur client, produit de programme informatique et procédé mis en oeuvre par ordinateur
US11290446B2 (en) Access to data stored in a cloud
US9558366B2 (en) Computer system for storing and retrieval of encrypted data items, client computer, computer program product and computer-implemented method
US20180285591A1 (en) Document redaction with data isolation
US20150271267A1 (en) Content-oriented federated object store
US11658982B2 (en) Efficient authentication in a file system with multiple security groups
US20160028699A1 (en) Encrypted network storage space
CN103095720B (zh) 一种基于会话管理服务器的云存储系统的安全管理方法
US20140189346A1 (en) License server manager
CN108062485A (zh) 一种面向多服务器多用户的模糊关键字搜索方法
US10635828B2 (en) Tokenized links with granular permissions
CN109831435B (zh) 一种数据库操作方法、系统及代理服务器和存储介质
US20170262546A1 (en) Key search token for encrypted data
US10650153B2 (en) Electronic document access validation
US9223949B1 (en) Secure transformable password generation
US9298808B2 (en) Encrypted search acceleration
US11410173B1 (en) Tokenization web services
US9621349B2 (en) Apparatus, method and computer-readable medium for user authentication
WO2018126380A1 (fr) Système de contrôle d'accès à une base de données
WO2018126387A1 (fr) Système de gestion de partage de base de données
WO2018126388A1 (fr) Procédé de gestion de partage de base de données
US9183403B2 (en) Key retrieval
WO2018126381A1 (fr) Procédé de commande d'accès à une base de données
CN111797424A (zh) 处理请求的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17890619

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC , EPO FORM 1205A DATED 06.11.19.

122 Ep: pct application non-entry in european phase

Ref document number: 17890619

Country of ref document: EP

Kind code of ref document: A1