A permission control method and system

Abstract

The present invention discloses a permission control method and system, which configures resources that meet preset permission conditions, obtains resource configuration results and loads them into memory, parses the parameters string in the resource configuration results to obtain a Map structure corresponding to the resource configuration results, and when the server receives the request information sent by the user, searches the Map structure for a resource ID corresponding to the request information. If so, based on the pre-acquired role resources and user roles, it is determined whether the user has access rights to the resources containing the resource ID. If so, the server responds to the request information. Through the above scheme, permission control can be performed on each field of the resource, meeting the requirements for fine and flexible control of resource permission control, and improving the precision of resource permission control. In addition, the resource configuration results are loaded into the memory so that resources can be quickly retrieved during permission checking, thereby improving the efficiency of permission checking.

Description

Technical Field

[0001] The present invention relates to the technical field of authority control, and more specifically, to an authority control method and system. Background Art

[0002] Uniform Resource Locator (URL) is a method of indicating the location of information on the World Wide Web service program of the Internet, and different protocols have different formats.

[0003] When different users access a resource through an Http URL, it is necessary to control the access rights of the user to the resource to meet the security requirements of the system.

[0004] The permission control of existing resources can only be performed based on the Http path in the URL, so that the control method of the permission control of existing resources cannot achieve fine-grained permission control and cannot meet the requirements of fine and flexible control of resource permission control, thus making the permission control of existing resources low in precision. Summary of the invention

[0005] In view of this, the present invention discloses a permission control method and system to improve the precision of resource permission control. In addition, the resource configuration result is loaded into the memory so that the resource can be quickly retrieved during permission checking, thereby improving the efficiency of permission checking.

[0006] In order to achieve the above purpose, the technical contents disclosed in the present invention are as follows:

[0007] A first aspect of the present invention discloses a permission control method, the method comprising:

[0008] Configure resources that meet the preset permission conditions to obtain resource configuration results, wherein the resource configuration results at least include a parameters parameter string;

[0009] Load the resource configuration result into the memory, and parse the parameters string to obtain a Map structure corresponding to the resource configuration result;

[0010] When the server receives the request information sent by the user, it searches the Map structure to see whether there is a resource ID corresponding to the request information;

[0011] If so, based on the pre-acquired role resources and user roles, determine whether the user has access rights to the resource containing the resource ID;

[0012] If the user has access rights to the resource including the resource ID, the server is enabled to respond to the request information.

[0013] Preferably, the resource configuration result is loaded into the memory, and the parameters string is parsed to obtain a Map structure corresponding to the resource configuration result, including:

[0014] Create parsing result object authMap;

[0015] Traversing the resource configuration results, and loading the resource configuration results into memory;

[0016] The parameters string in the resource configuration result is parsed to obtain a parsing result, and the parsing result is stored in the parsing result object authMap to obtain a Map structure corresponding to the resource configuration result.

[0017] Preferably, the parsing of the parameters parameter string to obtain a parsing result, and storing the parsing result in the parsing result object authMap to obtain a Map structure corresponding to the resource configuration result includes:

[0018] Create an object of resource information resourceInfo;

[0019] Assign the resource ID to the object of the resource information resourceInfo;

[0020] Determine whether the parameter value of the parameters string in the resource configuration result is null;

[0021] If yes, store the assigned resource information resourceInfo object into the parsing result object authMap to obtain the Map structure corresponding to the resource configuration result;

[0022] If not, split the parameters parameter string based on the first preset splitting parameter to obtain a string array tokens;

[0023] Traversing each string token in the string array tokens, splitting each string token based on a second preset splitting parameter to obtain a string array strs;

[0024] Determine that the variable name paraName in the Map structure is the preset element value of the string array strs;

[0025] Determine whether the length of the string array strs is 2;

[0026] If the length of the string array strs is not 2, determine that the variable value paraValue is a null value;

[0027] If the length of the string array strs is 2, determine that the position index of the string array strs of the variable value paraValue is 1, and create a regular expression object paraValuePattern based on the variable value paraValue whose position index is 1 in the string array strs;

[0028] The variable name paraName and the regular expression object paraValuePattern are stored in the paramMap parameter of the resource information resourceInfo;

[0029] The resource information resourceInfo including the variable name paraName and the regular expression object paraValuePattern is stored in the parsing result object authMap to obtain a Map structure corresponding to the resource configuration result.

[0030] Preferably, the resource information resourceInfo including the variable name paraName and the regular expression object paraValuePattern is stored in the parsing result object authMap to obtain a Map structure corresponding to the resource configuration result, including:

[0031] Based on the path path of the resource, obtain the resource list resourceInfoList from the parsing result object authMap;

[0032] If the resource list resourceInfoList is null, a new object is created for the resource list resourceInfoList, and the key and value in the new object are stored in the parsing result object authMap to obtain a Map structure corresponding to the resource configuration result.

[0033] Preferably, judging whether the user has access rights to the resource containing the resource ID based on the pre-acquired role resource and user role includes:

[0034] Determine whether the resource ID is null;

[0035] If the resource ID is null, stop executing the access permission determination operation;

[0036] If the resource ID is not null, based on the pre-acquired role resources and user roles, determine whether the user has access rights to the resource containing the resource ID;

[0037] If the user has the user role and the user role has the resource ID, determining that the user has access rights to the resource containing the resource ID;

[0038] If the user does not have the user role, or the user role does not have the resource ID, it is determined that the user does not have access permission to the resource containing the resource ID.

[0039] Preferably, it also includes:

[0040] If the user does not have access rights to the resource containing the resource ID, an exception message is generated.

[0041] Preferably, before searching whether the resource ID corresponding to the request information exists in the Map structure, the method further includes:

[0042] Get the resource ID;

[0043] The process of obtaining the resource ID includes:

[0044] Split the URL string of the request information to obtain a path string urlPath;

[0045] Obtaining a resource list resourceInfoList from the parsing result object authMap based on the path string urlPath;

[0046] Determine whether the resource list resourceInfoList is null;

[0047] If the resource list resourceInfoList is null, stop executing the operation of obtaining the resource ID;

[0048] If the resource list resourceInfoList is not a null value, traverse each resource information resourceInfo in the resource list resourceInfoList, and determine whether each resource information resourceInfo matches the preset parameters of the request information;

[0049] If it matches, the resource ID is obtained;

[0050] If there is no match, it is determined that the resource ID is a null value, and the operation of obtaining the resource ID ends.

[0051] Preferably, traversing each resource information resourceInfo in the resource list resourceInfoList and determining whether each resource information resourceInfo matches a preset parameter of the request information includes:

[0052] Traverse the paramMap parameters of resource information resourceInfo;

[0053] Get the entry class of the paramMap parameter;

[0054] Determine whether the entry class is null;

[0055] If the entry class is null, determine that the return value of the entry class is true;

[0056] If the entry class is not null, determine that the variable name paraName in the request object is the key of the entry class, and the regular expression object paraValuePattern in the Map structure is the value of the entry class;

[0057] Get the parameter value reqParaValue of the variable paraName from the request object;

[0058] Determine whether the reqParaValue is null;

[0059] If the reqParaValue is null, the return value of reqParaValue is false;

[0060] If the reqParaValue is not null, determine whether the reqParaValue is an array;

[0061] If the reqParaValue is an array, determine whether each parameter of the reqParaValue matches the regular expression object paraValuePattern;

[0062] If each parameter of the reqParaValue does not match the regular expression object paraValuePattern, determining that the return value of the reqParaValue is false;

[0063] If the reqParaValue matches the regular expression object paraValuePattern, return to the step of obtaining the entry class of the paramMap until all entry classes in the paramMap are matched;

[0064] If the reqParaValue is not an array, determine whether the reqParaValue matches the regular expression object paraValuePattern;

[0065] If there is a match, return to the step of obtaining the entry class of the paramMap until all entry classes in the paramMap are matched;

[0066] If there is no match, the return value of the reqParaValue is determined to be false.

[0067] A second aspect of the present invention discloses an authority control system, the system comprising:

[0068] A configuration unit, configured for resources meeting preset permission conditions, to obtain resource configuration results, wherein the resource configuration results at least include a parameter string;

[0069] A loading and parsing unit, used to load the resource configuration result into a memory, and parse the parameters string to obtain a Map structure corresponding to the resource configuration result;

[0070] A search unit, configured to search the Map structure for a resource ID corresponding to the request information when the server receives the request information sent by the user;

[0071] A judging unit, configured to judge, if a resource ID corresponding to the request information exists in the Map structure, whether the user has access rights to the resource containing the resource ID based on the pre-acquired role resources and user roles;

[0072] The responding unit is configured to enable the server to respond to the request information if the user has access rights to the resource including the resource ID.

[0073] Preferably, the loading and parsing unit comprises:

[0074] Create a module and create the parsing result object authMap;

[0075] A loading module, used for traversing the resource configuration results and loading the resource configuration results into a memory;

[0076] The parsing module is used to parse the parameters string in the resource configuration result to obtain the parsing result, and store the parsing result in the parsing result object authMap to obtain the Map structure corresponding to the resource configuration result.

[0077] Through the above technical solution, it can be known that the resource configuration result is obtained by configuring the resources that meet the preset permission conditions. The resource configuration result at least includes the parameters parameter string. The resource configuration result is loaded into the memory, and the parameters parameter string is parsed to obtain the Map structure corresponding to the resource configuration result. When the server receives the request information sent by the user, it searches the Map structure for the resource ID corresponding to the request information. If it exists, based on the pre-acquired role resources and user roles, it is determined whether the user has access rights to the resource containing the resource ID. If so, the server responds to the request information. Through the above solution, permission control can be performed on each field of the resource to meet the fine and flexible control requirements of the permission control of the resource, and improve the precision of the permission control of the resource. In addition, the resource configuration result is loaded into the memory so that the resource can be quickly retrieved during the permission check, thereby improving the efficiency of the permission check. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0079] Figure 1 A flowchart of a permission control method disclosed in an embodiment of the present invention;

[0080] Figure 2 A schematic diagram of a process of obtaining a Map structure corresponding to a resource configuration result disclosed in an embodiment of the present invention;

[0081] Figure 3 A schematic diagram of another process of obtaining a Map structure corresponding to a resource configuration result disclosed in an embodiment of the present invention;

[0082] Figure 4 A schematic diagram of another process of obtaining a Map structure corresponding to a resource configuration result disclosed in an embodiment of the present invention;

[0083] Figure 5 A schematic diagram of a process for determining whether a user has access rights to a resource including a resource ID based on pre-acquired role resources and user roles disclosed in an embodiment of the present invention;

[0084] Figure 6 A schematic diagram of a process for obtaining a resource ID disclosed in an embodiment of the present invention;

[0085] Figure 7 A flowchart of a process for determining whether each resource information resourceInfo matches the preset parameters of the request information disclosed in an embodiment of the present invention;

[0086] Figure 8 A schematic diagram of the structure of a permission control system disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0087] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0088] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0089] As can be seen from the background technology, the permission control of existing resources can only be performed based on the Http path in the URL, so that the control method of the permission control of existing resources cannot achieve fine-grained permission control and cannot meet the requirements of fine and flexible control of resource permission control, thus making the permission control of existing resources low in precision.

[0090] In order to solve this problem, the embodiment of the present invention discloses a permission control method and system, which can perform permission control on each field of a resource, meet the requirements of fine and flexible control of resource permission control, and improve the fineness of resource permission control. In addition, the resource configuration result is loaded into the memory so that the resource can be quickly retrieved during permission check, thereby improving the efficiency of permission check.

[0091] refer to Figure 1 FIG. 1 is a flow chart of a permission control method disclosed in an embodiment of the present invention. The permission control method mainly includes the following steps:

[0092] Step S101: configuring resources that meet preset permission conditions to obtain resource configuration results, which at least include a parameters string.

[0093] In step S101, resources that meet the preset permission conditions are all resources that need permission control, such as published announcements, news and other resources that need permission control.

[0094] The parameter value of the parameters parameter string is a regular expression.

[0095] The specific preset permission conditions are set by technical personnel according to actual conditions, and the present invention does not make specific limitations.

[0096] Resources that do not require permission control do not need to be configured, that is, these resources can be accessed by everyone, such as system login resources.

[0097] Store resources that meet preset permission conditions in a persistent medium, such as a database or file.

[0098] The fields included in each resource are shown in Table 1.

[0099]

[0100]

[0101] Table 1

[0102] The path is the URL <path>If the server URL contains a virtual path, you can remove the virtual path part to simplify the configuration.

[0103] Parameters are the URL <parameters>The variable value in parameters is a regular expression. For example, city=(1|2|3) means that city can be 1, 2, or 3.

[0104] The resource name (resourceName) is a function name that is highly readable to users.

[0105] The resource id (resourceId) is the unique serial number of the resource.

[0106] To help you understand the process of configuring resources that meet the preset permission conditions, here is an example:

[0107] For example, for sysName / action.do? city=1&area=1, the path is sysName / action.do and the parameters are city=1&area=1. If sysName is a virtual path, the path can also be configured as action.do. For a URL without parameters, the parameters can be empty.

[0108] Step S102: Load the resource configuration result into the memory, and parse the parameters string to obtain a Map structure corresponding to the resource configuration result.

[0109] In step S102, the resource configuration result is loaded into the memory for use in subsequent permission verification. The resource configuration result is generally loaded once when the system starts up and is resident in the memory. It only needs to be reloaded when the resource definition changes, such as reducing or increasing resources.

[0110] The core goal of loading resource configuration results into memory is to parse the configured parameters string into a Map structure in order to improve the processing speed of subsequent permission verification.

[0111] The structure of resource configuration results in memory is shown in Table 2.

[0112]

[0113]

[0114] Table 2

[0115] The structure of Table 2 is a Map, which is a list of key and value pairs. Key is the variable name, and value is the variable value.

[0116] Each key-value pair is called a Map entry.

[0117] The key is path, and the value is the resource list resourceInfoList with the same path. resourceInfoList is a resource list, and each element is the parsed resource information resourceInfo. Each resource information resourceInfo includes a resource ID (resouceId) and a paramMap representing the parameters. The parameter paraMap is a Map.

[0118] In Table 2, path1, path2 and path3 are all resource paths.

[0119] resouceId11, resouceId12, resouceId21 and resouceId31 are all resource IDs.

[0120] paraName111, paraName112, paraName113, paraName121, paraName122, paraName211, paraName212, and paraName311 are all variable names.

[0121] paraValue111, paraValue112, paraValue113, paraValue121, paraValue122, paraValue211, paraValue212, and paraValue311 are all variable values.

[0122] Step S103: When the server receives the request information sent by the user, it searches the Map structure to see whether the resource ID corresponding to the request information exists. If so, it executes step S104. If not, it executes step S106.

[0123] In step S103, the resource ID defined in the system is first obtained according to the request information. If the corresponding resource ID is not found, it means that no permission control is performed; if the corresponding resource ID is found, it is checked whether the user's role has the permission to access the resource ID.

[0124] When the server receives each HTTP request from a user, it needs to perform an authorization check.

[0125] Step S104: Based on the pre-acquired role resources and user roles, determine whether the user has access rights to the resource containing the resource ID. If so, execute step S105; if not, execute step S107.

[0126] In step S104, a role is a list collection of some resources, and a user with this role has access rights to these resources.

[0127] Before determining whether a user has access rights to a resource including a resource ID based on the pre-acquired role resources and user roles, the role resources and user roles need to be configured.

[0128] The fields included in the configuration of role resources are shown in Table 3.

[0129] Field Name meaning roleID Role ID resourceID Resource ID

[0130] Table 3

[0131] resourceID is the resource ID that the role can access. A role can have multiple configurations to satisfy the role's access rights to multiple resources.

[0132] The user role configuration must include the roles that the user has. A user can have multiple roles.

[0133] To facilitate understanding of the process of determining whether a user has access rights to a resource including a resource ID based on pre-acquired role resources and user roles, examples are provided here in conjunction with Table 4, Table 5, and Table 6.

[0134] For example, the resource configuration is shown in Table 4:

[0135] resourceID path parameters resourceName 1 addCustomer.do Increase customers 2 modifyCustomer.do method=submit Modify Customer 3 deleteCustomer.do method=submit Delete a customer 4 checkCustomer.do method=submit Review Customer

[0136] Table 4

[0137] The role resource configuration is shown in Table 5:

[0138] roleID resourceID 101 1 101 2 101 3 102 4

[0139] Table 5

[0140] Combining Table 4 and Table 5, role 101 (handling role) has the authority to access resources 1, 2, and 3, and 102 (reviewing role) has the authority to access resource 4.

[0141] The configuration of user roles is shown in Table 6.

[0142]

[0143]

[0144] Table 6

[0145] Combining Table 4, Table 5 and Table 6, user 11 has role 101, that is, can access resources 1, 2, and 3; user 12 has role 102, and can access resource 4; user 13 has roles 101 and 102, and can access resources 1, 2, 3, and 4.

[0146] Step S105, making the server respond to the request information.

[0147] In step S105, when the user has access rights to the resource including the resource ID, the server responds to the request information and can perform operations such as business logic.

[0148] Step S106: Determine that the user does not have access rights to the resource containing the resource ID.

[0149] Step S107: Generate abnormal information.

[0150] In step S107, exception information is generated, that is, an exception NoPermissionException is thrown, indicating that the user does not have access rights to the resource containing the resource ID.

[0151] In the embodiment of the present invention, the authority control can be performed on each field of the resource, which meets the requirements of fine and flexible control of the authority control of the resource and improves the fineness of the authority control of the resource. In addition, the resource configuration result is loaded into the memory so that the resource can be quickly retrieved during the authority check, thereby improving the efficiency of the authority check.

[0152] refer to Figure 2 As shown in FIG. 1 , it is a schematic diagram of a process of obtaining a Map structure, that is, the process in the above step S102 involving loading the resource configuration result into the memory and parsing the parameters string to obtain the Map structure corresponding to the resource configuration result mainly includes the following steps:

[0153] Step S201: Create a parsing result object authMap.

[0154] In step S201, the parsing result object authMap is an empty Map with no content.

[0155] Step S202: traverse the resource configuration results and load the resource configuration results into the memory.

[0156] In step S202, the resource configuration results in the persistent medium (database or file, etc.) are traversed, all resources in the resource configuration results are read, and the resource configuration results are loaded into the memory.

[0157] Step S203: parse the parameters string in the resource configuration result to obtain the parsing result, and store the parsing result into the parsing result object authMap to obtain a Map structure corresponding to the resource configuration result.

[0158] Parse the parameters string to get the parsing result, and store the parsing result in the parsing result object authMap to get a Map structure, in order to improve the processing speed of subsequent permission verification.

[0159] In an embodiment of the present invention, a parsing result object authMap is created, resource configuration results are traversed, the resource configuration results are loaded into memory, the parameters parameter string is parsed to obtain the parsing result, and the parsing result is stored in the parsing result object authMap to obtain a Map structure, thereby achieving the purpose of improving the processing speed during subsequent permission verification.

[0160] refer to Figure 3 As shown, it is another process diagram for obtaining a Map structure, that is, the above step S203 involves parsing the parameters string in the resource configuration result, obtaining the parsing result, and storing the parsing result in the parsing result object authMap, and obtaining the Map structure corresponding to the resource configuration result, which mainly includes the following steps:

[0161] It should be noted that the parsing process of a single resource in the resource configuration result is as follows:

[0162] Step S301: Create an object of resource information resourceInfo.

[0163] Step S302: Assign the resource ID to the object of resource information resourceInfo.

[0164] Step S303: Determine whether the parameters string in the resource configuration result is null. If so, execute step S304. If not, execute step S305.

[0165] Step S304: store the assigned resource information resourceInfo object into the parsing result object authMap to obtain a Map structure corresponding to the resource configuration result.

[0166] Step S305: Split the parameters parameter string based on the first preset splitting parameter to obtain a string array tokens.

[0167] In step S305, the first preset splitting parameter is the "&" splitting parameter, and the parameters parameter string is split based on the & splitting parameter to obtain the string array tokens.

[0168] Step S306: traverse each string token in the string array tokens, split each string token based on the second preset splitting parameter, and obtain the string array strs.

[0169] In step S306, the second preset splitting parameter is the "=" splitting parameter, and each string token is split based on the "=" splitting parameter to obtain a string array strs.

[0170] Step S307: Determine that the variable name paraName in the Map structure is a preset element value of the string array strs.

[0171] In step S307, the preset element value is strs[0], where the number of offsets is 0.

[0172] Step S308: Determine whether the length of the string array strs is 2, if so, execute step S310, if not, execute step S309.

[0173] Step S309: Determine that the variable value paraValue is null.

[0174] Step S310: Determine that the position index of the string array strs of the variable value paraValue is 1, and create a regular expression object paraValuePattern based on the variable value paraValue whose position index is 1 of the string array strs.

[0175] In step S310, the variable name paraName=strs[1] in the Map structure is determined, where the number of offsets is 1.

[0176] If the "=" split parameter is not used, the length of the string array strs is 1.

[0177] Step S311: store the variable name paraName and the regular expression object paraValuePattern into the paramMap table of the resource information resourceInfo.

[0178] Step S312: store the resource information resourceInfo including the variable name paraName and the regular expression object paraValuePattern into the parsing result object authMap, and obtain a Map structure corresponding to the resource configuration result.

[0179] In the embodiment of the present invention, the parameters string in the resource configuration result is parsed to obtain the parsing result, and the parsing result is stored in the parsing result object authMap, so as to achieve the purpose of obtaining the Map structure corresponding to the resource configuration result.

[0180] refer to Figure 4 As shown, it is another flow chart of obtaining a Map structure, that is, the process of storing the resource information resourceInfo including the variable name paraName and the regular expression object paraValuePattern in the parsing result object authMap involved in the above step S311, and obtaining the Map structure corresponding to the resource configuration result, mainly including the following steps:

[0181] Step S401: based on the resource path, obtain the resource list resourceInfoList from the parsing result object authMap.

[0182] In step S401, each element in the resource list resourceInfoList is the parsed resource information resourceInfo, and the resource information resourceInfo is added to the resource list resourceInfoList.

[0183] Step S402: if the resource list resourceInfoList is null, a new object is created for the resource list resourceInfoList, and the key and value in the new object are stored in the parsing result object authMap to obtain a Map structure corresponding to the resource configuration result.

[0184] In an embodiment of the present invention, based on the path of the resource, the resource list resourceInfoList is obtained from the parsing result object authMap. If the resource list resourceInfoList is a null value null, a new object is created for the resource list resourceInfoList, and the key and value in the new object are stored in the parsing result object authMap, thereby achieving the purpose of obtaining the Map structure corresponding to the resource configuration result.

[0185] refer to Figure 5 As shown, the process of determining whether the user has access rights to the resource containing the resource ID based on the pre-acquired role resources and user roles in the above step S104 mainly includes the following steps:

[0186] Step S501: Determine whether the resource ID is null, if not, execute step S502, if yes, execute step S505.

[0187] In step S501, if the resource ID is null, a NoPermissionException is thrown, indicating that the user does not have access rights to the resource containing the resource ID.

[0188] Step S502: Based on the pre-acquired role resources and user roles, determine whether the user has access rights to the resources containing the resource ID. If the user has a user role and the user role has a resource ID, execute step S503. If the user does not have a user role or the user role does not have a resource ID, execute step S504.

[0189] Step S503: Determine whether the user has access rights to the resource containing the resource ID.

[0190] Step S504: Determine that the user does not have access rights to the resource containing the resource ID.

[0191] Step S505: The operation of determining whether the user has access rights to the resource containing the resource ID is not performed.

[0192] In the embodiment of the present invention, based on the pre-acquired role resources and user roles, the purpose of judging whether the user has access rights to the resources including the resource ID is achieved.

[0193] Optionally, before searching the Map structure for a resource ID corresponding to the request information, obtain the resource ID. The process of obtaining the resource ID is as follows: Figure 6 As shown, it mainly includes the following steps:

[0194] Step S601: Split the URL string of the request information to obtain the path string urlPath.

[0195] In step S601, if the virtual path portion is removed from the configured resource path, the virtual path portion is also removed when splitting the URL character string of the request information.

[0196] Step S602: Obtain the resource list resourceInfoList from the parsing result object authMap based on the path string urlPath.

[0197] Step S603: Determine whether the resource list resourceInfoList is null, if so, execute step S604, if not, execute step S605.

[0198] Step S604: Stop executing the operation of obtaining the resource ID.

[0199] Step S605: traverse each resource information resourceInfo in the resource list resourceInfoList, and determine whether each resource information resourceInfo matches the preset parameters of the request information. If it matches, execute step S606; if it does not match, execute step S607.

[0200] In step S605, the resource ID can be obtained only when all resource information resourceInfo in the resource list resourceInfoList matches the preset parameters of the request information.

[0201] The preset parameters are set by technicians according to actual conditions, and the present invention does not make specific limitations.

[0202] Step S606: Obtain resource ID.

[0203] Step S607: Determine that the resource ID is a null value, and end the operation of obtaining the resource ID.

[0204] In an embodiment of the present invention, the URL string of the request information is split to obtain the path string urlPath, and the resource list resourceInfoList is obtained from the parsing result object authMap based on the path string urlPath. The resource list resourceInfoList is traversed, and when each resource information resourceInfo in the resource list resourceInfoList matches the preset parameters of the request information, the purpose of obtaining the resource ID is achieved.

[0205] refer to Figure 7 As shown, the process of traversing each resource information resourceInfo in the resource list resourceInfoList and judging whether each resource information resourceInfo matches the preset parameters of the request information in the above step S604 mainly includes the following steps:

[0206] Step S701: traverse the paramMap of resource information resourceInfo.

[0207] In step S701, each resource information resourceInfo includes a resource ID (resouceID) and a paramMap representing a parameter, where paraMap is a Map.

[0208] Step S702: Get the entry class of the paramMap parameter.

[0209] In step S702, the entry class is a single key, value pair in the Map. For the request information, all parameters of the resource information resourceInfo need to be matched. For each parameter of the resource information resourceInfo, if the parameter is not in the request information, the request does not match the resource; if there are multiple values ​​for the parameter in the request information, each value needs to be matched to be considered a match for the resource.

[0210] Entry is an interface in Map, which is used to represent a map item (which contains Key and Value), while Set <Map.Entry<K,V> >Represents a Set of mapping entries.

[0211] Map.Entry has corresponding getKey and getValue methods, that is, JavaBean, which can retrieve the Key and Value from an item.

[0212] Step S703: Determine whether the entry class is null, if so, execute step S704, if not, execute step S705.

[0213] Step S704: Determine that the return value of the entry class is true.

[0214] Step S705: Determine that the variable name paraName in the request object is the key of the entry class, and the regular expression object paraValuePattern in the Map structure is the value of the entry class.

[0215] Step S706: Obtain the parameter value reqParaValue of the variable paraName from the request object.

[0216] In step S706, the parameter value named paraName is obtained from the request object. The request object in reqParaValue refers to the request object of HTTP communication, such as the HttpServletRequest object in Java or its packaging object. The parameters obtained from the request object include the parameters in the url and the parameters in the message body of the HTTP communication message.

[0217] Step S707: Determine whether reqParaValue is null. If so, execute step S708; if not, execute step S709.

[0218] Step S708: Determine that the return value of reqParaValue is false.

[0219] Step S709: Determine whether reqParaValue is an array, if so, execute step S710, if not, execute step S713.

[0220] Among them, an array is a collection used to store multiple data of the same type.

[0221] Step S710: Determine whether each parameter of reqParaValue matches the regular expression object paraValuePattern. If so, execute step S712; if not, execute step S711.

[0222] Step S711: Determine that the return value of reqParaValue is false.

[0223] Step S712: Return to the step of obtaining the entry class of paramMap until all entry classes in paramMap are matched.

[0224] Step S713: Determine whether reqParaValue matches the regular expression object paraValuePattern. If not, execute step S714. If so, execute step S715.

[0225] Step S714: Determine that the return value of reqParaValue is false.

[0226] Step S715: Return to the step of obtaining the entry class of paramMap until all entry classes in paramMap are matched.

[0227] In the embodiment of the present invention, each resource information resourceInfo in the resource list resourceInfoList is traversed to achieve the purpose of determining whether each resource information resourceInfo matches the preset parameters of the request information.

[0228] Based on the permission control method disclosed in the above embodiment, the embodiment of the present invention also discloses a permission control system, such as Figure 8 As shown, the permission control system mainly includes a configuration unit 801, a loading and parsing unit 802, a search unit 803, a judgment unit 804 and a response unit 805.

[0229] The configuration unit 801 configures resources that meet the preset permission conditions to obtain resource configuration results, which at least include parameters parameter character string.

[0230] The loading and parsing unit 802 is used to load the resource configuration result into the memory and parse the parameters string to obtain a Map structure corresponding to the resource configuration result.

[0231] The searching unit 803 is used to search whether there is a resource ID corresponding to the request information in the Map structure when the server receives the request information sent by the user.

[0232] The judging unit 804 is configured to judge whether the user has access rights to the resource containing the resource ID based on the pre-acquired role resources and user roles if the resource ID corresponding to the request information exists in the Map structure.

[0233] The response unit 805 is used to make the server respond to the request information if the user has access rights to the resource including the resource ID.

[0234] Furthermore, the loading and parsing unit 802 includes a creation module, a loading module and a parsing module.

[0235] Create a module and create the parsing result object authMap.

[0236] The loading module is used to traverse the resource configuration results and load the resource configuration results into the memory.

[0237] The parsing module is used to parse the parameters string in the resource configuration result, obtain the parsing result, and store the parsing result in the parsing result object authMap to obtain a Map structure.

[0238] Furthermore, the parsing module includes a creation submodule, an assignment submodule, a first judgment submodule, a first storage submodule, a first splitting submodule, a second splitting submodule, a first determination submodule, a second judgment submodule, a second determination submodule, a third determination submodule, a second storage submodule and a third storage submodule.

[0239] Create a submodule to create an object of resource information resourceInfo.

[0240] The assignment submodule is used to assign the resource ID to the object of resource information resourceInfo.

[0241] The first judgment submodule is used to judge whether the parameter value of the parameters parameter string in the resource configuration result is null.

[0242] The first storage submodule is used to store the assigned resource information resourceInfo object into the parsing result object authMap to obtain a Map structure.

[0243] The first splitting submodule is used to split the parameters parameter string based on the first preset splitting parameter to obtain the string array tokens.

[0244] The second splitting submodule is used to traverse each string token in the string array tokens, split each string token based on a second preset splitting parameter, and obtain the string array strs.

[0245] The first determination submodule is used to determine that the variable name paraName in the Map structure is a preset element value of the string array strs.

[0246] The second judgment submodule is used to judge whether the length of the string array strs is 2.

[0247] The second determination submodule is used to determine that the variable value paraValue is a null value null if the length of the string array strs is not 2.

[0248] The third determination submodule is used to determine that the position index of the string array strs of the variable value paraValue is 1 if the length of the string array strs is 2, and create a regular expression object paraValuePattern based on the variable value paraValue whose position index is 1 of the string array strs.

[0249] The second storage submodule is used to store the variable name paraName and the regular expression object paraValuePattern in the paramMap table of the resource information resourceInfo.

[0250] The third storage submodule is used to store the resource information resourceInfo including the variable name paraName and the regular expression object paraValuePattern into the parsing result object authMap to obtain a Map structure.

[0251] Furthermore, the third storage submodule is specifically used to obtain the resource list resourceInfoList from the parsing result object authMap based on the resource path path; if the resource list resourceInfoList is null, a new object is created for the resource list resourceInfoList, and the key and value in the new object are stored in the parsing result object authMap to obtain a Map structure.

[0252] Furthermore, the judging unit 804 includes a first judging module, a first execution stopping module, a second judging module, a first determining module, a second determining module and an execution stopping module.

[0253] The first judgment module is used to judge whether the resource ID is a null value.

[0254] The first execution stopping module is used to stop the judgment operation of the access authority if the resource ID is a null value.

[0255] The second judgment module is used to judge whether the user has access rights to the resource containing the resource ID based on the pre-acquired role resources and user roles if the resource ID is not null.

[0256] The first determination module is used to determine that the user has access rights to the resource containing the resource ID if the user has the user role and the user role has the resource ID.

[0257] The second determination module is used to determine that the user does not have access rights to the resource containing the resource ID if the user does not have the user role or the user role does not have the resource ID.

[0258] Furthermore, it also includes a generating unit.

[0259] The generating unit is used to generate exception information if the user does not have access rights to the resource including the resource ID.

[0260] Furthermore, it also includes an acquisition unit.

[0261] The acquisition unit is used to obtain the resource ID.

[0262] Furthermore, the acquisition unit includes a splitting module, a first acquisition module, a third judgment module, a second stop execution module, a traversal module, a second acquisition module and a third determination module.

[0263] The splitting module is used to split the URL string of the request information to obtain the path string urlPath.

[0264] The first acquisition module is used to obtain the resource list resourceInfoList from the parsing result object authMap based on the path string urlPath.

[0265] The third judgment module is used to judge whether the resource list resourceInfoList is a null value.

[0266] The second execution stopping module is used to stop executing the operation of obtaining the resource ID if the resource list resourceInfoList is a null value.

[0267] The traversal module is used to traverse each resource information resourceInfo in the resource list resourceInfoList if the resource list resourceInfoList is not a null value null, and determine whether each resource information resourceInfo matches the preset parameters of the request information.

[0268] The second acquisition module is used to acquire the resource ID if there is a match.

[0269] The third determination module is used to determine that the resource ID is a null value if there is no match, and end the operation of obtaining the resource ID.

[0270] Furthermore, the traversal module includes a traversal sub-module, a first acquisition sub-module, a third judgment sub-module, a fourth determination sub-module, a fifth determination sub-module, a second acquisition sub-module, a fourth judgment sub-module, a sixth determination sub-module, a fifth judgment sub-module, a sixth judgment sub-module, a first execution sub-module, a second execution sub-module, a seventh judgment sub-module, a third execution sub-module and a seventh determination sub-module.

[0271] The traversal submodule is used to traverse the paramMap of resource information resourceInfo.

[0272] The first acquisition submodule is used to obtain the entry class of paramMap.

[0273] The third judgment submodule is used to judge whether the entry class is a null value.

[0274] The fourth determination submodule is used to determine that the return value of the entry class is true if the entry class is a null value.

[0275] The fifth determination submodule is used to determine that the variable name paraName in the request object is the key of the entry class and the regular expression object paraValuePattern in the Map structure is the value of the entry class if the entry class is not null.

[0276] The second acquisition submodule is used to obtain the parameter value reqParaValue of the variable paraName from the request object.

[0277] The fourth judgment submodule is used to judge whether reqParaValue is a null value.

[0278] The sixth determination submodule is used to determine that the return value of reqParaValue is false if reqParaValue is null.

[0279] The fifth judgment submodule is used to judge whether reqParaValue is an array if reqParaValue is not null.

[0280] The sixth judgment submodule is used to judge whether each parameter of reqParaValue matches the regular expression object paraValuePattern if reqParaValue is an array.

[0281] The first execution submodule is used for determining that the return value of reqParaValue is false if the parameters of reqParaValue do not match the regular expression object paraValuePattern, and returning to execute the step of obtaining the entry class of paramMap until all entry classes in paramMap are matched.

[0282] The second execution submodule is used for returning to the step of obtaining the entry class of paramMap if the reqParaValue matches the regular expression object paraValuePattern, until all entry classes in paramMap are matched.

[0283] The seventh judgment submodule is used to judge whether reqParaValue matches the regular expression object paraValuePattern if reqParaValue is not an array.

[0284] The third execution submodule is used to return to the step of obtaining the entry class of paramMap if a match is found, until all entry classes in paramMap are matched.

[0285] The seventh determination submodule is used to determine that the return value of reqParaValue is false if there is no match.

[0286] In the embodiment of the present invention, the authority control can be performed on each field of the resource, which meets the requirements of fine and flexible control of the authority control of the resource and improves the fineness of the authority control of the resource. In addition, the resource configuration result is loaded into the memory so that the resource can be quickly retrieved during the authority check, thereby improving the efficiency of the authority check.

[0287] For the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the order of the actions described, because according to the present invention, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0288] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0289] The steps in the methods of the embodiments of the present invention may be adjusted in order, combined, or deleted according to actual needs.

[0290] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0291] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0292] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.< / parameters> < / path>

Claims

1. A permission control method, characterized in that: The method comprises: Configure resources that meet the preset permission conditions to obtain resource configuration results, wherein the resource configuration results at least include a parameters parameter string; Create parsing result object authMap; Traversing the resource configuration results, and loading the resource configuration results into memory; Create an object of resource information resourceInfo; Assign the resource ID to the object of the resource information resourceInfo; Determine whether the parameter value of the parameters string in the resource configuration result is null; If yes, store the assigned resource information resourceInfo object into the parsing result object authMap to obtain the Map structure corresponding to the resource configuration result; If not, split the parameters parameter string based on the first preset splitting parameter to obtain a string array tokens; Traversing each string token in the string array tokens, splitting each string token based on a second preset splitting parameter to obtain a string array strs; Determine that the variable name paraName in the Map structure is the preset element value of the string array strs; Determine whether the length of the string array strs is 2; If the length of the string array strs is not 2, determine that the variable value paraValue is null; If the length of the string array strs is 2, determine that the position index of the string array strs of the variable value paraValue is 1, and create a regular expression object paraValuePattern based on the variable value paraValue whose position index is 1 in the string array strs; The variable name paraName and the regular expression object paraValuePattern are stored in the paramMap parameter of the resource information resourceInfo; Based on the path path of the resource, obtain the resource list resourceInfoList from the parsing result object authMap; If the resource list resourceInfoList is null, a new object is created for the resource list resourceInfoList, and the key and value in the new object are stored in the parsing result object authMap to obtain a Map structure corresponding to the resource configuration result; When the server receives the request information sent by the user, it searches the Map structure to see whether there is a resource ID corresponding to the request information; If so, based on the pre-acquired role resources and user roles, determine whether the user has access rights to the resource containing the resource ID; If the user has access rights to the resource including the resource ID, the server is enabled to respond to the request information.

2. The method according to claim 1, characterized in that The determining, based on the pre-acquired role resource and user role, whether the user has access rights to the resource containing the resource ID includes: Determine whether the resource ID is null; If the resource ID is null, stop executing the access permission determination operation; If the resource ID is not null, based on the pre-acquired role resources and user roles, determine whether the user has access rights to the resource containing the resource ID; If the user has the user role and the user role has the resource ID, determining that the user has access rights to the resource containing the resource ID; If the user does not have the user role, or the user role does not have the resource ID, it is determined that the user does not have access permission to the resource containing the resource ID.

3. The method according to claim 1, characterized in that Also includes: If the user does not have access rights to the resource containing the resource ID, an exception message is generated.

4. The method according to claim 1, characterized in that Before searching the Map structure for a resource ID corresponding to the request information, the method further includes: Get the resource ID; The process of obtaining the resource ID includes: Split the URL string of the request information to obtain a path string urlPath; Obtaining a resource list resourceInfoList from the parsing result object authMap based on the path string urlPath; Determine whether the resource list resourceInfoList is null; If the resource list resourceInfoList is null, stop executing the operation of obtaining the resource ID; If the resource list resourceInfoList is not a null value, traverse each resource information resourceInfo in the resource list resourceInfoList, and determine whether each resource information resourceInfo matches the preset parameters of the request information; If it matches, the resource ID is obtained; If there is no match, it is determined that the resource ID is a null value, and the operation of obtaining the resource ID ends.

5. The method according to claim 4, characterized in that The traversing each resource information resourceInfo in the resource list resourceInfoList and judging whether each resource information resourceInfo matches a preset parameter of the request information includes: Traverse the paramMap parameters of resource information resourceInfo; Get the entry class of the paramMap parameter; Determine whether the entry class is null; If the entry class is null, determine that the return value of the entry class is true; If the entry class is not null, determine that the variable name paraName in the request object is the key of the entry class, and the regular expression object paraValuePattern in the Map structure is the value of the entry class; Get the parameter value reqParaValue of the variable paraName from the request object; Determine whether the reqParaValue is null; If the reqParaValue is null, the return value of reqParaValue is false; If the reqParaValue is not null, determine whether the reqParaValue is an array; If the reqParaValue is an array, determine whether each parameter of the reqParaValue matches the regular expression object paraValuePattern; If each parameter of the reqParaValue does not match the regular expression object paraValuePattern, determining that the return value of the reqParaValue is false; If the reqParaValue matches the regular expression object paraValuePattern, return to the step of obtaining the entry class of the paramMap until all entry classes in the paramMap are matched; If the reqParaValue is not an array, determine whether the reqParaValue matches the regular expression object paraValuePattern; If there is a match, return to the step of obtaining the entry class of the paramMap until all entry classes in the paramMap are matched; If there is no match, the return value of the reqParaValue is determined to be false.

6. A permission control system, characterized in that: The system comprises: A configuration unit, configured for resources meeting preset permission conditions, to obtain resource configuration results, wherein the resource configuration results at least include a parameters parameter string; A loading and parsing unit, used to load the resource configuration result into a memory, and parse the parameters string to obtain a Map structure corresponding to the resource configuration result; A search unit, configured to search the Map structure for a resource ID corresponding to the request information when the server receives the request information sent by the user; A judging unit, configured to judge, if a resource ID corresponding to the request information exists in the Map structure, whether the user has access rights to the resource containing the resource ID based on the pre-acquired role resources and user roles; a response unit, configured to enable the server to respond to the request information if the user has access rights to the resource containing the resource ID; The loading and parsing unit comprises: Create a module and create the parsing result object authMap; A loading module, used for traversing the resource configuration results and loading the resource configuration results into a memory; A parsing module, used for parsing the parameters string in the resource configuration result, obtaining the parsing result, and storing the parsing result in the parsing result object authMap, to obtain a Map structure corresponding to the resource configuration result; The parsing module includes a creation submodule, an assignment submodule, a first judgment submodule, a first storage submodule, a first splitting submodule, a second splitting submodule, a first determination submodule, a second judgment submodule, a second determination submodule, a third determination submodule, a second storage submodule and a third storage submodule; The creation submodule is used to create an object of resource information resourceInfo; The assignment submodule is used to assign the resource ID to the object of resource information resourceInfo; The first judgment submodule is used to judge whether the parameter value of the parameters parameter string in the resource configuration result is null; The first storage submodule is used to store the assigned resource information resourceInfo object into the parsing result object authMap to obtain a Map structure; The first splitting submodule is used for, if not, splitting the parameters parameter string based on the first preset splitting parameter to obtain the string array tokens; The second splitting submodule is used to traverse each string token in the string array tokens, split each string token based on a second preset splitting parameter, and obtain a string array strs; The first determination submodule is used to determine that the variable name paraName in the Map structure is a preset element value of the string array strs; The second judgment submodule is used to judge whether the length of the string array strs is 2; The second determination submodule is used to determine that the variable value paraValue is a null value null if the length of the string array strs is not 2; The third determining submodule is used for determining that the position index of the string array strs of the variable value paraValue is 1 if the length of the string array strs is 2, and creating a regular expression object paraValuePattern based on the variable value paraValue whose position index is 1 in the string array strs; The second storage submodule is used to store the variable name paraName and the regular expression object paraValuePattern in the paramMap table of the resource information resourceInfo; The third storage submodule is used to store the resource information resourceInfo including the variable name paraName and the regular expression object paraValuePattern into the parsing result object authMap to obtain a Map structure; The third storage submodule is specifically used to obtain the resource list resourceInfoList from the parsing result object authMap based on the resource path path; if the resource list resourceInfoList is null, a new object is created for the resource list resourceInfoList, and the key and value in the new object are stored in the parsing result object authMap to obtain a Map structure.

Images