Access request authentication method, device, equipment and readable storage medium

Abstract

The present application relates to the field of data security technology, and discloses an authentication method for access requests, including: receiving an access request, and identifying identity information contained in the access request; querying in a service cache according to the identity information to determine whether access authentication is currently being performed; if it is determined that access authentication is currently being performed, determining a user identifier according to the identity information, and querying in a hotspot list according to the user identifier; when it is determined that the hotspot list does not contain a resource identifier corresponding to the user identifier, obtaining a standard resource identifier corresponding to the access request according to the identity information; and determining whether to respond to the access request according to the standard resource identifier. The present application also provides a device, a computer device, and a storage medium. The efficiency of resource access is effectively improved, and the responsiveness of the system is also improved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an access request authentication method, an access request authentication device, a computer device, and a computer-readable storage medium. Background Art

[0002] In order to ensure system security and prevent users from over-authorized operations, ACL (Access Control List) permission control is usually used as a general solution used by the system, which is an indispensable function. When users access system functions, different users have different operation permissions. For resources visible to users, users have corresponding operation permissions, but for resources invisible to users, users cannot perform corresponding operations, such as query, delete, and add.

[0003] In the existing ACL permission control chain, three elements are generally involved: users, roles, and resources. Then, by building a corresponding relationship between the three, the correspondence between users and resources is achieved, so that users can operate on corresponding resources through query and matching when accessing the system.

[0004] Although this method realizes the query of resource information, the system response time is long due to the long permission verification link, resulting in relatively poor performance. At the same time, in high-concurrency scenarios, it will also bring greater operating load to the system. Summary of the invention

[0005] The present application provides an access request authentication method, apparatus, computer equipment and storage medium to improve the efficiency of resource access and the responsiveness of the system.

[0006] In a first aspect, the present application provides an access request authentication method, the method comprising:

[0007] Receiving an access request and identifying identity information contained in the access request;

[0008] Querying the service cache according to the identity information to determine whether access authentication is currently being performed;

[0009] If it is determined that access authentication is currently being performed, determining a user identifier according to the identity information, and querying in a hotspot list according to the user identifier;

[0010] When it is determined that the hotspot list does not contain the resource identifier corresponding to the user identifier, obtaining the standard resource identifier corresponding to the access request according to the identity information;

[0011] Determine whether to respond to the access request according to the standard resource identifier.

[0012] In a second aspect, the present application further provides an access request authentication device, the device comprising:

[0013] A request receiving module, used to receive an access request and identify the identity information contained in the access request;

[0014] An authentication judgment module is used to query the service cache according to the identity information to determine whether access authentication is currently performed;

[0015] An information query module, for determining a user identifier according to the identity information if it is determined that access authentication is currently being performed, so as to query a hotspot list according to the user identifier;

[0016] An identification generation module, used for obtaining a standard resource identification corresponding to the access request according to the identity information when it is determined that the hotspot list does not contain a resource identification corresponding to the user identification;

[0017] A response determination module is used to determine whether to respond to the access request according to the standard resource identifier.

[0018] In a third aspect, the present application also provides a computer device, comprising a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program and implement the access request authentication method as described above when executing the computer program.

[0019] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the access request authentication method as described above.

[0020] The present application discloses an authentication method, device, computer equipment and storage medium for access request. When performing resource access, relevant identity information is obtained through a gateway, and a hotspot list that is updated and changed in real time is constructed. The relevant information of the hotspot user is recorded and stored, and then authentication is performed based on the obtained identity information and hotspot list to determine whether the system responds to the received access request, so that the long-chain query and judgment of "user→role→resource" is avoided when performing resource access, which effectively improves the efficiency of resource access and the response performance of the system. At the same time, when performing authentication, the request will be processed according to different request styles, that is, it can be applied to request generation methods of different styles, which improves the adaptability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 A flowchart of an access request authentication method provided by an embodiment of the present application;

[0023] Figure 2 A flowchart of the steps of determining whether to perform access authentication provided in an embodiment of the present application;

[0024] Figure 3 A flowchart of the steps of performing a query based on a user identifier provided in an embodiment of the present application;

[0025] Figure 4 A schematic block diagram of an access request authentication device in one embodiment of the present application;

[0026] Figure 5 This is a schematic block diagram of the structure of a computer device in one embodiment of the present application. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0029] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0030] It should be further understood that the term “and / or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0031] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0032] See also Figure 1 , Figure 1 A flowchart of an access request authentication method provided for an embodiment of the present application.

[0033] like Figure 1 As shown, the access request authentication method includes steps S101 to S105.

[0034] Step S101: Receive an access request and identify identity information contained in the access request.

[0035] When a user accesses the system, the user sends a request for access to resources to the system through corresponding operations, so that when the system receives the access request, it performs corresponding processing and judgment to determine whether the user who issued the access request can access the resources to be accessed, and then responds to the received access request when it is determined that the access request can be responded to, and gives corresponding feedback when it is determined that the access is not possible, such as treating the feedback request as an invalid request, or issuing a corresponding prompt message to inform why the access is not possible.

[0036] Therefore, when an access request is received, the identity information contained in the access request will be identified first, and then it will be determined whether to respond to the received access request based on the identified identity information, so as to enable the user to access resource information when it is determined to respond to the received access request.

[0037] In one embodiment, when an access request is identified to obtain corresponding identity information, the obtained identity information may include: request resource identifier URI (Uniform Resource Identifier, which is a string used to identify the name of an Internet resource), request type, service identifier portal Token, login account and account type, where the account type is determined according to the actual situation. For example, the account type may include um type, one-account type and group epa type, etc., which are mainly determined within the company.

[0038] In actual applications, when accessing resources, the correspondence between user roles and resources is usually used to access the resources currently to be accessed. Specifically, the corresponding role is determined by the user, and then the corresponding resource is determined by the role to obtain the resources that the user can access, or whether the resources to be accessed can be accessed, and then determine whether the resources that the user currently wants to access are allowed to be accessed.

[0039] For this type of resource access method, due to a long-link access, when high concurrency occurs, the resource access efficiency will be reduced to a certain extent due to frequent query matching. Therefore, in this application, when implementing access to resource information, it does not rely solely on the relationship between users and roles and between roles and resources. Through reasonable authentication and query of resource information, reasonable information caching is achieved in high concurrency to effectively improve resource access efficiency and avoid the increase in operating load caused by chain access and authentication in high concurrency.

[0040] Step S102: query the service cache according to the identity information to determine whether access authentication is currently being performed.

[0041] The service cache records the relevant information of the services executed or running in the system, such as the service identification information. All services that have run in the system will be recorded in the service cache. In actual use, for the corresponding service cache and the actual configuration, it is not recorded in the service cache only when the correspondence between users and roles and roles and resources is completed. As long as it exists in the system, regardless of the actual configuration, the service will be recorded in the service cache. For example, when the system is upgraded and the configuration is updated, the new configuration information is not configured in the system.

[0042] Therefore, after determining the identity information of the user currently accessing the service based on the access request, it will be determined whether the user can access the resource that he wants to access based on the identity information. Specifically, the service cache of each pre-recorded storage is obtained, and then the service cache is queried and matched based on the obtained identity information to determine whether to perform access authentication based on the query matching result. When it is determined that access authentication is required, the currently received access request and reverse authentication are performed based on the identified identity information, and when it is determined that access authentication is not required, the access request will not be authenticated, and the received access request will be released, that is, the access request will not be responded to.

[0043] In actual applications, when determining whether to perform authentication, first obtain the service identifier contained in the identity information, and then make a corresponding judgment based on the service identifier. Specifically, obtain the pre-recorded service cache, and then query the service cache based on the obtained service identifier to determine whether the service cache contains the currently obtained service identifier. When it is determined that the service cache does not contain the obtained service identifier, it means that the service does not exist in the system. Therefore, the access request received at this time can be regarded as an invalid request, and then corresponding feedback information is issued.

[0044] When it is determined that the service cache contains a service identifier, it is not directly determined that access authentication is required at this time, but further judgment and determination are required to determine whether to perform access authentication on the access request based on the results of the judgment and determination.

[0045] Furthermore, if Figure 2 As shown, Figure 2 A flowchart of the steps for determining whether to perform access authentication is provided in one embodiment of the present application.

[0046] Wherein, step S102 includes step S201 to step S202.

[0047] Step S201: obtaining a service identifier contained in the identity information, and determining whether the service identifier exists in a preset service cache;

[0048] Step S202: If it is determined that the service identifier exists in the service cache, the state of the authentication switch is determined to determine whether access authentication is currently performed according to the state of the authentication switch.

[0049] The identity information contains several related information, such as the request resource identifier uri, request type, service identifier portal token, login account and account type, etc. Different information represents different information of the current access request. For example, the service identifier represents the relevant information of the service corresponding to the access request, and the login account and account type represent the account information and account type information used by the user who issued the access request. When making access authentication judgments, only access requests that meet the relevant conditions are allowed to be authenticated and responded to.

[0050] Therefore, when determining whether access authentication is required for an access request, the service identifier included in the obtained identity information is identified, and then a query is performed in the service cache that is updated and stored in real time based on the obtained service identifier to determine whether the service identifier exists in the service cache. Since the existence of the service identifier is used to determine whether the service has been run in the system before, and all services that have been run will be recorded, that is, there will be corresponding matching items in the service cache, so when it is determined that the service identifier exists in the service cache, it is determined that the currently received access request may need to be accessed, and when it is determined that the service identifier does not exist in the service cache, it is determined that the access request will not be responded to, that is, the access request received at this time can be regarded as an invalid request.

[0051] As can be seen from the above description, when it is determined that the service identifier exists in the service cache, it is determined that the currently received access request may need to be accessed, so further judgment and determination are required. Specifically, when it is determined that the service identifier exists in the service cache, the state of the authentication switch for access authentication in the system is determined, where the state of the switch includes on and off, and then whether access authentication is currently required is determined based on the state of the authentication switch.

[0052] The authentication switch in the system is controlled by the administrator and is determined based on the actual operating status of the system. For example, when the system is upgrading its services, there is an update of resource permission information. During the update, because of the update of information, authentication may not be completed accurately. At the same time, it will also increase the operating load. Therefore, the authentication switch needs to be controlled to be in the off state to avoid authentication processing when the information is updated.

[0053] Further, determining whether to perform access authentication according to the authentication switch includes: if it is determined that the state of the authentication switch is on, determining to perform access authentication; if it is determined that the state of the authentication switch is off, determining not to perform access authentication and releasing the access request.

[0054] In actual applications, the authentication switch is the basis for determining whether the current system environment allows access authentication, and the authentication switch is determined according to the actual situation of the system. Therefore, even if the service identifier exists in the service cache, if the authentication switch is in the off state, it means that access authentication will not be performed at this time.

[0055] Step S103: If it is determined that access authentication is currently being performed, a user identifier is determined according to the identity information, so as to query in a hotspot list according to the user identifier.

[0056] Among them, the hotspot list records the relationship between some users and resources, but does not include the corresponding relationship between all users and resources. It usually records users and resources with access or query frequency. At the same time, the hotspot list is in a real-time update state. The information recorded in the hotspot list will be updated according to the actual usage status to ensure that more useful data is recorded in the hotspot list to improve the efficiency of access and authentication.

[0057] Furthermore, the relationship between users and resources recorded in the hotspot list can be updated according to time information and query frequency during the monitoring period. By updating the information in the hotspot list, the amount of data recorded in the hotspot list is reduced while ensuring the efficiency of access and authentication. At the same time, the corresponding newly emerged relationship between users and resources can be directly cached in the hotspot list, and will also be updated and processed over time.

[0058] When it is determined that authentication is required based on the user's identity information, authentication will be completed based on the identity information obtained in advance to determine whether to respond to the received network request. Specifically, when it is determined that authentication is required based on the service identifier and the actual status of the system, a query will be performed in the hotspot list based on the identified identity information to determine whether a response to the access request is required at this time.

[0059] As for the identity information, in addition to the service identifier, it also includes the requested resource identifier, request type, login account and account type. Therefore, when querying in the hot spot list based on the identity information, the user information of the user accessing the resource is first determined based on the identity information, such as the user identifier (such as numbers or letters, etc.), and then the resource authentication judgment is completed based on the determined user information.

[0060] When an access request is received, the access request contains relevant information about the resource that the user wants to access, such as the requested resource identifier contained in the identity information, and then through authentication and determination, it is determined whether the user can access the resource that needs to be accessed.

[0061] Specifically, Figure 3 As shown, Figure 3 A flowchart of the steps of performing a query based on a user identifier provided in one embodiment of the present application.

[0062] The process of determining the user identifier according to the identity information, and querying the hotspot list (user resource list) according to the user identifier, includes steps S301 to S303.

[0063] Step S301: Obtain the login account and account information contained in the identity information to obtain the current corresponding user identification;

[0064] Step S302: Obtain a pre-recorded user cache, and determine whether the user identifier exists in the user cache;

[0065] Step S303: If it is determined that the user identifier exists in the user cache, a query is performed in the hotspot list based on the user identifier.

[0066] The user cache records the relevant information of users who have access rights in the system.

[0067] When performing authentication and judgment, the current corresponding user identifier is determined based on the login account and account type contained in the identity information, and then a match is performed in the user cache based on the obtained user identifier to determine whether the user cache contains the user identifier. If it is determined that the obtained user identifier does not exist in the user cache, it is determined that the user does not have access rights. If it is determined that the obtained user identifier exists in the user cache, further judgment and determination are performed.

[0068] Specifically, when determining whether to respond to a received access request, the login account and account type contained in the identity information are identified and obtained to obtain the current corresponding user information, such as a user ID, and then a determination is made whether the obtained user ID is in a user cache that is updated in real time. When the user ID exists in the user cache, it is determined that further judgment and determination can be made. When the user ID does not exist in the user cache, it is determined that the user corresponding to the user ID does not have resource access rights at this time. At this time, it will be determined not to respond to the received access request.

[0069] When determining whether the user identification exists in the user cache, first obtain the pre-recorded user cache, and then determine whether the currently obtained user identification exists in the user cache by querying and comparing, such as by comparing identification information.

[0070] The query and comparison results include: the user identifier exists in the user cache and the user identifier does not exist in the user cache. According to the above description, it is determined that no response is made when it does not exist in the user cache, and further judgment is required when it is determined that it exists in the user cache. Therefore, when it is determined that the user identifier exists in the user cache, a query is performed in the hotspot list based on the user identifier to determine whether the user identifier exists in the hotspot list. When it is determined that the currently obtained user identifier exists in the hotspot list, the first resource identifier of the first resource corresponding to the user identifier is obtained, and then the first resource identifier is compared with the request resource identifier to determine whether to respond to the access request.

[0071] In fact, after the user ID is determined according to the user's login account and account type, and it is determined that the user ID exists in the user cache, a query and match is performed in the hotspot list according to the user ID to obtain the first resource corresponding to the user ID in the hotspot list and the first resource ID corresponding to the first resource. When the request resource ID exists in the first resource ID, it is determined that the user can access the resource that he wants to access, that is, at this time, the received access request will be responded to.

[0072] Step S104: when it is determined that the hotspot list contains the resource identifier corresponding to the user identifier, a standard resource identifier corresponding to the access request is obtained according to the identity information.

[0073] In actual applications, due to the diversity of request resource identifiers, even if the user has access rights to the resources he wants to access, authentication may fail due to the different forms of the request resource identifiers. For example, for a RESTful-style request resource identifier, the user identifier is carried when the request resource identifier is generated, so the resulting request resource identifier is composed of "path + resource identifier". Therefore, for this type of request resource identifier, even if the user identifier exists in the user cache, the associated resources will not be queried at this time, which means that authentication will fail. Therefore, further processing and judgment are required at this time.

[0074] Specifically, when it is determined that there is no resource identifier corresponding to the user identifier in the hotspot list, it will be determined whether the request resource identifier needs to be processed at this time, that is, the composition type of the request resource identifier is determined, and when it is determined that processing is required according to the composition type, the request resource identifier is processed to obtain a standard resource identifier. For example, the request resource identifier is segmented to divide the request resource identifier into several segments. For example, for the request resource identifier generated in the above-mentioned "path + resource identifier" composition form, the request resource identifier will be segmented into two parts, "path" and "resource identifier", and then judged according to the user identifier and the obtained resource identifier, and when the user ID, that is, the user identifier passes the authentication judgment, the resource identifier obtained by the segmentation is directly judged and determined for the second time.

[0075] After obtaining the standard resource identifier, a query is performed in the hotspot list according to the user identifier and the standard resource identifier in the manner of step 103 to complete the authentication.

[0076] Furthermore, when determining the standard resource identifier, it also includes forming a standard resource identifier according to the system identifier of the system currently accessed by the user and the user identifier, and then accessing the resource in the manner of the user to the role and the resource. After the German and Austrian standard resource identifier, determining whether to respond to the access request actually includes: obtaining the user role cache list, and determining whether there is a corresponding role identifier according to the standard resource identifier, so as to obtain the corresponding target role identifier when it is determined that there is a corresponding role identifier; querying in the role resource cache list according to the target role identifier and the service identifier included in the identity information to determine whether there is a corresponding resource identifier; when it is determined that there is a corresponding resource identifier, matching the corresponding resource identifier with the request resource identifier included in the identity information, so as to determine whether to respond to the access request according to the matching result; wherein, if there is a matching item of the request resource identifier in the corresponding resource identifier, it is determined to respond to the access request; and if there is no matching item of the request resource identifier in the corresponding resource identifier, it is determined not to respond to the access request.

[0077] Specifically, when determining whether it is necessary to process the requested resource identifier, if it is determined that the requested resource identifier does not need to be processed, the system identifier can also be obtained at this time, and then the user role cache is queried based on the obtained system identifier and user identifier, and then when it is determined that the user role cache contains a useful identifier, the role resource cache is queried based on the service identifier contained in the identity information and the role identifier obtained by the query, and when it is determined that there is a resource identifier corresponding to the role identifier, the requested resource identifier and the obtained resource identifier are matched through antPattern, and when a result is matched, it is determined that the authentication is passed, otherwise the authentication fails.

[0078] Step S105: Determine whether to respond to the access request according to the standard resource identifier.

[0079] After obtaining the standard resource identifier, determine whether to respond to the received access request based on the obtained standard resource identifier. When it is determined to respond to the access request, respond directly to the access request, and when the response is completed, the resources that the user needs to access will be obtained and displayed. When it is determined not to respond to the access request, corresponding feedback information will be issued based on the actual authentication result, such as feedback information containing the reason for the access failure.

[0080] In the access request authentication method described above, when accessing resources, relevant identity information is obtained through the gateway, and a hotspot list that is updated and changed in real time is constructed, and the relevant information of the hotspot users is recorded and stored, and then authentication is performed based on the obtained identity information and hotspot list to determine whether the system responds to the received access request, so that the long-chain query and judgment of "user→role→resource" is avoided when accessing resources, which effectively improves the efficiency of resource access and the response performance of the system. At the same time, when performing authentication, the request will be processed according to different request styles, that is, it can be applied to request generation methods of different styles, which improves the adaptability of the system.

[0081] See also Figure 4 , Figure 4 This is a schematic block diagram of an access request authentication device in one embodiment of the present application, where the device is used to execute the aforementioned access request authentication method.

[0082] like Figure 4 As shown, the access request authentication device 400 includes:

[0083] The request receiving module 401 is used to receive an access request and identify the identity information included in the access request;

[0084] The authentication judgment module 402 is used to query the service cache according to the identity information to determine whether access authentication is currently performed;

[0085] The information query module 403 is used to determine the user identification according to the identity information if it is determined that the access authentication is currently being performed, so as to query the hotspot list according to the user identification;

[0086] The identification generating module 404 is used to obtain the standard resource identification corresponding to the access request according to the identity information when it is determined that the hotspot list does not contain the resource identification corresponding to the user identification;

[0087] The response determination module 405 is used to determine whether to respond to the access request according to the standard resource identifier.

[0088] Furthermore, in one embodiment, the authentication determination module 402 is further configured to:

[0089] Obtain the service identifier contained in the identity information, and determine whether the service identifier exists in a preset service cache; if it is determined that the service identifier exists in the service cache, determine the state of the authentication switch to determine whether access authentication is currently performed based on the state of the authentication switch.

[0090] Furthermore, in one embodiment, the authentication determination module 402 is further configured to:

[0091] If it is determined that the state of the authentication switch is on, it is determined that access authentication is performed; if it is determined that the state of the authentication switch is off, it is determined that access authentication is not performed and the access request is released.

[0092] Furthermore, in one embodiment, the information query module 403 is further configured to:

[0093] Obtain the login account and account information contained in the identity information to obtain the current corresponding user ID; obtain the pre-recorded user cache and determine whether the user ID exists in the user cache; if it is determined that the user ID exists in the user cache, query the hotspot list based on the user ID.

[0094] Furthermore, in one embodiment, the access request authentication device 400 is further configured to:

[0095] When a corresponding first resource identifier set is obtained in the hotspot list based on the user identifier, the first resource identifier set is compared with the request resource identifier contained in the identity information; if it is determined that the request resource identifier exists in the first resource identifier set, it is determined to respond to the access request; if it is determined that the request resource identifier does not exist in the first resource identifier set, it is determined not to respond to the access request.

[0096] Furthermore, in one embodiment, the information query module 403 is further configured to:

[0097] Identify the requested resource identifier contained in the identity information and the component type corresponding to the requested resource identifier; segment the requested resource identifier according to the component type to obtain the standard resource identifier corresponding to the access request.

[0098] Furthermore, in one embodiment, the information query module 403 is further configured to:

[0099] A system identifier is obtained to obtain a standard resource identifier according to the system identifier and the user identifier.

[0100] The response determination module 405 is further specifically used for:

[0101] Obtain a user role cache list, and determine whether a corresponding role identifier exists according to the standard resource identifier, so as to obtain a corresponding target role identifier when it is determined that a corresponding role identifier exists; query the role resource cache list according to the target role identifier and the service identifier included in the identity information to determine whether a corresponding resource identifier exists; when it is determined that a corresponding resource identifier exists, match the corresponding resource identifier with the request resource identifier included in the identity information to determine whether to respond to the access request according to the matching result;

[0102] Among them, if there is a matching item of the requested resource identifier in the corresponding resource identifier, it is determined to respond to the access request; and if there is no matching item of the requested resource identifier in the corresponding resource identifier, it is determined not to respond to the access request.

[0103] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and each module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0104] The above-mentioned device can be implemented in the form of a computer program. Figure 5 Runs on the computer device shown.

[0105] See also Figure 5 , Figure 5 This is a schematic block diagram of the structure of a computer device in one embodiment of the present application. The computer device may be a server.

[0106] See also Figure 5 The computer device includes a processor, a memory and a network interface connected through a system bus, wherein the memory may include a non-volatile storage medium and an internal memory.

[0107] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any authentication method for an access request.

[0108] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0109] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any authentication method for the access request.

[0110] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will appreciate that Figure 5The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0111] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0112] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:

[0113] Receive an access request and identify the identity information contained in the access request; query the service cache based on the identity information to determine whether access authentication is currently being performed; if it is determined that access authentication is currently being performed, determine the user ID based on the identity information to query the hotspot list based on the user ID; when it is determined that the hotspot list does not contain a resource ID corresponding to the user ID, obtain the standard resource ID corresponding to the access request based on the identity information; and determine whether to respond to the access request based on the standard resource ID.

[0114] In one embodiment, when the processor implements querying in the service cache according to the identity information to determine whether access authentication is currently performed, it is also used to implement:

[0115] Obtain the service identifier contained in the identity information, and determine whether the service identifier exists in a preset service cache; if it is determined that the service identifier exists in the service cache, determine the state of the authentication switch to determine whether access authentication is currently performed based on the state of the authentication switch.

[0116] In one embodiment, when the processor implements determining whether authentication access is currently being performed according to the state of the authentication switch, it is further configured to implement:

[0117] If it is determined that the state of the authentication switch is on, it is determined that access authentication is performed; if it is determined that the state of the authentication switch is off, it is determined that access authentication is not performed and the access request is released.

[0118] In one embodiment, when the processor implements determining the user identifier according to the identity information to query in the hotspot list according to the user identifier, it is further configured to implement:

[0119] Obtain the login account and account information contained in the identity information to obtain the current corresponding user ID; obtain the pre-recorded user cache and determine whether the user ID exists in the user cache; if it is determined that the user ID exists in the user cache, query the hotspot list based on the user ID.

[0120] In one embodiment, after implementing the query in the hotspot list based on the user identifier if it is determined that the user identifier exists in the user cache, the processor is further configured to implement:

[0121] When a corresponding first resource identifier set is obtained in the hotspot list based on the user identifier, the first resource identifier set is compared with the request resource identifier contained in the identity information; if it is determined that the request resource identifier exists in the first resource identifier set, it is determined to respond to the access request; if it is determined that the request resource identifier does not exist in the first resource identifier set, it is determined not to respond to the access request.

[0122] In one embodiment, when the processor implements obtaining the standard resource identifier corresponding to the access request according to the identity information, it is further configured to implement:

[0123] Identify the requested resource identifier contained in the identity information and the component type corresponding to the requested resource identifier; segment the requested resource identifier according to the component type to obtain the standard resource identifier corresponding to the access request.

[0124] In one embodiment, when the processor implements obtaining the standard resource identifier corresponding to the access request according to the identity information, it is further configured to implement:

[0125] Acquire a system identifier to obtain a standard resource identifier according to the system identifier and the user identifier;

[0126] The determining whether to respond to the access request according to the standard resource identifier includes:

[0127] Obtain a user role cache list, and determine whether there is a corresponding role identifier based on the standard resource identifier, so as to obtain the corresponding target role identifier when it is determined that there is a corresponding role identifier; query the role resource cache list based on the target role identifier and the service identifier included in the identity information to determine whether there is a corresponding resource identifier; when it is determined that there is a corresponding resource identifier, match the corresponding resource identifier with the request resource identifier included in the identity information to determine whether to respond to the access request based on the matching result; wherein, if there is a match for the request resource identifier in the corresponding resource identifier, it is determined to respond to the access request; and if there is no match for the request resource identifier in the corresponding resource identifier, it is determined not to respond to the access request.

[0128] A computer-readable storage medium is also provided in an embodiment of the present application. The computer-readable storage medium stores a computer program. The computer program includes program instructions. The processor executes the program instructions to implement any access request authentication method provided in the embodiment of the present application.

[0129] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.

[0130] Furthermore, the computer-readable storage medium may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function, etc.; the data storage area may store data created according to the use of the blockchain node, etc.

[0131] In addition, the blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0132] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for authenticating an access request, characterized in that: The method comprises: Receiving an access request and identifying identity information contained in the access request; Querying the service cache according to the identity information to determine whether access authentication is currently being performed; If it is determined that access authentication is currently being performed, determining a user identifier according to the identity information, and querying in a hotspot list according to the user identifier; When it is determined that the hotspot list does not contain the resource identifier corresponding to the user identifier, obtaining the standard resource identifier corresponding to the access request according to the identity information; determining whether to respond to the access request according to the standard resource identifier; Wherein, the method further comprises: When the system is upgrading services, the control authentication switch is in the off state; The querying in the service cache according to the identity information to determine whether to perform access authentication currently includes: Obtaining a service identifier contained in the identity information, and determining whether the service identifier exists in a preset service cache; If it is determined that the service identifier exists in the service cache, the state of the authentication switch is determined to determine whether access authentication is currently performed according to the state of the authentication switch.

2. The method according to claim 1, characterized in that The determining whether to perform authentication access currently according to the state of the authentication switch includes: If it is determined that the state of the authentication switch is on, then determining to perform access authentication; If it is determined that the state of the authentication switch is off, it is determined that no access authentication is performed and the access request is released.

3. The method according to claim 1, characterized in that The determining the user identifier according to the identity information, and querying in the hotspot list according to the user identifier, includes: Obtain the login account and account information contained in the identity information to obtain the current corresponding user identification; Obtaining a pre-recorded user cache, and determining whether the user identifier exists in the user cache; If it is determined that the user identifier exists in the user cache, a query is performed in the hotspot list based on the user identifier.

4. The method according to claim 3, characterized in that If it is determined that the user identifier exists in the user cache, after searching in the hotspot list based on the user identifier, the method further includes: When a corresponding first resource identifier set is obtained in the hotspot list based on the user identifier, comparing the first resource identifier set with the request resource identifier included in the identity information; If it is determined that the requested resource identifier exists in the first resource identifier set, determining to respond to the access request; If it is determined that the requested resource identifier does not exist in the first resource identifier set, it is determined not to respond to the access request.

5. The method according to claim 1, characterized in that The obtaining, according to the identity information, a standard resource identifier corresponding to the access request includes: Identify the requested resource identifier contained in the identity information, and the component type corresponding to the requested resource identifier; The requested resource identifier is segmented according to the composition type, so as to obtain the standard resource identifier corresponding to the access request according to the obtained resource identifier.

6. The method according to claim 1, characterized in that The obtaining, according to the identity information, a standard resource identifier corresponding to the access request further includes: Acquire a system identifier to obtain a standard resource identifier according to the system identifier and the user identifier; The determining whether to respond to the access request according to the standard resource identifier includes: Obtaining a user role cache list, and determining whether a corresponding role identifier exists according to the standard resource identifier, so as to obtain a corresponding target role identifier when it is determined that a corresponding role identifier exists; According to the target role identifier and the service identifier included in the identity information, query in the role resource cache list to determine whether there is a corresponding resource identifier; When it is determined that there is a corresponding resource identifier, matching the corresponding resource identifier with the request resource identifier included in the identity information to determine whether to respond to the access request based on the matching result; Among them, if there is a matching item of the requested resource identifier in the corresponding resource identifier, it is determined to respond to the access request; and if there is no matching item of the requested resource identifier in the corresponding resource identifier, it is determined not to respond to the access request.

7. An access request authentication device, characterized in that: The device comprises: A request receiving module, used to receive an access request and identify the identity information contained in the access request; An authentication judgment module is used to query the service cache according to the identity information to determine whether access authentication is currently performed; An information query module, for determining a user identifier according to the identity information if it is determined that access authentication is currently being performed, so as to query a hotspot list according to the user identifier; An identification generation module, used for obtaining a standard resource identification corresponding to the access request according to the identity information when it is determined that the hotspot list does not contain a resource identification corresponding to the user identification; A response determination module, used to determine whether to respond to the access request according to the standard resource identifier; Wherein, the access request authentication device is also used for: When the system is upgrading services, the control authentication switch is in the off state; The authentication judgment module, when performing the query in the service cache according to the identity information to determine whether access authentication is currently performed, is further used to: Obtaining a service identifier contained in the identity information, and determining whether the service identifier exists in a preset service cache; If it is determined that the service identifier exists in the service cache, the state of the authentication switch is determined to determine whether access authentication is currently performed according to the state of the authentication switch.

8. A computer device, characterized in that: Including memory and processor: The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the access request authentication method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, one or more processors are caused to perform the steps of the access request authentication method according to any one of claims 1 to 6.

Images