Method and apparatus for control of data access

1. A method for control of data access, characterized in that the method comprises:

receiving a data query request characterizing that a first user requests target data using a query keyword;

obtaining a business data access capability attribute corresponding to the first user and obtaining a first business security attribute corresponding to the target data and a second business security attribute corresponding to the query keyword,

wherein the business data access capability attribute is used to characterize capability of accessing data in a business environment in the charge of a user based on a business attribute of the user, and

each of the first business security attribute and the second business security attribute is used to characterize an identification attribute for classifying data based on business security requirements, and comprises one or more of a public level, an identifiability level, and a time level of data, and wherein the public level indicates a degree of difficulty in obtaining the data, the identifiability level indicates whether the data can identify a user, a natural person, or an entity, and the time level indicates whether the association between user data and a user will become invalid within a threshold time period;

determining a data query processing policy corresponding to the data query request by invoking a data access security model based on the business data access capability attribute of the first user, the first business security attribute of the target data and the second business security attribute of the query keyword; and

processing the target data by invoking the data query processing policy and generating a response message for feedback.

2. The method of claim 1 , characterized in that processing the target data by invoking the data query processing policy and generating a response message for feedback comprises:

when the data query processing policy corresponding to the data query request is an anonymization policy, performing anonymization processing on data to be protected in the target data, and generating a response message for feedback based on the target data processed with the anonymization processing.

3. The method of claim 1 , characterized in that processing the target data by invoking the data query processing policy and generating a response message for feedback comprises:

generating a response message including the target data for feedback based on the target data when the data query processing policy corresponding to the data query request is a data pass-through policy.

4. The method of claim 1 , characterized in that processing the target data by invoking the data query processing policy and generating a response message for feedback comprises:

generating a response message characterizing that the data query request is not allowed for feedback when the data query processing policy corresponding to the data query request is a data isolation policy.

5. The method of claim 1 , characterized in that

determining the data query processing policy corresponding to the data query request by invoking the data access security model based on the business data access capability attribute of the first user, the first business security attribute of the target data and the second business security attribute of the query keyword comprises:

when the business data access capability attribute of the first user identifies that the first user is of a type of limited data access right, the first business security attribute of the target data identifies that the target data is non-public, and the second business security attribute of the query keyword identifies that the keyword is public, invoking the data access security model to determine that the data query processing policy corresponding to the data query request is a data isolation policy, the data isolation policy being used to prevent the first user from querying the target data.

6. The method of claim 1 , characterized in that processing the target data by invoking the data query processing policy and generating the response message for feedback comprises:

processing the target data by invoking the data query processing policy and generating a response message, and configuring an effective time for specified data in the target data included in the response message and feeding back the response message, the effective time being used to indicate a validity period for use of the specified data in business.

7. The method of claim 1 , wherein each of the first business security attribute and the second business security attribute comprises or indicates one or more of a public level, an identifiability level, and a time level of the data.

8. An electronic device, comprising:

a memory and a processor;

wherein the memory is used to store one or more computer instructions which are executed by the processor to

receive a data query request characterizing that a first user requests target data using a query keyword;

obtain a business data access capability attribute corresponding to the first user and obtaining a first business security attribute corresponding to the target data and a second business security attribute corresponding to the query keyword, wherein the business data access capability attribute is used to characterize capability of accessing data in a business environment in the charge of a user based on a business attribute of the user, and each of the first business security attribute and the second business security attribute is used to characterize an identification attribute for classifying data based on business security requirements, and comprises one or more of a public level, an identifiability level, and a time level of data, and wherein the public level indicates a degree of difficulty in obtaining the data, the identifiability level indicates whether the data can identify a user, a natural person, or an entity, and the time level indicates whether the association between user data and a user will become invalid within a threshold time period;

determine a data query processing policy corresponding to the data query request by invoking a data access security model based on the business data access capability attribute of the first user, the first business security attribute of the target data and the second business security attribute of the query keyword; and

process the target data by invoking the data query processing policy and generating a response message for feedback.

9. A computer program product comprising computer readable storage medium storing one or more computer instructions thereon which are executed by a processor to

receive a data query request characterizing that a first user requests target data using a query keyword;

obtain a business data access capability attribute corresponding to the first user and obtaining a first business security attribute corresponding to the target data and a second business security attribute corresponding to the query keyword, wherein the business data access capability attribute is used to characterize capability of accessing data in a business environment in the charge of a user based on a business attribute of the user, and each of the first business security attribute and the second business security attribute is used to characterize an identification attribute for classifying data based on business security requirements, and comprises one or more of a public level, an identifiability level, and a time level of data, and wherein the public level indicates a degree of difficulty in obtaining the data, the identifiability level indicates whether the data can identify a user, a natural person, or an entity, and the time level indicates whether the association between user data and a user will become invalid within a threshold time period;

determine a data query processing policy corresponding to the data query request by invoking a data access security model based on the business data access capability attribute of the first user, the first business security attribute of the target data and the second business security attribute of the query keyword; and

process the target data by invoking the data query processing policy and generating a response message for feedback.