Business data processing method, device, equipment and medium based on shared authority

Abstract

The present application relates to the field of data security, and in particular to a method, device, equipment and medium for processing business data based on shared permissions. The method comprises: receiving a login request from a user terminal, the login request carrying a user identifier; querying a tenant identifier corresponding to the user identifier, and querying the user permission information of the user corresponding to the user identifier in the tenant corresponding to the tenant identifier, and generating authorization information based on the user permission information; generating session information based on the authorization information, the user permission information and the user identifier, and sending the authorization information to the user terminal; receiving a business request sent by the user terminal, the business request carrying authorization information; querying the stored session information corresponding to the authorization information, and performing permission control on the business request based on the user permission information in the session information, and obtaining response data corresponding to the business request; and returning the response data to the user terminal. The use of this method can ensure data security.

Description

Technical Field

[0001] The present application relates to the field of big data processing technology, and in particular to a business data processing method, device, equipment and medium based on shared permissions. Background Art

[0002] With the continuous improvement of virtualization and cloud computing technologies, SaaS (Software as a Service) is gradually being widely accepted and used. SaaS is a model of providing software through the Internet. Software vendors deploy application software on their own servers. Customers can order the required application software services from vendors through the Internet according to their actual needs, pay the software vendors according to the amount of services ordered and the length of time, and obtain the services provided by the software vendors through the Internet. Users no longer need to purchase software, but instead rent Web-based software from software vendors to manage business activities, and there is no need to maintain the software. Software vendors will fully manage and maintain the software. While providing Internet applications to customers, software vendors also provide offline operation of the software and local data storage, allowing users to use the software and services they ordered anytime and anywhere. For many small businesses, SaaS is the best way to adopt advanced technology. It eliminates the need for enterprises to purchase, build and maintain infrastructure and applications.

[0003] However, for the SaaS model, most of them are based on the traditional RBAC model. The traditional RABC model is a single-layer management model, that is, access control is performed on the platform layer. Platform roles are divided into rule roles and management roles. Rule roles are used to execute the business functions of the platform, and management roles are used to manage the creation of roles and the allocation of permissions in the platform. However, the traditional RBAC model is global in the allocation of resources and role division of the entire platform. It cannot customize access control policies according to tenant needs, nor can it separate the rules and management roles between tenants. As a result, it is impossible to isolate and manage the data of different tenants on the same platform, resulting in the risk of data leakage between different tenants. Summary of the invention

[0004] Based on this, it is necessary to provide a business data processing method, device, equipment and medium based on shared permissions that can ensure data security in response to the above technical problems.

[0005] A business data processing method based on shared permissions, the method comprising:

[0006] Receiving a login request from a user terminal, wherein the login request carries a user identifier;

[0007] Querying the tenant identifier corresponding to the user identifier, and querying the user authority information of the user corresponding to the user identifier in the tenant corresponding to the tenant identifier, and generating authorization information according to the user authority information;

[0008] Generate session information according to the authorization information, the user authority information, and the user identifier, and send the authorization information to the user terminal;

[0009] Receiving a service request sent by a user terminal, wherein the service request carries authorization information;

[0010] Querying the stored session information corresponding to the authorization information, performing authority control on the service request according to the user authority information in the session information, and obtaining response data corresponding to the service request;

[0011] The response data is returned to the user terminal.

[0012] In one embodiment, the generation of the user authority information includes:

[0013] Receiving a user rights configuration request sent by a tenant terminal, and creating a role corresponding to the user rights configuration request and a plurality of user accounts corresponding to the role;

[0014] Acquire tenant authority information corresponding to the tenant terminal, wherein the tenant authority information includes system authority packages of systems corresponding to several products in the platform;

[0015] Parsing the system permission package to obtain multiple initial permission information;

[0016] The corresponding initial permission information is configured for the role to authorize the user account to generate user permission information.

[0017] In one embodiment, the tenant authority information is generated in the following manner:

[0018] Receiving a tenant rights configuration request sent by a tenant terminal, wherein the tenant rights configuration request carries a product identifier and a system identifier;

[0019] Querying multiple systems corresponding to the product identifier, and selecting a target system according to the system identifier;

[0020] Obtaining system permission information corresponding to the target system, selecting target permission information from the system permission information according to the tenant permission configuration request, and packaging the target permission information to obtain a tenant permission package;

[0021] The tenant rights package is configured to the tenant to obtain tenant rights information.

[0022] In one embodiment, the querying of multiple systems corresponding to the product identification includes:

[0023] Querying the tenant domain corresponding to the tenant terminal;

[0024] A plurality of systems corresponding to the product identifier is queried from the tenant domain.

[0025] In one embodiment, querying the stored session information corresponding to the authorization information includes:

[0026] Querying the cache whether there is stored session information corresponding to the authorization information;

[0027] When the stored session information corresponding to the authorization information does not exist in the cache, querying whether the stored session information corresponding to the authorization information exists in the database;

[0028] When there is stored session information corresponding to the authorization information in the database, the session information is read into the cache.

[0029] A business data processing device based on shared permissions, the device comprising:

[0030] A first receiving module, configured to receive a login request from a user terminal, wherein the login request carries a user identifier;

[0031] A first query module is used to query the tenant identifier corresponding to the user identifier, query the user authority information of the user corresponding to the user identifier in the tenant corresponding to the tenant identifier, and generate authorization information according to the user authority information;

[0032] A session information generating module, configured to generate session information according to the authorization information, the user authority information, and the user identifier, and send the authorization information to the user terminal;

[0033] A second receiving module is used to receive a service request sent by a user terminal, wherein the service request carries authorization information;

[0034] A second query module is used to query the stored session information corresponding to the authorization information, and obtain response data corresponding to the service request after performing authority control on the service request according to the user authority information in the session information;

[0035] The sending module is used to return the response data to the user terminal.

[0036] In one embodiment, the device further comprises:

[0037] A third receiving module is used to receive a user authority configuration request sent by a tenant terminal, and create a role corresponding to the user authority configuration request and multiple user accounts corresponding to the role;

[0038] A system permission package acquisition module, used to acquire tenant permission information corresponding to the tenant terminal, wherein the tenant permission information includes system permission packages of systems corresponding to several products in the platform;

[0039] A parsing module, used for parsing the system permission package to obtain a plurality of initial permission information;

[0040] The user authority information generation module is used to configure the corresponding initial authority information for the role so as to authorize the user account and generate user authority information.

[0041] In one embodiment, the device further comprises:

[0042] A fourth receiving module, configured to receive a tenant rights configuration request sent by a tenant terminal, wherein the tenant rights configuration request carries a product identifier and a system identifier;

[0043] A third query module, used to query multiple systems corresponding to the product identifier, and select a target system according to the system identifier;

[0044] A tenant permission package acquisition module is used to acquire system permission information corresponding to a target system, select target permission information from the system permission information according to the tenant permission configuration request, and package the target permission information to obtain a tenant permission package;

[0045] The tenant authority information configuration module is used to configure the tenant authority package to the tenant to obtain tenant authority information.

[0046] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above methods when executing the computer program.

[0047] A computer-readable storage medium stores a computer program, which implements the steps of any one of the above methods when executed by a processor.

[0048] The above-mentioned business data processing method, device, equipment and medium based on shared permissions, after receiving the login request sent by the user terminal, first obtains the tenant identifier corresponding to the user identifier, and then can query the user's permission information in the tenant, and generate authorization information based on the permission information, so that the authorization information, user permission information, and user identifier are generated into session information and saved. When there is a business request, the corresponding permission information in the session information can be directly queried. In this way, permission control is performed on the business request through the permission information, which can ensure that different users can only obtain data within the permission, and will not cause data leakage. Moreover, since the user permission information is queried at the time of login, the user permission information can be directly used in the subsequent business processing without multiple queries, which can also improve the processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is an application scenario diagram of a business data processing method based on shared permissions in an embodiment;

[0050] Figure 2 A schematic diagram of a process flow of a business data processing method based on shared permissions in one embodiment;

[0051] Figure 3 is a diagram showing an example of a seven-layer model in an embodiment;

[0052] Figure 4 A schematic diagram of permission configuration in an embodiment;

[0053] Figure 5 A schematic diagram of personalized tenant function adaptation in one embodiment;

[0054] Figure 6 A schematic diagram of domain management in an embodiment;

[0055] Figure 7 is a timing diagram of a business data processing method based on shared permissions in one embodiment;

[0056] Figure 8 is a structural block diagram of a business data processing device based on shared permissions in an embodiment;

[0057] Fig. 9 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0059] The business data processing method based on shared permissions provided in this application can be applied to Figure 1 In the application environment shown. Among them, the user terminal 102 communicates with the server 104 through the network. The user terminal 102 sends a login request to the server 104, so that the server 104 can query the tenant identifier corresponding to the user identifier, and query the user authority information of the user corresponding to the user identifier in the tenant corresponding to the tenant identifier, and generate authorization information according to the user authority information, generate session information according to the authorization information, the user authority information, and the user identifier, and send the authorization information to the user terminal 102. Therefore, when the user terminal 102 sends a service request to the server 104, the server 104 can query the stored session information corresponding to the authorization information, perform authority control on the service request according to the user authority information in the session information, obtain the response data corresponding to the service request, and send the obtained response data 104 to the user terminal 102. In this way, by controlling the permissions of business requests through permission information, it can be ensured that different users can only obtain data within their permissions, and data leakage will not occur. In addition, since the user permission information is queried at the time of login, the user permission information can be directly used in subsequent business processing without multiple queries, which can also improve the processing efficiency. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones, tablets and portable wearable devices, and the server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0060] In one embodiment, Figure 2 As shown, a business data processing method based on shared permissions is provided, and the method is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0061] S202: Receive a login request from a user terminal, where the login request carries a user identifier.

[0062] Specifically, the login request is generated by the user terminal, which may include user identification, such as account and password, list, map and deep-level parameters. The user terminal concatenates these parameters through the signature string **, and then concatenates them with the fixed parameters in the header. In order to ensure uniqueness, random string + timestamp form parameters are used for concatenation, and finally the dynamic encryption value is added to form a parameter signature string. The signature string is first encrypted using sha256, and then encrypted in reverse order using md5 to obtain the signature value, and finally a login request is generated based on the signature value.

[0063] S204: Query the tenant identifier corresponding to the user identifier, query the user authority information of the user corresponding to the user identifier in the tenant corresponding to the tenant identifier, and generate authorization information according to the user authority information.

[0064] Specifically, the tenant identifier is used to uniquely identify the tenant. The tenant is an abstract organization relative to the platform. The platform can include multiple different products, each product can correspond to different systems, each system can include multiple different permission packages, and the tenant can be configured with multiple different permission packages. Multiple different roles can be set under the tenant, and each role can be configured with different users. The roles are authorized to the users under the tenant; different tenants can define roles and authorize them to users according to their respective management requirements. In this way, when the server receives the user identifier, it can determine the tenant identifier corresponding to the user identifier to determine which tenant the user belongs to. In this way, the role corresponding to the user under the tenant can be obtained, and the permissions corresponding to the role can be obtained, that is, the user permission information. When the user permission information exists, it means that the user is legal, so authorization information can be generated to facilitate the processing of subsequent business.

[0065] Optionally, the server can receive the login request through the gateway, and verify the signature information in the login request through the gateway. After the verification is successful, the server logs in to the user center through the user account and password. The verification process is the opposite of the above-mentioned signature information generation process, which will not be repeated here.

[0066] S206: Generate session information according to the authorization information, user authority information, and user identification, and send the authorization information to the user terminal.

[0067] Specifically, after generating the authorization information, the server generates session information from the authorization information, user authority information, and user identification and saves the session information so that the user terminal can directly use the session information when making a service processing request.

[0068] Specifically, as mentioned above, after logging in to the user center, the user center verifies the account and password entered by the user, and then performs authentication. After successful authentication, session information is generated. For example, after the legitimacy of the user information is verified, an authorization token and a dynamic encrypted verification value will be issued for this login. The token, dynamic verification value and user information will be cached in the cache server, and only the authorized token information and dynamic verification value information will be returned to the user terminal, so that when the user terminal performs subsequent business processing, the corresponding permission information can be directly queried and the login status of the user terminal can be maintained.

[0069] The above-mentioned authentication process may include a variety of authentication methods: for example, a variety of authentication strategies (including no authentication, session-level authentication, permission item authentication, and non-public network interface authentication), multiple security encryption strategies (including: AccessToken and RefreshToken dual token mechanism, session-level dynamic encryption verification mechanism, interface authentication mechanism), custom tamper-proof encryption algorithm, three-level security level design (encrypted storage of sensitive data, control capability of sessions and concurrent users, two-factor authentication mechanism (when logging in, the user enters the original personal password (static password), and then enters the dynamic password displayed on the token to achieve secure two-factor identity authentication protection.)) and so on.

[0070] S208: Receive a service request sent by the user terminal, where the service request carries authorization information.

[0071] Specifically, the service request is a request from a user terminal to apply for a service from a server, which may carry the above-mentioned authorization information, thereby ensuring the login status and facilitating the query of authority information.

[0072] Optionally, the server can receive the service request through the gateway, and then verify the signature information in the service request through the gateway. Specifically, it can perform authentication through a unified gateway based on the OAuth2.0 protocol, and after successful authentication, read the session information from the user center.

[0073] S210: Query the stored session information corresponding to the authorization information, perform permission control on the service request according to the user permission information in the session information, and obtain response data corresponding to the service request.

[0074] Specifically, the server sends the authentication success information to the user center, so that the user center can read the stored session information and perform permission control on the service request according to the user permission information in the session information, such as whether to allow reading data, whether to allow writing data, etc., to obtain the response data corresponding to the service request.

[0075] S212: Return the response data to the user terminal.

[0076] Specifically, after the processing is completed, the server returns the response data to the user terminal, completing the processing of the entire business request. If the user also processes other systems in the platform, he can directly jump to another system and then process the business. The specific processing process is as above and will not be repeated.

[0077] The above-mentioned business data processing method based on shared permissions, after receiving the login request sent by the user terminal, first obtains the tenant identifier corresponding to the user identifier, and then can query the user's permission information in the tenant, and generate authorization information based on the permission information, so that the authorization information, user permission information, and user identifier are generated into session information and saved. When there is a business request, the corresponding permission information in the session information can be directly queried. In this way, permission control is performed on the business request through the permission information, which can ensure that different users can only obtain data within the permission, and will not cause data leakage. Moreover, since the user permission information is queried at the time of login, the user permission information can be directly used in the subsequent business processing without multiple queries, which can also improve the processing efficiency.

[0078] Specifically, see Figures 3 to 5 As shown, Figure 3 is a diagram showing an example of a seven-layer model in an embodiment. Figure 4 A schematic diagram of permission configuration in an embodiment is shown below. Figure 5 The figure is a schematic diagram of personalized tenant function adaptation in one embodiment.

[0079] In one embodiment, in combination Figures 3 to 5 , the generation of user permission information includes:

[0080] First, the server receives a user rights configuration request sent by a tenant terminal, and creates a role corresponding to the user rights configuration request and multiple user accounts corresponding to the role.

[0081] Specifically, roles are used to authorize managers. Tenants are abstract organizations with users under them. Roles are authorized to users under tenants. Different tenants can define roles and authorize users according to their management requirements. Tenants can configure users. During configuration, the server receives the user permission configuration request sent by the tenant, and then creates different roles and users based on the configuration request.

[0082] Secondly, the server obtains tenant authority information corresponding to the tenant terminal, and the tenant authority information includes system authority packages of systems corresponding to several products in the platform.

[0083] Specifically, the tenant can obtain the permission packages of multiple systems, so as to obtain the tenant permission information, and the tenant permission information may include the permission packages of multiple systems.

[0084] Third, the server parses the system permission package to obtain multiple initial permission information; configures the corresponding initial permission information for the role to authorize the user account and generate user permission information.

[0085] Specifically, the server can parse the permission package to obtain multiple initial permission information, such as different permission information corresponding to each type of data, including read and write permissions, data reading range permissions, etc. The server can configure the corresponding initial permission information for each role as needed, and then authorize the role to the user account, thereby completing the configuration of user permission information.

[0086] In the above embodiments, users are managed at the role level, and permissions are configured for users at the platform, product, system, permission package, tenant, role, and user levels to meet permission function management requirements and facilitate user management.

[0087] In one of the embodiments, please continue to combine Figures 3 to 5 As shown, the generation methods of tenant permission information include:

[0088] First, the server receives a tenant rights configuration request sent by a tenant terminal, where the tenant rights configuration request carries a product identifier and a system identifier.

[0089] Tenant permission configuration requests correspond to products and systems. Each product can be set up with multiple systems. Tenants can rent different systems under different products to complete corresponding businesses.

[0090] Secondly, the server queries multiple systems corresponding to the product identifier and selects a target system according to the system identifier.

[0091] The server first queries multiple systems corresponding to the product identifiers, and determines the system rented by the user, ie, the target system, according to the system identifiers.

[0092] Third, the server obtains the system permission information corresponding to the target system, selects the target permission information from the system permission information according to the tenant permission configuration request, and packages the target permission information to obtain a tenant permission package.

[0093] Specifically, the generation method of the permission package includes: metadata definition and data rule definition, wherein metadata is mainly information that describes data attributes, and is used to support functions such as indicating storage location, historical data, resource search, and file records. Data rules are pre-set data processing rules. By packaging the data rules, that is, the system permission information, the corresponding permission package can be obtained.

[0094] Fourth, the tenant permission package is configured to the tenant to obtain the tenant permission information.

[0095] The server configures the permission packages to different tenants to obtain tenant permission information.

[0096] In the above embodiment, the permission information is configured for tenants at the granularity of system permission packages, which can flexibly meet the personalized functional requirements of different tenants and improve the adaptability and expansion capabilities of the platform through configuration management.

[0097] In one embodiment, querying multiple systems corresponding to the product identification includes: querying a tenant domain corresponding to the tenant terminal; and querying multiple systems corresponding to the product identification from the tenant domain.

[0098] Specifically, see Figure 6 , Figure 6 This is a schematic diagram of domain management in an embodiment. In this embodiment, the tenant permission configuration request also includes the tenant domain. Before querying the multiple systems corresponding to the product identification, the server also needs to query the corresponding domain according to the tenant's domain to query the multiple systems corresponding to the product identification from the corresponding domain, that is, the user distinguishes the user type. The tenant is one of the core components in the platform, representing different organizations, such as hospitals, companies, government departments, etc. Different types of organizations in the platform will classify users, that is, domains, such as A\B\G. The platform service provider corresponds to domain A, the hospital corresponds to domain B, and the government department corresponds to domain G. When configuring the tenant, it is necessary to determine the domain in order to obtain different permission packages, so that when the tenant configures the user under it, the user type can be marked to obtain the authority corresponding to the domain.

[0099] In one of the embodiments, querying the stored session information corresponding to the authorization information includes: querying whether there is stored session information corresponding to the authorization information in the cache; when there is no stored session information corresponding to the authorization information in the cache, querying whether there is stored session information corresponding to the authorization information in the database; when there is stored session information corresponding to the authorization information in the database, reading the session information into the cache.

[0100] Specifically, when the server reads the stored session information, it can first read whether there is session information corresponding to the authorization information in the cache. If so, it directly returns the query success. Otherwise, it can continue to query whether it exists in the database. If so, the session information in the database is read into the cache. In this way, when the server processes the business request, it directly queries the cache and then obtains the user permission information. After performing permission control through the user permission information, it obtains the response data corresponding to the business request.

[0101] See also Figure 7 As shown, Figure 7The present invention is a timing diagram of a business data processing method based on shared permissions in an embodiment. In this embodiment, the user terminal first generates a login request, then signs the login request and sends it to the gateway. The gateway verifies the signature of the login request. After the verification, the login authentication is sent to the user center. The user center authenticates and records the log, queries the corresponding user permission information, generates authorization information and session information, and caches them in the cache management database. Then, the session result, that is, the authorization information, is returned to the user terminal through the user center and the gateway. In this way, the user terminal caches the authorization information and jumps to the business processing interface.

[0102] In this way, the user terminal receives the business request input by the user through the business processing interface, signs the business request, and sends the signed business request to the gateway. After the gateway verifies the signature, it sends the verified business request to the user center for interface authentication. In this way, the user center can read the cache from the cache management database and return the session information and permission information. If the cache does not exist, the session information and permission information in the database are read to complete the interface authentication, and the authentication result is returned to the gateway. In this way, after the authentication is passed, the gateway sends the business request to the business system, so that the business system reads the session information from the cache management database, and performs permission control on the business request according to the user permission information in the session information, and obtains the response data corresponding to the business request. After the business system obtains the response data, it returns the response data to the user terminal.

[0103] The above-mentioned business data processing method based on shared permissions, after receiving the login request sent by the user terminal, first obtains the tenant identifier corresponding to the user identifier, and then can query the user's permission information in the tenant, and generate authorization information based on the permission information, so that the authorization information, user permission information, and user identifier are generated into session information and saved. When there is a business request, the corresponding permission information in the session information can be directly queried. In this way, permission control is performed on the business request through the permission information, which can ensure that different users can only obtain data within the permission, and will not cause data leakage. Moreover, since the user permission information is queried at the time of login, the user permission information can be directly used in the subsequent business processing without multiple queries, which can also improve the processing efficiency.

[0104] It should be understood that although Figure 2 and Figure 7 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2 and Figure 7At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0105] In one embodiment, Figure 8 As shown, a business data processing device based on shared permissions is provided, comprising: a first receiving module 100, a first query module 200, a session information generating module 300, a second receiving module 400, a second query module 500 and a sending module 600, wherein:

[0106] The first receiving module 100 is used to receive a login request from a user terminal, where the login request carries a user identifier.

[0107] The first query module 200 is used to query the tenant identifier corresponding to the user identifier, query the user authority information of the user corresponding to the user identifier in the tenant corresponding to the tenant identifier, and generate authorization information according to the user authority information.

[0108] The session information generation module 300 is used to generate session information according to the authorization information, user authority information, and user identification, and send the authorization information to the user terminal.

[0109] The second receiving module 400 is used to receive a service request sent by a user terminal, where the service request carries authorization information.

[0110] The second query module 500 is used to query the stored session information corresponding to the authorization information, and obtain response data corresponding to the business request after performing authority control on the business request according to the user authority information in the session information.

[0111] The sending module 600 is used to return the response data to the user terminal.

[0112] In one embodiment, the business data processing device based on sharing authority may further include:

[0113] The third receiving module is used to receive a user authority configuration request sent by the tenant terminal, and create a role corresponding to the user authority configuration request and multiple user accounts corresponding to the role.

[0114] The system permission package acquisition module is used to obtain tenant permission information corresponding to the tenant terminal. The tenant permission information includes system permission packages of the system corresponding to several products in the platform.

[0115] The parsing module is used to parse the system permission package to obtain multiple initial permission information.

[0116] The user authority information generation module is used to configure the corresponding initial authority information for the role, so as to authorize the user account and generate user authority information.

[0117] In one embodiment, the business data processing device based on sharing authority may further include:

[0118] The fourth receiving module is used to receive a tenant authority configuration request sent by a tenant terminal, where the tenant authority configuration request carries a product identifier and a system identifier.

[0119] The third query module is used to query multiple systems corresponding to the product identification and select a target system according to the system identification.

[0120] The tenant permission package acquisition module is used to obtain the system permission information corresponding to the target system, select the target permission information from the system permission information according to the tenant permission configuration request, and package the target permission information to obtain the tenant permission package.

[0121] The tenant permission information configuration module is used to configure the tenant permission package to the tenant to obtain the tenant permission information.

[0122] In one embodiment, the third query module may include:

[0123] The domain query unit is used to query the tenant domain corresponding to the tenant terminal.

[0124] The system query unit is used to query multiple systems corresponding to the product identifier from the tenant domain.

[0125] In one embodiment, the second query module 500 may include:

[0126] The cache query unit is used to query whether there is stored session information corresponding to the authorization information in the cache.

[0127] The database query unit is used to query whether there is stored session information corresponding to the authorization information in the database when there is no stored session information corresponding to the authorization information in the cache.

[0128] The reading unit is used to read the session information into the cache when there is stored session information corresponding to the authorization information in the database.

[0129] For the specific definition of the business data processing device based on shared permissions, please refer to the definition of the business data processing method based on shared permissions above, which will not be repeated here. Each module in the above-mentioned business data processing device based on shared permissions can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0130] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig. 9 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store business data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a business data processing method based on shared permissions is implemented.

[0131] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0132] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program: receiving a login request from a user terminal, the login request carrying a user identifier; querying a tenant identifier corresponding to the user identifier, and querying user authority information of a user corresponding to the user identifier in a tenant corresponding to the tenant identifier, and generating authorization information based on the user authority information; generating session information based on the authorization information, the user authority information, and the user identifier, and sending the authorization information to the user terminal; receiving a service request sent by the user terminal, the service request carrying the authorization information; querying the stored session information corresponding to the authorization information, performing authority control on the service request based on the user authority information in the session information, and obtaining response data corresponding to the service request; and returning the response data to the user terminal.

[0133] In one embodiment, the generation of user permission information involved when the processor executes a computer program includes: receiving a user permission configuration request sent by a tenant terminal, creating a role corresponding to the user permission configuration request and multiple user accounts corresponding to the role; obtaining tenant permission information corresponding to the tenant terminal, the tenant permission information including a system permission package of a system corresponding to several products in the platform; parsing the system permission package to obtain multiple initial permission information; configuring the corresponding initial permission information for the role to authorize the user account to generate user permission information.

[0134] In one embodiment, a method for generating tenant permission information involved in executing a computer program by a processor includes: receiving a tenant permission configuration request sent by a tenant terminal, the tenant permission configuration request carrying a product identifier and a system identifier; querying multiple systems corresponding to the product identifier, and selecting a target system based on the system identifier; obtaining system permission information corresponding to the target system, selecting target permission information from the system permission information based on the tenant permission configuration request, and packaging the target permission information to obtain a tenant permission package; configuring the tenant permission package to the tenant to obtain tenant permission information.

[0135] In one embodiment, querying multiple systems corresponding to the product identification implemented by the processor when executing the computer program includes: querying the tenant field corresponding to the tenant terminal; and querying multiple systems corresponding to the product identification from the tenant field.

[0136] In one embodiment, the querying of stored session information corresponding to the authorization information implemented by the processor when executing the computer program includes: querying whether there is stored session information corresponding to the authorization information in the cache; when the stored session information corresponding to the authorization information does not exist in the cache, querying whether there is stored session information corresponding to the authorization information in the database; when the stored session information corresponding to the authorization information exists in the database, reading the session information into the cache.

[0137] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: receiving a login request from a user terminal, the login request carrying a user identifier; querying a tenant identifier corresponding to the user identifier, and querying user authority information of a user corresponding to the user identifier in a tenant corresponding to the tenant identifier, and generating authorization information based on the user authority information; generating session information based on the authorization information, the user authority information, and the user identifier, and sending the authorization information to the user terminal; receiving a service request sent by the user terminal, the service request carrying the authorization information; querying the stored session information corresponding to the authorization information, performing authority control on the service request based on the user authority information in the session information, and obtaining response data corresponding to the service request; and returning the response data to the user terminal.

[0138] In one embodiment, the generation of user permission information involved when a computer program is executed by a processor includes: receiving a user permission configuration request sent by a tenant terminal, creating a role corresponding to the user permission configuration request and multiple user accounts corresponding to the role; obtaining tenant permission information corresponding to the tenant terminal, the tenant permission information including a system permission package of a system corresponding to several products in the platform; parsing the system permission package to obtain multiple initial permission information; configuring the corresponding initial permission information for the role to authorize the user account to generate user permission information.

[0139] In one embodiment, a method for generating tenant permission information involved when a computer program is executed by a processor includes: receiving a tenant permission configuration request sent by a tenant terminal, the tenant permission configuration request carrying a product identifier and a system identifier; querying multiple systems corresponding to the product identifier, and selecting a target system based on the system identifier; obtaining system permission information corresponding to the target system, selecting target permission information from the system permission information based on the tenant permission configuration request, and packaging the target permission information to obtain a tenant permission package; configuring the tenant permission package to the tenant to obtain tenant permission information.

[0140] In one embodiment, the querying of multiple systems corresponding to the product identification implemented by the computer program when executed by the processor includes: querying the tenant domain corresponding to the tenant terminal; and querying the multiple systems corresponding to the product identification from the tenant domain.

[0141] In one embodiment, the querying of stored session information corresponding to the authorization information implemented by the computer program when executed by the processor includes: querying whether there is stored session information corresponding to the authorization information in the cache; when the stored session information corresponding to the authorization information does not exist in the cache, querying whether there is stored session information corresponding to the authorization information in the database; when the stored session information corresponding to the authorization information exists in the database, reading the session information into the cache.

[0142] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0143] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0144] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A business data processing method based on shared permissions, the method comprising: Receiving a login request from a user terminal, wherein the login request carries a user identifier; Querying the tenant identifier corresponding to the user identifier, and querying the user authority information of the user corresponding to the user identifier in the tenant corresponding to the tenant identifier, and generating authorization information according to the user authority information; Generate session information according to the authorization information, the user authority information, and the user identifier, and send the authorization information to the user terminal, wherein the authorization information includes authorization token information and dynamic verification value information; Receiving a service request sent by a user terminal, wherein the service request carries authorization information; Querying the stored session information corresponding to the authorization information, performing authority control on the service request according to the user authority information in the session information, and obtaining response data corresponding to the service request; The response data is returned to the user terminal.

2. The method according to claim 1, characterized in that The generation of the user authority information includes: Receiving a user rights configuration request sent by a tenant terminal, and creating a role corresponding to the user rights configuration request and a plurality of user accounts corresponding to the role; Acquire tenant authority information corresponding to the tenant terminal, wherein the tenant authority information includes system authority packages of systems corresponding to several products in the platform; Parsing the system permission package to obtain multiple initial permission information; The corresponding initial permission information is configured for the role to authorize the user account to generate user permission information.

3. The method according to claim 2, characterized in that The generation method of the tenant authority information includes: Receiving a tenant rights configuration request sent by a tenant terminal, wherein the tenant rights configuration request carries a product identifier and a system identifier; Querying multiple systems corresponding to the product identifier, and selecting a target system according to the system identifier; Obtaining system permission information corresponding to the target system, selecting target permission information from the system permission information according to the tenant permission configuration request, and packaging the target permission information to obtain a tenant permission package; The tenant rights package is configured to the tenant to obtain tenant rights information.

4. The method according to claim 3, characterized in that The querying of multiple systems corresponding to the product identification includes: Querying the tenant domain corresponding to the tenant terminal; A plurality of systems corresponding to the product identifier is queried from the tenant domain.

5. The method according to any one of claims 1 to 4, characterized in that: The querying of the stored session information corresponding to the authorization information includes: Querying the cache whether there is stored session information corresponding to the authorization information; When the stored session information corresponding to the authorization information does not exist in the cache, querying whether the stored session information corresponding to the authorization information exists in the database; When there is stored session information corresponding to the authorization information in the database, the session information is read into the cache.

6. A business data processing device based on shared permissions, characterized in that: The device comprises: A first receiving module, configured to receive a login request from a user terminal, wherein the login request carries a user identifier; A first query module, configured to query a tenant identifier corresponding to the user identifier, query user authority information of a user corresponding to the user identifier in the tenant corresponding to the tenant identifier, and generate authorization information according to the user authority information; A session information generation module, configured to generate session information according to the authorization information, the user authority information, and the user identifier, and send the authorization information to the user terminal, wherein the authorization information includes authorization token information and dynamic verification value information; A second receiving module is used to receive a service request sent by a user terminal, wherein the service request carries authorization information; A second query module is used to query the stored session information corresponding to the authorization information, and obtain response data corresponding to the service request after performing authority control on the service request according to the user authority information in the session information; The sending module is used to return the response data to the user terminal.

7. The device according to claim 6, characterized in that The device also includes: A third receiving module is used to receive a user authority configuration request sent by a tenant terminal, and create a role corresponding to the user authority configuration request and multiple user accounts corresponding to the role; A system permission package acquisition module, used to acquire tenant permission information corresponding to the tenant terminal, wherein the tenant permission information includes system permission packages of systems corresponding to several products in the platform; A parsing module, used for parsing the system permission package to obtain a plurality of initial permission information; The user authority information generation module is used to configure the corresponding initial authority information for the role so as to authorize the user account and generate user authority information.

8. The device according to claim 7, characterized in that The device also includes: A fourth receiving module, configured to receive a tenant rights configuration request sent by a tenant terminal, wherein the tenant rights configuration request carries a product identifier and a system identifier; A third query module, used to query multiple systems corresponding to the product identifier, and select a target system according to the system identifier; A tenant permission package acquisition module is used to acquire system permission information corresponding to a target system, select target permission information from the system permission information according to the tenant permission configuration request, and package the target permission information to obtain a tenant permission package; The tenant authority information configuration module is used to configure the tenant authority package to the tenant to obtain tenant authority information.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images