Access control methods and devices

Abstract

This invention discloses a method and apparatus for access control, relating to the field of automatic programming technology. The method and apparatus are applied to an open service system, which provides at least one function, and the at least one function is divided into at least one functional layer. A specific embodiment of the method includes: receiving an access request sent by a third party; sequentially determining the target function of the third party in each functional layer according to a preset order; and performing access control on the third party based on the target function. This embodiment enables flexible control over multiple third parties with different access needs within the same open service system.

Description

Technical Field

[0001] This invention relates to the field of automatic programming technology, and in particular to a method and apparatus for access control. Background Technology

[0002] An open service system is a collection of services or page functions that developers release on their open platforms for third-party use. Service openness has become a new trend in internet development. Once a third party has obtained access to an open service system, they gain permission to access all functions within that service set or product set. If access to only certain business functions of the platform's products is permitted, a new open service system needs to be released for third parties to use. Therefore, within the same open service system, it is impossible to flexibly manage multiple third parties with different access needs. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a method and apparatus for access control, which can achieve flexible control over multiple third parties with different access requirements in the same open service system.

[0004] In a first aspect, embodiments of the present invention provide an access control method applied to an open service system, wherein the open service system provides at least one function, and the at least one function is divided into at least one functional layer, including:

[0005] Receive access requests from third parties;

[0006] According to a preset order, the target functions of the third party within the functional scope of each layer are determined sequentially;

[0007] Based on the target function, access control is implemented for the third party.

[0008] Optionally, it also includes:

[0009] Determine at least one orchestration function of the third party within the orchestration function scope, wherein the orchestration function scope is the smallest level of the function scope among the at least one level of function scope;

[0010] For each of the orchestration functions: determine at least one underlying service under the orchestration function, the at least one underlying service corresponding to the third party; determine the invocation order of the at least one underlying service; generate service orchestration parameters for the orchestration function based on the at least one underlying service and the invocation order;

[0011] The step of controlling access to the third party based on the target function includes:

[0012] Based on the target function and the service orchestration parameters, access control is performed on the third party.

[0013] Optionally, before determining the invocation order of the at least one underlying service, the method further includes:

[0014] Determine the calling mode of the orchestration function, the calling mode including: parallel and serial;

[0015] If the calling mode is serial, then the step of determining the calling order of the at least one underlying service is performed.

[0016] Optionally, after determining at least one orchestration function of the third party within the scope of orchestration functions, the method further includes:

[0017] The process objective and / or interruption condition of the orchestration function are determined, and the process objective and the interruption condition are used to control the execution of the at least one underlying service.

[0018] Optionally, it also includes:

[0019] Determine the control type of the third party;

[0020] The step of controlling access to the third party based on the target function includes:

[0021] Based on the target function and the control type, the third party's access is controlled.

[0022] Optionally, the control type includes: service mode type, which includes: page-based mode and interface-based mode;

[0023] The step of controlling access to the third party based on the target function and the control type includes:

[0024] Based on the target function and the service mode type, access control is implemented for the third party.

[0025] Optionally, the control type includes: transaction element type;

[0026] Determining the control type of the third party includes:

[0027] Determine the type of transaction element of the third party;

[0028] The step of controlling access to the third party based on the target function and the control type includes:

[0029] Based on the target function and the transaction element type, the third party's access is controlled.

[0030] Optionally, after determining the transaction element type of the third party, the method further includes:

[0031] Based on the transaction element type, set up a blacklist or whitelist for the transaction element;

[0032] The step of controlling access to the third party based on the target function and the transaction element type includes:

[0033] Based on the target function and the blacklist / whitelist of transaction elements, access control is exercised over the third party.

[0034] Optionally, the step of controlling access to the third party based on the target function includes:

[0035] Based on the target function, determine the open product parameters of the third party;

[0036] Based on the control type, determine the instantiation parameters of the third party's partner;

[0037] Based on the open product parameters and the instantiation parameters of the partner, determine the dynamic assembly parameters of the third party;

[0038] The third party is subject to access control based on the dynamic assembly parameters.

[0039] Optionally, the open product parameters include at least one of the following: product function level definition parameters, partner product function parameters, and partner product function service orchestration parameters.

[0040] Optionally, the partner instantiation parameters include: partner instantiation parameters, which include at least one of the following: partner control parameters, partner access mode parameters, and partner transaction element control parameters.

[0041] Optionally, the step of controlling access to the third party based on the target function includes:

[0042] Receive the access request sent by the third party;

[0043] Load the function entry corresponding to the target function on the response interface corresponding to the access request;

[0044] The response interface is displayed to the third party.

[0045] Secondly, embodiments of the present invention provide an access control device applied to an open service system, wherein the open service system provides at least one function, and the at least one function is divided into at least one functional layer, including:

[0046] The request receiving module is used to receive access requests sent by third parties;

[0047] The function determination module is used to determine the target functions of the third party within the functional scope of each layer in a preset order;

[0048] The access control module is used to control the access permissions of the third party based on the target function.

[0049] Thirdly, embodiments of the present invention provide an electronic device, including:

[0050] one or more processors;

[0051] Storage device for storing one or more programs.

[0052] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any of the above embodiments.

[0053] Fourthly, embodiments of the present invention provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the methods described in any of the above embodiments.

[0054] One embodiment of the above invention has the following advantages or beneficial effects: it determines the target functions of a third party within each functional scope of the open service system, and manages the third party's access permissions based on these target functions. Different functions can be selected for a third party within the functional scope of the open service system according to their different access needs, thereby achieving access control over the third party through the corresponding functions. Therefore, it is possible to achieve flexible management of multiple third parties with different access needs within the same open service system.

[0055] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0056] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0057] Figure 1 This is a schematic diagram illustrating an application scenario of an access control method provided in one embodiment of the present invention;

[0058] Figure 2 This is a schematic diagram of the flow of an access control method provided in an embodiment of the present invention;

[0059] Figure 3 This is a schematic diagram of a product control scope model provided in one embodiment of the present invention;

[0060] Figure 4 This is a schematic diagram of the flow of a functional orchestration method provided in an embodiment of the present invention;

[0061] Figure 5 This is a schematic diagram of the flow of another access control method provided in an embodiment of the present invention;

[0062] Figure 6 This is a schematic diagram of the process of a third-party control type configuration method provided in an embodiment of the present invention;

[0063] Figure 7 This is a flowchart illustrating a method for determining dynamic assembly parameters of a third party, provided in an embodiment of the present invention.

[0064] Figure 8 This is a schematic diagram of a third-party control process provided in one embodiment of the present invention;

[0065] Figure 9 This is a schematic diagram of the architecture of an access control system provided in one embodiment of the present invention;

[0066] Figure 10 This is a schematic diagram of the structure of an access control device provided in one embodiment of the present invention;

[0067] Figure 11 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0068] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0069] With the increasing maturity of mobile internet technology and the continuous development and transformation of internet finance technology, service openness has become a new trend in internet finance development. For example, commercial bank open banking management platforms, or open banking for short, release existing core financial services of commercial banks, such as account opening, settlement options, and investment management, to the public in the form of standard SDKs (Software Development Kits) or APIs (Application Programming Interfaces). This provides third-party partners with standardized and convenient access and professional financial services. By packaging financial services into products according to business functions for third-party partners to access and use, professional financial services are provided to customers, creating an integrated, immersive financial ecosystem.

[0070] To facilitate understanding of the methods in the embodiments of the present invention, the following explanations are based on the open service system provided by commercial banks. It should be noted that those skilled in the art should recognize that the scope of the present invention is not limited to the development service system provided by commercial banks.

[0071] It should be noted that in the embodiments of the present invention, the terms "cooperation party" and "third party" have the same meaning, both referring to relevant users or organizations accessing the open service system.

[0072] Existing commercial banks typically only manage services at the product level for their partners. Open platform products refer to a set of services released by the product project team on an open platform. This set of services should be able to independently complete a full business process. For example, for a government platform app, if it needs to provide wallet activation, payment, and billing functions for government agencies or certain entities, then government wallet-related products would be made available externally; for agricultural and rural ecological scenarios, if it needs to provide farmers with full-process account services, then rural ecological-related products would be made available externally. The management of developed service systems mainly includes two aspects: access control and security control.

[0073] Access control primarily refers to the management of third-party access by open banks based on predefined open platform products. For example, if an existing open platform product A includes services a1, a2, and a3, then when partner X applies for product A, they have the permission to access business functions a1, a2, and a3 simultaneously. If the business department wants partner X to only be allowed to access business functions a1 and a2, and partner Y to only be allowed to access business functions a2 and a3, then a new open banking platform product B containing only business functions a1 and a2 must be released for partner X, and a new open banking platform product C containing only business functions a2 and a3 must be released for partner Y.

[0074] Security control primarily targets third parties accessing specific services of open banking products, involving message encryption / decryption, traffic control, and certificate authentication. The process is as follows: when a third party calls a commercial bank's interface, the open banking gateway authenticates the third party's legitimacy using certificates and the merchant's public / private keys. Then, it encrypts the third party's message before making the internal service call, de-identifies sensitive fields, and finally encrypts the response message before forwarding it to the third party.

[0075] While existing third-party governance methods based on open banking products can basically meet business needs, they have the following drawbacks:

[0076] Access control at the product level cannot achieve layered control based on business domains. For example, a certain open banking product aims to provide a range of banking financial services to third-party platforms, such as account services, bill payment, and investment management products and services. When a third party applies to use the product, even if the application scenario they need to build only includes account services and bill payment, they are accessing the full range of services of the product. It is difficult to distinguish between different service modules of different business functions, and therefore it is impossible to release customizable business functions for different third parties under the same open banking product.

[0077] The controllable dimensions for partners are limited. Although open banking implements access control for partners based on product dimensions, the control dimensions are limited. For example, if a product completes scenario and service registration through open banking, open banking cannot implement detailed control over the product's H5 page output or interface output, nor can it control partner access based on specific transaction elements (such as account information or customer information).

[0078] This can easily lead to the creation of redundant open banking products. Since it's impossible to provide customizable products for different partners, strictly controlling access permissions for partners means that business departments need to register or define new similar products, and the technical team needs to rebuild the new product SDK and provide it to third parties. This not only complicates the application and registration process but also requires extensive business impact testing, extending the project implementation cycle.

[0079] Service calls rely on third parties, making business process control impossible. A complete business process typically requires the collaboration of multiple services. For example, opening an account with a third party involves a combination of services, including account pre-screening, SMS sending, customer information creation, SMS verification, and account opening. Because the overall service integration depends on a third party, there is a risk that the order of service calls could be maliciously altered (e.g., directly opening an account).

[0080] In view of the many problems existing in the existing open service system, the embodiments of the present invention provide an access control method that can solve the problems in the existing open service system.

[0081] Figure 1 This is a schematic diagram illustrating an application scenario of an access control method provided by an embodiment of the present invention. For example... Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. Network 104 is a medium for providing communication links between terminal devices 101, 102, 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0082] The service deployed on server 105 is open, and multiple third parties can access server 105 through terminal devices 101, 102, and 103. Terminal devices 101, 102, and 103 can be mobile phones, laptops, servers, tablets, laptop computers, etc.

[0083] The open service system deployed on server 105 provides at least one function, which is divided into at least one functional layer. Server 105 receives access requests sent by third parties, sequentially determines the target function of the third party in each functional layer, and performs access control on different third parties according to the target function.

[0084] It should be noted that the permission control method provided in this embodiment of the invention is generally executed by server 105, and correspondingly, the permission control device is generally set in server 105.

[0085] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0086] Figure 2 This is a schematic diagram of the flow of an access control method provided in an embodiment of the present invention, as shown below. Figure 2 As shown, the method includes:

[0087] Step 201: Receive an admission request sent by a third party.

[0088] The access control method provided in this invention is applied to an open service system. An open service system is a set of services or page functions published by a developer on its open platform and available for use by third parties.

[0089] Step 202: Determine the target functions of the third party in each functional scope according to the preset order.

[0090] An open service system provides at least one function, which is divided into at least one functional level. Each higher-level function can be divided into at least one lower-level function. The smallest functional level can correspond to at least one underlying service.

[0091] Figure 3 This is a schematic diagram of a product control scope model provided in one embodiment of the present invention. After a third party has completed the product access process, the control scope of the third-party product can be defined with the smallest level of functionality provided by the open service system as the smallest granularity. This includes determining the control level and the service division for each level.

[0092] like Figure 3As shown, taking a specific open banking product as an example, it provides a series of banking financial services to third-party platforms. These can be broadly categorized into account services, payment functions, and investment and wealth management functions. Account services can be further subdivided into sub-functions such as account opening, top-up, withdrawal, balance inquiry, and transaction history inquiry. Payment functions are further refined into sub-functions such as bill payment, e-custody, and general payment. Based on the above, the functional scope provided by the open service system is determined to be two layers.

[0093] First, define the service scope of the first-tier functionality. This product comprises three main functional modules: account services, bill payment, and investment management. For example, for third party X, configure them to only allow access to the account services product, while for third party Y, configure them to allow access to both the account services and bill payment products.

[0094] Next, define the service scope of the second-tier functions. Account services can be divided into three sub-modules: account opening, inquiry, and account management. Payment services are divided into three sub-modules: corporate payment, personal payment, and general payment. Investment and wealth management are divided into two sub-modules: funds and deposits. For the same account service function, configure third party X to allow access to account opening and balance inquiry functions under the account service product; and configure third party Y to allow access to account opening, deposit / withdrawal, balance inquiry, and transaction history inquiry functions under that product.

[0095] Regarding the definition of the scope of control for third-party products, once a third party has selected the target functions within each functional scope of the same open service system, different third parties can use the defined level for access without needing to define it repeatedly.

[0096] Step 203: Implement access control for third parties based on the target functions.

[0097] In this embodiment of the invention, the target functions of a third party within each functional scope of the open service system are determined, and access control is implemented for the third party based on these target functions. Different functions can be selected for the third party within the functional scope of the open service system according to their different access needs, thereby achieving access control over the third party through the corresponding functions. Therefore, this solves the technical problem of not being able to flexibly manage multiple third parties with different access needs within the same open service system.

[0098] In one embodiment of the present invention, the method further includes the following after step 202:

[0099] Identify at least one orchestration function of a third party within the orchestration function scope, where the orchestration function scope is the smallest level of the function scope in at least one function scope.

[0100] For each orchestration function: identify at least one underlying service under the orchestration function, with at least one underlying service corresponding to a third party; determine the invocation order of at least one underlying service; and generate service orchestration parameters for the orchestration function based on at least one underlying service and its invocation order.

[0101] Based on the target functionality, implement access control for third parties, including:

[0102] Access control is implemented for third parties based on target functions and service orchestration parameters.

[0103] Depending on different business requirements, different functional orchestrations can be achieved by orchestrating pre-written underlying services. Functional orchestration can enhance code reusability, reduce software development and testing costs, improve software maintainability, and reduce maintenance costs.

[0104] In one embodiment of the present invention, before determining the invocation order of at least one underlying service, the method further includes:

[0105] Determine the calling mode of the orchestration function, including parallel and serial calling modes;

[0106] If the call mode is serial, then the steps to determine the call order of at least one underlying service are performed.

[0107] If the invocation mode is parallel, the multiple underlying services corresponding to the function can be executed in parallel without needing to determine the invocation order for these services. If the invocation mode is serial, the multiple underlying services corresponding to the function can be executed serially, but the invocation order for these services needs to be determined to control their execution in a preset order.

[0108] In one embodiment of the present invention, after determining at least one orchestration function of a third party within the scope of orchestration functions, the method further includes:

[0109] Define the process objectives and / or interruption conditions for the orchestration function. The process objectives and interruption conditions are used to control the execution of at least one underlying service.

[0110] Figure 4 This is a schematic diagram illustrating the flow of a function orchestration method according to an embodiment of the present invention. For product functions that have been divided, service orchestration is performed to determine the service call order. The granularity of orchestration is the smallest level of product functions divided.

[0111] Taking the product functions categorized at the highest level as an example, the second-level product functions represent the smallest granularity. Under the account service function, there are three sub-functions: account opening, balance inquiry, and deposit / withdrawal. Taking account opening as an example, the service is orchestrated as follows: 1. Account opening pre-check; 2. Facial recognition and customer information establishment; 3. Account opening SMS sending; 4. Account opening SMS verification and account opening. This service call sequence is used as an executable process to coordinate internal and external service interactions.

[0112] For third-party service orchestration, once an open banking product has completed its service orchestration, different third-party accesses are directly controlled by it and do not need to be orchestrated repeatedly.

[0113] Figure 5 This is a schematic diagram of the flow of another access control method provided in an embodiment of the present invention, as shown below. Figure 5 As shown, the method includes:

[0114] Step 501: Receive an access request sent by a third party.

[0115] The access control method provided in this invention is applied to an open service system. An open service system is a set of services or page functions published by a developer on its open platform and available for use by third parties.

[0116] Step 502: Determine the control type for the third party.

[0117] Control types can include: service mode type, transaction element type, etc. Among them, service mode type can include: page-based mode and interface-based mode.

[0118] If the service mode type is page mode, then only page mode output is allowed for service products for this third-party account. If the service mode type is API mode, then only API mode output is allowed for service products for this third-party account.

[0119] In one embodiment of the present invention, after determining the transaction element type of the third party, the method further includes:

[0120] Set up blacklists and whitelists for transaction elements based on their types;

[0121] Based on the target function and transaction element type, implement access control for third parties, including:

[0122] Access control for third parties is implemented based on blacklists and whitelists of target functions and transaction elements.

[0123] Transaction elements are information related to third-party accounts, such as mobile phone number, account name, institution, and region. Blacklists and whitelists can be set according to the type of transaction elements, and access to the open service platform by third parties can be controlled based on the blacklists and whitelists, allowing only relevant accounts on the whitelist or those not on the blacklist to access the platform.

[0124] Step 503: Implement access control for third parties based on the control type.

[0125] Figure 6 This is a schematic diagram illustrating the flow of a third-party control type configuration method provided in an embodiment of the present invention. Figure 6 As shown, after defining the product scope of the partner, it is necessary to configure the partner control type. This control type is divided into two categories: service model type and transaction element type.

[0126] Partner service mode type control can be divided into partner management based on page mode and partner management based on API mode. After defining the service function hierarchy scope as described above, configure the corresponding control type for different partner service mode outputs. For example, if partner X only allows page mode output for the account service product, then accessing the product via API mode by this partner should be rejected.

[0127] Partner transaction element type control allows for flexible setting of transaction control elements based on different partners. For example, for partner X, mobile phone number can be set as a transaction control element; for partner Y, customer information can be set as a transaction control element. Furthermore, blacklists and whitelists can be set up in conjunction with specific transaction elements to achieve effective control. For instance, when partner transaction element control is set to a mobile phone number whitelist mode, if a partner submits an unidentifiable mobile phone number during a transaction, access to the product will be prohibited through transaction rejection or transaction alerts.

[0128] In one embodiment of the present invention, access control for third parties is performed according to the target function, including:

[0129] Based on the target functionality, determine the parameters of the third-party open products;

[0130] Determine the instantiation parameters of the third-party partner based on the control type;

[0131] Based on the open product parameters and the instantiation parameters of the partner, determine the dynamic assembly parameters of the third party;

[0132] Access control is implemented for third parties based on dynamic assembly parameters.

[0133] Based on the specific access requirements of each third party, the target functions and control types corresponding to that third party can be set. Access control for third parties can then be implemented using dynamically configured parameters that characterize the target functions and control types, achieving the technical effect of flexible control over different third parties within the same open service platform.

[0134] In one embodiment of the present invention, the open product parameters include at least one of the following: product function level definition parameters, partner product function parameters, and partner product function service orchestration parameters.

[0135] In one embodiment of the present invention, the partner instantiation parameters include: partner instantiation parameters, which include at least one of the following: partner control parameters, partner access mode parameters, and partner transaction element control parameters.

[0136] Figure 7 This is a flowchart illustrating a method for determining third-party dynamic assembly parameters according to an embodiment of the present invention. Figure 7 As shown, after completing the above steps, the parameters can be loaded into the partner product parameter configuration library through a dynamic assembly mode, and applied as instantiated product parameters for each partner. The partner product parameter configuration library mainly contains two types:

[0137] Open banking product parameters include: partner product function level definition parameters (defining the level of product functions), partner product function parameters (the specific service content of each level), partner product function service orchestration (orchestrending services for the defined product functions), etc.

[0138] Partner instantiation parameters: Partner control parameters (product function permissions a partner has), Partner access mode parameters (page mode / interface mode, etc.), Partner transaction element control parameters (the transaction elements a partner needs to manage).

[0139] In addition, the definition of the scope of products and control types of partners can be queried and maintained by the business department after the business department has reviewed and approved the product and completed the installation.

[0140] Once the target functions and / or control types of the third party are determined, control over the third party can be achieved through various methods. Figure 8 This is a schematic diagram illustrating a third-party control process provided in one embodiment of the present invention. For example... Figure 8 As shown, when a third-party platform requests access to a packaged product of an open bank, after completing the assembly of the partner's control information, a customizable control process based on different partners can be realized.

[0141] For example, it can receive access requests from third parties; load the function entry point corresponding to the target function on the response interface corresponding to the access request; and display the response interface to the third party. This achieves the goal of allowing the third party to only access preset accessible functions.

[0142] Taking a certain open banking product as an example, it provides a series of banking financial services to third-party platforms, including account services, bill payment, investment and wealth management products. Currently, three third-party platforms, X, Y, and Z, are connected to commercial banks.

[0143] Through configuration, this third party X is only allowed to access account service products and investment and wealth management products, and the product SDK is configured to output to third party X in a page mode. Therefore, when the third party accesses the commercial bank's H5 page through open banking, the H5 page first dynamically loads the entry points for account service products and investment and wealth management products by accessing the third party's control parameters. Upon redirection to the corresponding product H5 page, it verifies the third party's control elements; if successful, the corresponding function interface is displayed; otherwise, the transaction is rejected.

[0144] Through configuration, third-party Y is only allowed to access account service products. The product's SDK is configured to output to third-party Y via an interface, and a blacklist of mobile phone numbers is maintained for transaction control. When third-party Y calls the account opening service, if the customer's mobile phone number is within the blacklist, the transaction is rejected; otherwise, it succeeds. If the service call process is tampered with by hackers to directly perform batch account openings (bypassing pre-screening and facial recognition), the service is rejected; otherwise, the service call is completed successfully according to the normal process.

[0145] If third party Z is only allowed to access the account opening and balance inquiry functions of the account service product, the product SDK outputs to third party Z using an interface mode. When third party Z calls the account service product's deposit and withdrawal interface through open banking, the account service product will refuse third party access if the third party's control elements do not meet business requirements.

[0146] Figure 9 This is a schematic diagram of the architecture of an access control system provided in one embodiment of the present invention. Figure 9 As shown, this partner management mechanism consists of five parts: defining the scope of partner product management, orchestrating partner services, configuring partner management types, dynamically assembling partner products, and managing partners. Through the combination of these five parts, the entire process from product definition and parameterized configuration to partner management is realized after a third party accesses an open banking product.

[0147] The definition of the scope of control for partner products is used to determine the target functions of the third party within each functional scope. Please refer to the appendix of the instruction manual. Figure 3 .

[0148] Partner service orchestration is used to determine at least one underlying service under the orchestration function and to determine the invocation order of at least one underlying service. Please refer to the appendix of the specification for details. Figure 4 .

[0149] The Partner Control Type Configuration is used to determine the control type for third parties. Control types may include: service model type, transaction element type, etc., please refer to the appendix of the instruction manual. Figure 6 .

[0150] The partner product dynamic assembly feature is used to store the dynamic assembly parameters of third parties. These parameters can be used to characterize relevant information about target functions and control types. Please refer to the appendix of the instruction manual for details. Figure 7 .

[0151] Partner control is used to manage third parties based on their corresponding target functions and / or control types. Please refer to the appendix of the instruction manual. Figure 8 .

[0152] In this embodiment of the invention, the partner management mechanism of the flexibly configurable service open system mainly consists of five parts: partner product management scope definition, partner service orchestration, partner management type configuration, partner product dynamic assembly, and partner management. It realizes the entire process from product definition and parameterized configuration to partner management after a third party accesses the open banking product.

[0153] In addition, the flexible configuration of the service open system’s partner management mechanism allows for flexible stratification and self-definition of the partner product management scope based on actual business conditions; the partner management type configuration includes partner service model control and partner transaction element control.

[0154] Furthermore, the system offers flexible service process control, allowing for autonomous service orchestration to determine the order of service calls. Orchestration granularity is defined at the smallest level of product functionality. For partner service orchestration, once a functional product within a service open system has completed its orchestration, different partners can directly access and control the system without requiring repeated orchestration.

[0155] In addition, the partner management of the service open system is designed based on the characteristics of open products. When setting parameters, it takes into account different effects of business management and the user-friendliness of customer prompts, while also having horizontal and vertical scalability.

[0156] Figure 10 This is a schematic diagram of the structure of an access control device provided in one embodiment of the present invention. Figure 10 As shown, this is applied to an open service system, which provides at least one function, and this function is divided into at least one functional layer, including:

[0157] The request receiving module 1001 is used to receive access requests sent by third parties;

[0158] The function determination module 1002 is used to determine the target functions of the third party in each functional scope according to a preset order;

[0159] The access control module 1003 is used to control access to third parties based on the target function.

[0160] Optionally, it also includes:

[0161] The function orchestration module 1004 is used to determine at least one orchestration function of a third party within the orchestration function scope, wherein the orchestration function scope is the smallest level of the function scope in at least one level of function scope;

[0162] For each orchestration function: identify at least one underlying service under the orchestration function, with at least one underlying service corresponding to a third party; determine the invocation order of at least one underlying service; and generate service orchestration parameters for the orchestration function based on at least one underlying service and its invocation order.

[0163] The access control module 1003 is specifically used for:

[0164] Access control is implemented for third parties based on target functions and service orchestration parameters.

[0165] Optionally, it also includes:

[0166] The mode determination module 1005 is used to determine the calling mode of the orchestration function. The calling modes include parallel and serial.

[0167] Optionally, it also includes:

[0168] The condition determination module is used to determine the process objectives and / or interruption conditions of the orchestration function. The process objectives and interruption conditions are used to control the execution of at least one underlying service.

[0169] Optionally, it also includes:

[0170] The type determination module 1006 is used to determine the control type of a third party;

[0171] The access control module 1003 is specifically used for:

[0172] Access control is implemented for third parties based on the target function and control type.

[0173] Optionally, the control type includes: service mode type, which includes: page-based mode and interface-based mode;

[0174] The access control module 1003 is specifically used for:

[0175] Access control is implemented for third parties based on the target function and service model type.

[0176] Optionally, the control type includes: transaction element type;

[0177] The access control module 1003 is specifically used for:

[0178] Access control is implemented for third parties based on the target function and the type of transaction elements.

[0179] Optionally, it also includes:

[0180] The list setting module 1007 is used to set up blacklists and whitelists for transaction elements based on the type of transaction element.

[0181] The access control module 1003 is specifically used for:

[0182] Access control for third parties is implemented based on blacklists and whitelists of target functions and transaction elements.

[0183] Optionally, the access control module 1003 is specifically used for:

[0184] Based on the target functionality, determine the parameters of the third-party open products;

[0185] Determine the instantiation parameters of the third-party partner based on the control type;

[0186] Based on the open product parameters and the instantiation parameters of the partner, determine the dynamic assembly parameters of the third party;

[0187] Access control is implemented for third parties based on dynamic assembly parameters.

[0188] Optionally, the open product parameters include at least one of the following: product function level definition parameters, partner product function parameters, and partner product function service orchestration parameters.

[0189] Optionally, the partner instantiation parameters include: partner instantiation parameters, which include at least one of the following: partner control parameters, partner access mode parameters, and partner transaction element control parameters.

[0190] Optionally, the access control module 1003 is specifically used for:

[0191] Receive access requests sent by third parties;

[0192] Load the function entry point corresponding to the target function on the response interface corresponding to the access request;

[0193] Display the response interface to third parties.

[0194] This invention provides an electronic device, comprising:

[0195] one or more processors;

[0196] Storage device for storing one or more programs.

[0197] When one or more programs are executed by one or more processors, the one or more processors implement the methods of any of the above embodiments.

[0198] The following is for reference. Figure 11 It shows a schematic diagram of the structure of a computer system 1100 suitable for implementing a terminal device of the present invention. Figure 11 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0199] like Figure 11 As shown, the computer system 1100 includes a central processing unit (CPU) 1101, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 1102 or programs loaded from storage section 1108 into random access memory (RAM) 1103. The RAM 1103 also stores various programs and data required for the operation of the system 1100. The CPU 1101, ROM 1102, and RAM 1103 are interconnected via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0200] The following components are connected to I / O interface 1105: an input section 1106 including a keyboard, mouse, etc.; an output section 1107 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN card, modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to I / O interface 1105 as needed. Removable media 1111, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1110 as needed so that computer programs read from them can be installed into storage section 1108 as needed.

[0201] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1109, and / or installed from removable medium 1111. When the computer program is executed by central processing unit (CPU) 1101, it performs the functions defined above in the system of this invention.

[0202] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0203] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0204] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be located in a processor, and for example, can be described as: a request receiving module, a function determination module, and an access control module. The names of these modules do not necessarily limit the module itself; for example, the request receiving module can also be described as "a module that receives access requests sent by a third party."

[0205] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include:

[0206] Receive access requests from third parties;

[0207] According to a preset order, the target functions of the third party within the functional scope of each layer are determined sequentially;

[0208] Based on the target function, access control is implemented for the third party.

[0209] According to the technical solution of this invention, the target functions of a third party within each functional scope of an open service system are determined, and access control is implemented for the third party based on these target functions. Different functions can be selected for a third party within the functional scope of the open service system based on their different access needs, thereby achieving access control for the third party through the corresponding functions. Therefore, flexible management of multiple third parties with different access needs can be achieved within the same open service system.

[0210] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for controlling access permissions, characterized in that, Applied to an open service system, wherein the open service system provides at least one function, the at least one function is divided into at least one functional scope, and is a set of services or page functions available to third parties, the method includes: Receive access requests from third parties; According to a preset order, the target functions of the third party in each layer of the functional scope are determined sequentially; at least one orchestration function of the third party in the orchestration functional scope is determined, wherein the orchestration functional scope is the smallest level of the functional scope in the at least one layer of functional scope; for each orchestration function: at least one underlying service under the orchestration function is determined, wherein the at least one underlying service corresponds to the third party; the invocation order of the at least one underlying service is determined; and service orchestration parameters of the orchestration function are generated according to the at least one underlying service and the invocation order. Based on the target function and the service orchestration parameters, access control is performed on the third party.

2. The method according to claim 1, characterized in that, Before determining the invocation order of the at least one underlying service, the method further includes: Determine the calling mode of the orchestration function, the calling mode including: parallel and serial; If the calling mode is serial, then the step of determining the calling order of the at least one underlying service is performed.

3. The method according to claim 1, characterized in that, After determining at least one orchestration function of the third party within the scope of orchestration functions, the method further includes: The process objective and / or interruption condition of the orchestration function are determined, and the process objective and the interruption condition are used to control the execution of the at least one underlying service.

4. The method according to claim 1, characterized in that, Also includes: Determine the control type of the third party; The step of controlling access to the third party based on the target function includes: Based on the target function and the control type, the third party's access is controlled.

5. The method according to claim 4, characterized in that, The control type includes: service mode type, which includes: page-based mode and interface-based mode; The step of controlling access to the third party based on the target function and the control type includes: Based on the target function and the service mode type, access control is implemented for the third party.

6. The method according to claim 4, characterized in that, The control types include: transaction element types; Determining the control type of the third party includes: Determine the type of transaction element of the third party; The step of controlling access to the third party based on the target function and the control type includes: Based on the target function and the transaction element type, the third party's access is controlled.

7. The method according to claim 6, characterized in that, After determining the transaction element type of the third party, the process further includes: Based on the transaction element type, set up a blacklist or whitelist for the transaction element; The step of controlling access to the third party based on the target function and the transaction element type includes: Based on the target function and the blacklist / whitelist of transaction elements, access control is exercised over the third party.

8. The method according to claim 4, characterized in that, The step of controlling access to the third party based on the target function includes: Based on the target function, determine the open product parameters of the third party; Based on the control type, determine the instantiation parameters of the third party's partner; Based on the open product parameters and the instantiation parameters of the partner, determine the dynamic assembly parameters of the third party; The third party is subject to access control based on the dynamic assembly parameters.

9. The method according to claim 8, characterized in that, The open product parameters include at least one of the following: product function level definition parameters, partner product function parameters, and partner product function service orchestration parameters.

10. The method according to claim 8, characterized in that, The partner instantiation parameters include: partner instantiation parameters, which include at least one of the following: partner control parameters, partner access mode parameters, and partner transaction element control parameters.

11. The method according to claim 1, characterized in that, The step of controlling access to the third party based on the target function includes: Receive the access request sent by the third party; Load the function entry corresponding to the target function on the response interface corresponding to the access request; The response interface is displayed to the third party.

12. An access control device, characterized in that, Applied to an open service system, the open service system provides at least one function, the at least one function is divided into at least one functional scope, and is a set of services or page functions available to third parties, the apparatus includes: The request receiving module is used to receive access requests sent by third parties; The function determination module is used to sequentially determine the target functions of the third party in each layer of the functional scope according to a preset order; determine at least one orchestration function of the third party in the orchestration functional scope, wherein the orchestration functional scope is the smallest level of the functional scope in the at least one layer of functional scope; for each orchestration function: determine at least one underlying service under the orchestration function, wherein the at least one underlying service corresponds to the third party; determine the calling order of the at least one underlying service; and generate service orchestration parameters for the orchestration function based on the at least one underlying service and the calling order. The access control module is used to control the access of the third party based on the target function and the service orchestration parameters.

13. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-11.

14. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-11.

Images