Authentication method, device, electronic device and storage medium

Abstract

The present disclosure relates to an authentication method, device, electronic device and storage medium, wherein the method comprises: a server receives an authentication request sent by a client, wherein the authentication request is generated by the client according to the business identifier and target role of the target business to which the target component belongs and the business attribute corresponding to the business identifier when the client monitors the triggering operation of the target component in the currently displayed target page; obtaining the business attribute corresponding to the business identifier; obtaining the target rule expression matching the business attribute from the rule library; performing authentication processing on the target role and the business attribute according to the target rule expression, determining the authentication result, and determining whether the client has the operation authority for the target component according to the authentication result. In this way, the server can perform authentication processing on the client to determine whether the client has the operation authority for each component in the page, so as to avoid risk problems caused by lack of authority control or improper operation.

Description

Technical Field

[0001] The present disclosure relates to the field of big data data access technology, and in particular to an authentication method, device, electronic device, and storage medium. Background Art

[0002] The permission system focuses on permission management for the entire system, enabling logical and orderly use of permission management. As business systems grow larger, permission management functions become increasingly important. From a purely permission management perspective, it may not be possible to cover permission management across all subsystems. Therefore, the permission system can be introduced to achieve a more macro-level organization and control of permission management for the entire system. For example, if the wheels of a vehicle are likened to the permission management function, then the permission management of each subsystem is equivalent to a wheel of the vehicle, and the vehicle's driving system is the permission management system. A deep understanding of the permission system can make the permissions of the entire system more logical and orderly, making the initial permissions of different categories of users and the changes in certain permissions clearer.

[0003] Permission management is an important component of all backend systems. Its main purpose is to control the access rights of different users to resources and avoid risks caused by lack of permission control or improper operation, such as operational errors and privacy data leakage.

[0004] Therefore, it is very important to implement permission control on user access resources. Summary of the Invention

[0005] The present disclosure provides an authentication method, apparatus, electronic device, and storage medium to at least partially address one of the technical problems in the related art. The technical solution of the present disclosure is as follows:

[0006] According to a first aspect of an embodiment of the present disclosure, there is provided an authentication method, comprising:

[0007] Receiving an authentication request sent by a client, wherein the authentication request is generated by the client, when detecting a triggering operation on a target component in a currently displayed target page, determining a target role corresponding to the client based on the client's login information, and based on a business identifier of a target business to which the target component belongs and the target role;

[0008] In response to the authentication request, obtaining, according to the service identifier, a service attribute corresponding to the service identifier;

[0009] Obtaining a target rule expression that matches the business attribute from a rule library;

[0010] According to the target rule expression, the target role and business attribute are authenticated to determine an authentication result, so as to determine whether the client has the operation authority for the target component according to the authentication result.

[0011] In a possible implementation of the embodiment of the present disclosure, obtaining a target rule expression matching the service attribute from a rule base includes:

[0012] Obtaining a category corresponding to the business attribute, and obtaining a rule expression matching the category from the rule library as the target rule expression;

[0013] or,

[0014] The permission name corresponding to the business attribute is obtained, and a rule expression matching the permission name is obtained from the rule library as the target rule expression.

[0015] In a possible implementation of the embodiment of the present disclosure, performing authentication processing on the target role and business attributes according to the target rule expression, determining an authentication result, and determining whether the client has operation authority for the target component according to the authentication result, includes:

[0016] Creating a driver for parsing the target regular expression;

[0017] Using the driver to assign values ​​to the parameters in the target rule expression according to the target role and business attributes to obtain the authentication result;

[0018] When the authentication result satisfies a set condition, determining that the client has the operation authority for the target component;

[0019] When the authentication result does not meet the set condition, it is determined that the client does not have the operation authority for the target component.

[0020] In a possible implementation of the embodiment of the present disclosure, the authentication request also includes user attributes determined by the client based on the login information, and the driver is used to assign values ​​to each parameter in the target rule expression based on the target role and business attributes to obtain the authentication result, including:

[0021] The driver is used to assign values ​​to various parameters in a target rule expression according to the target role, the service attributes, and the user attributes to obtain the authentication result.

[0022] In a possible implementation of the embodiment of the present disclosure, the method further includes:

[0023] Obtain first rule input information;

[0024] Parsing the first rule input information to generate a first regular expression;

[0025] The first rule expression and the first rule input information are added to the rule base accordingly.

[0026] In a possible implementation of the embodiment of the present disclosure, the method further includes:

[0027] monitoring an editing operation on second rule input information corresponding to a second rule expression in the rule base;

[0028] In response to the editing operation, editing the second rule input information;

[0029] Parsing the edited second rule input information to generate an updated second rule expression;

[0030] The second regular expression in the rule base is updated using the updated second regular expression.

[0031] In a possible implementation of the embodiment of the present disclosure, the method further includes:

[0032] Performing regression testing on each rule expression in the rule base to generate a target test data list;

[0033] Acquire a reference test data list, wherein the reference test data list is a test data list generated by performing a regression test on each rule expression in the rule base for the first time or the most recent time;

[0034] The target test data list is compared with the reference test data list to determine target test data in the target test data list that is different from the reference test data list, so as to determine whether the rule base contains abnormal rule expressions according to the target test data.

[0035] In a possible implementation of the embodiment of the present disclosure, the method further includes:

[0036] When it is determined according to the target test data that the rule library contains abnormal rule expressions, prompt information is sent to prompt the abnormal rule expressions to be updated.

[0037] According to a second aspect of an embodiment of the present disclosure, another authentication device is provided, including:

[0038] a receiving module configured to receive an authentication request sent by a client, wherein the authentication request is generated by the client, when detecting a triggering operation on a target component in a currently displayed target page, determining a target role corresponding to the client based on login information of the client, and based on a business identifier of a target business to which the target component belongs and the target role;

[0039] a response module configured to, in response to the authentication request, obtain a service attribute corresponding to the service identifier according to the service identifier;

[0040] An acquisition module is configured to acquire a target rule expression matching the business attribute from a rule base;

[0041] The authentication module is configured to perform authentication processing on the target role and business attributes according to the target rule expression, determine an authentication result, and determine whether the client has the operation authority for the target component according to the authentication result.

[0042] In a possible implementation of the embodiment of the present disclosure, the acquisition module is configured to:

[0043] Obtaining a category corresponding to the business attribute, and obtaining a rule expression matching the category from the rule library as the target rule expression;

[0044] or,

[0045] The permission name corresponding to the business attribute is obtained, and a rule expression matching the permission name is obtained from the rule library as the target rule expression.

[0046] In a possible implementation of the embodiment of the present disclosure, the authentication module is configured to:

[0047] Creating a driver for parsing the target regular expression;

[0048] Using the driver to assign values ​​to the parameters in the target rule expression according to the target role and business attributes to obtain the authentication result;

[0049] When the authentication result satisfies a set condition, determining that the client has the operation authority for the target component;

[0050] When the authentication result does not meet the set condition, it is determined that the client does not have the operation authority for the target component.

[0051] In a possible implementation of the embodiment of the present disclosure, the authentication request further includes a user attribute determined by the client according to the login information, and the authentication module is configured to:

[0052] The driver is used to assign values ​​to various parameters in a target rule expression according to the target role, the service attributes, and the user attributes to obtain the authentication result.

[0053] In a possible implementation of the embodiment of the present disclosure, the acquisition module is further configured to acquire first rule input information;

[0054] The device further comprises:

[0055] a generating module configured to parse the first rule input information to generate a first regular expression;

[0056] The adding module is configured to add the first rule expression and the first rule input information to the rule base accordingly.

[0057] In a possible implementation of the embodiment of the present disclosure, the apparatus further includes:

[0058] A monitoring module is configured to monitor an editing operation on second rule input information corresponding to a second rule expression in the rule base;

[0059] an editing module, configured to edit the second rule input information in response to the editing operation;

[0060] a parsing module configured to parse the edited second rule input information to generate an updated second rule expression;

[0061] The updating module is configured to update the second regular expression in the rule base using the updated second regular expression.

[0062] In a possible implementation of the embodiment of the present disclosure, the apparatus further includes:

[0063] A testing module is configured to perform regression testing on each rule expression in the rule base to generate a target test data list;

[0064] The acquisition module is further configured to acquire a reference test data list, wherein the reference test data list is a test data list generated by performing a regression test on each rule expression in the rule base for the first time or the most recent time;

[0065] The comparison module is configured to compare the target test data list with the reference test data list to determine target test data in the target test data list that is different from the reference test data list, so as to determine whether there is an abnormal rule expression in the rule base according to the target test data.

[0066] In a possible implementation of the embodiment of the present disclosure, the apparatus further includes:

[0067] The sending module is configured to send prompt information to prompt the user to update the abnormal rule expression when it is determined according to the target test data that the rule library has an abnormal rule expression.

[0068] According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the authentication method as described in the above embodiment of the present disclosure.

[0069] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the authentication method as described in the above embodiment of the present disclosure.

[0070] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, comprising: a computer program, wherein when the computer program is executed by a processor, the authentication method as described in the above embodiment of the present disclosure is implemented.

[0071] The technical solutions provided by the embodiments of the present disclosure bring at least the following beneficial effects:

[0072] The server authenticates the client to determine whether the client has permission to operate the components on the page. If the client does not have permission to operate the component, it cannot perform the corresponding operation on the component, which can improve the security of the system. In other words, in this disclosure, the server can control the access rights of users logged in on the client to access resources, thereby avoiding risks caused by lack of permission control or improper operation, thereby improving the security of the system. In addition, the use of regular expressions matching business attributes to perform permission verification can be applied to any business scenario, which can improve the applicability of this method.

[0073] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] The accompanying drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute an improper limitation of the present disclosure.

[0075] Figure 1 This is a schematic diagram of the RBAC model.

[0076] Figure 2This is a schematic diagram of the ABAC mode.

[0077] Figure 3 It is a flowchart of the authentication method shown in the first embodiment of the present disclosure.

[0078] Figure 4 It is a flowchart of the authentication method shown in the second embodiment of the present disclosure.

[0079] Figure 5 It is a flowchart of the authentication method shown in the third embodiment of the present disclosure.

[0080] Figure 6 It is a flowchart of the authentication method shown in the fourth embodiment of the present disclosure.

[0081] Figure 7 It is a structural diagram of the authentication device shown in the fifth embodiment of the present disclosure.

[0082] Figure 8 It is a schematic structural diagram of an electronic device shown in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0083] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0084] It should be noted that the terms "first," "second," and the like in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the numbers used in this manner are interchangeable where appropriate so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure as detailed in the appended claims.

[0085] With the widespread use of lightweight open-source front-end frameworks such as Vue and React (both of which are JavaScript frameworks), dynamic page technology with two-way binding of data and interface interaction has become a future direction for application interface rendering. Dynamic pages have the following characteristics:

[0086] (1) Dynamic pages are based on database technology, which can greatly reduce the maintenance workload of websites and applications;

[0087] (2) Websites and applications that use dynamic page design can achieve more flexible interactions and provide users with a better experience;

[0088] (3) Dynamic page technologies based on two-way binding are mostly implemented using a progressive framework for building user interfaces. Unlike large front-end frameworks, these lightweight frameworks can be designed to be applied layer by layer from the bottom up.

[0089] When a subject needs to perform an operation on an individual, the restrictions placed by the system on this operation are called permission control. In a secure system, the subject's identity is confirmed through authentication. The object is a resource, the object of the subject's request; permissions define what the subject can do.

[0090] Permission control is divided into two parts: one is vertical permission and the other is horizontal permission. Vertical permission refers to functional permission, and horizontal permission refers to data permission.

[0091] Based on permission control, many permission models have evolved, such as the ACL (Access Control List) model and the RBAC (Role Based Access Control) model. In terms of technical implementation, each enterprise and organization currently establishes its own permission management system based on its actual business conditions, which cannot be flexibly adapted to other scenarios (such as highly complex and dynamic scenarios).

[0092] Among them, "role-based access control" and "data-based access control" are two types of permission control methods used in system security design. Common permission control models include the following:

[0093] The first type is ACL (Access Control List). An ACL consists of three elements: users, resources, and resource operations. Each resource is configured with a list that indicates which users can perform which operations on that resource. When the system attempts to access a resource, it checks the list to see if the user has the required permissions. In general, ACL is a resource-oriented access control model, with its mechanisms centered around resources.

[0094] The second type is Discretionary Access Control (DAC). The system identifies the user and then, based on the ACL or AML (Access Control Matrix) of the object being operated on, determines whether the user can perform operations on the subject, as well as which operations they can perform, such as reading or modifying. Users with object permissions can assign permissions to other users, hence the term "discretionary access control." The biggest drawback of DAC is that permission control is decentralized, making it difficult to manage. For example, permissions cannot be granted to a specific group of users.

[0095] The third type is Mandatory Access Control (MAC). MAC was developed to address the decentralized nature of DAC's access control model. In MAC's design, each object has a set of permissions, and each user also has a set of permissions. Whether a user can perform operations on an object depends on the relationship between these permissions. This restriction is typically imposed by the system. For example, in film and television, it's common to see an agent trying to access a confidential file on a device only to see the screen display "Unable to access, Level 1 security clearance required." In this example, the confidential file has a Level 1 security clearance, but the user doesn't have it, preventing the user from accessing or viewing the file. It's important to note that MAC can be suitable for confidential organizations and other industries with strong hierarchical structures, but it's not flexible enough for commercial service systems like commercial banks.

[0096] The fourth type is RBAC (Role-Based Access Control). RBAC believes that authorization is actually the relationship between who, what, and how, that is, who performs how operations on what. Among them, RBAC focuses on the relationship between Role, User, and Permission, which are called User Assignment (UA) and Permission Assignment (PA). Both sides of the relationship are many-to-many relationships, that is, a User can correspond to multiple roles, and a role can contain multiple Users. A User obtains the Permission of a Role by becoming a Role, and a Role isolates the logical relationship between User and Permission.

[0097] Among them, RBAC supports three well-known security principles:

[0098] 1. The principle of least privilege: The system requires that only necessary permissions be granted to entities, rather than excessive permissions. This effectively reduces the probability of errors in systems, networks, applications, and databases. RBAC can configure roles to the minimum set of permissions required to complete tasks.

[0099] 2. Separation of Duties: Use mutually independent and mutually exclusive roles to jointly complete sensitive tasks. For example, a bookkeeper and a financial administrator may jointly participate in the same accounting.

[0100] 3. Data abstraction principle: abstract permissions. For example, financial operations use abstract permissions such as borrowing and depositing, rather than the typical read, write, and execute permissions provided by the system.

[0101] As an example, the RBAC model can be as follows Figure 1 As shown in the figure, when a user corresponds to both roles on the left, he or she can have access to both resources on the right; when a user corresponds to only one role, he or she can only have access to one of the two resources on the right.

[0102] The fifth type is OAuth (Open Authorization). OAuth is a security protocol that authorizes third-party applications to access web resources without providing a username and password. For example, an OAuth scenario might involve a user storing photos on Google, and then a "Cloud Photo" website needs to obtain the user's authorization to access the user's photos on Google.

[0103] Among them, OAuth includes the following modes:

[0104] 1. Authorization code mode: This is the most comprehensive and rigorous collection mode, characterized by interaction between the client's backend server and the service provider's authentication server.

[0105] 2. Simplified mode: Instead of going through a third-party application server, you request a token directly from the authentication server in the browser, skipping the authorization code step. All steps are completed in the browser, the token is visible to the visitor, and switching clients does not require authentication.

[0106] 3. Password Mode: The user provides their username and password to the client, which uses this information to request authorization from the service provider. In this mode, the user is required to provide their password to the client, but the client is not allowed to store the password. This mode is typically used when the user has a high degree of trust in the client, such as when the client is part of an operating system or a well-known company. The authentication server will only use this mode when other authorization modes are unsuccessful.

[0107] 4. Client model: The client authenticates with the service provider on its own behalf, rather than on behalf of the user. Strictly speaking, the client model doesn't fall under the OAuth framework's specific purpose. In this model, the user registers directly with the client, and the client requests services from the service provider on its own behalf, eliminating the need for user authorization.

[0108] The sixth type is ABAC (Attribute-Based Access Control). ABAC is considered to be the future of permission systems. Unlike the common solution of associating users with permissions in some way, ABAC makes authorization decisions by dynamically calculating whether one or a group of attributes meet certain conditions (simple logic can be written). Attributes are generally divided into four categories: user attributes (Subject Attributes, such as user gender and age), environmental attributes (such as current time), operation attributes (such as reading), and object attributes (Object Attributes, such as an article, also known as resource attributes). Therefore, in theory, ABAC can achieve very flexible control and meet almost all types of needs.

[0109] As an example, the ABAC mode can be as follows Figure 2 shown.

[0110] ABAC has the following characteristics:

[0111] A. Centralized management;

[0112] B. Different granularity of permission control can be achieved as needed;

[0113] C. It does not require predefined judgment logic, which can reduce the maintenance cost of the permission system, especially for systems with frequently changing requirements;

[0114] D. When defining permissions, the relationship between users and objects cannot be intuitively seen;

[0115] E. If the rules are slightly complicated or the design is confusing, it will cause trouble for managers to maintain and track;

[0116] F. Permission judgment needs to be executed in real time. Too many rules will cause performance problems.

[0117] As web pages and interfaces become more dynamic, permission control on dynamic interfaces is becoming increasingly complex. For example, permission design for dynamic pages requires a higher level of dimensionality compared to that for static pages. Because dynamic pages encompass a wider range of businesses and offer more flexible interactive elements, permission scenarios for dynamic pages are more complex and require more dimensionality in their judgment criteria.

[0118] For another example, it is difficult to abstract the configurability of dynamic interface component permissions.

[0119] Another example is the inability to perform full-scale regression testing. In a complex permission control system, after modifying a permission, it's impossible to perform full-scale regression testing. This can introduce risks to system upgrades and rollouts.

[0120] In addition, in some business scenarios, operational permission control is no longer simply designed based on roles, but rather roles are intertwined with various complex business states for judgment, which makes the design of permission control solutions more difficult.

[0121] Therefore, in order to solve the above-mentioned problems, the present disclosure proposes an authentication method, device, electronic device and storage medium.

[0122] The following describes the authentication method, device, electronic device, and storage medium of the embodiments of the present disclosure with reference to the accompanying drawings. Before describing the embodiments of the present disclosure in detail, for ease of understanding, the following common technical terms are first introduced:

[0123] JEXL Expression Engine: Java Expression Language (JEXL) is a library designed to facilitate dynamic script parsing in applications and frameworks written in Java. JEXL predefines an expression language based on certain extensions to the JSTL (JSP (Java Server Pages) Standard Tag Library) expression language. These extensions support most constructs found in shell scripts or ECMA (European Computer Manufacturers Association) scripts, a standard scripting language.

[0124] Dynamic web pages are a web programming technique that contrasts with static web pages. With static web pages, as HTML (Hypertext Markup Language) code is generated, the page content and appearance remain essentially unchanged unless the code is modified. Dynamic web pages, on the other hand, are different. While the code remains unchanged, the displayed content can change over time, based on the environment, or as a result of database operations.

[0125] Permission control: All management systems include a permissions module to allocate and control user permissions, thereby achieving operational and data isolation. Permission control primarily relies on backend permissions, combined with front-end interface display to manage permissions at different levels.

[0126] Figure 3 It is a flowchart of the authentication method shown in the first embodiment of the present disclosure.

[0127] like Figure 3 As shown, the authentication method can be applied to the server, including the following steps S11 to S14.

[0128] In step S11, an authentication request sent by the client is received, wherein the authentication request is generated by the client when it monitors the triggering operation of the target component in the currently displayed target page, determines the target role corresponding to the client based on the client's login information, and is generated based on the business identifier and target role of the target business to which the target component belongs.

[0129] In the embodiment of the present disclosure, the target page refers to the page currently displayed by the client. The target page can be a static page, or the target page can be a dynamic page, which is not limited by the present disclosure.

[0130] In the embodiment of the present disclosure, the target component can be any component displayed in the target page. For example, the method is applied to the loan process of a bank for exemplary description, and the target component can be a component such as loan, customer, collateral, etc. in the target page.

[0131] In the disclosed embodiment, when a client detects a user triggering an operation on a target component in a currently displayed target page, the client can determine the target role corresponding to the user based on the user's login information. Specifically, the client can determine the target role corresponding to the user logging into the client based on the client's login information. Furthermore, the client can determine the target business to which the target component belongs, generate an authentication request based on the business identifier and target role of the target business, and send the authentication request to the server. Accordingly, the server can receive the authentication request sent by the client and perform authentication processing on the client.

[0132] In step S12, in response to the authentication request, the service attribute corresponding to the service identifier is acquired according to the service identifier.

[0133] In the embodiments of the present disclosure, business attributes can also be referred to as business condition parameters. For example, the business attributes may include business scenario parameters, business feature parameters, etc., such as business process status, business product code, business product type, business acceptance time, business approval time, etc.

[0134] In the embodiment of the present disclosure, after receiving the authentication request, the server can obtain the service attribute corresponding to the service identifier according to the service identifier in the authentication request.

[0135] In step S13, a target rule expression matching the business attribute is obtained from the rule base.

[0136] In the embodiment of the present disclosure, the rule base refers to a database for storing regular expressions.

[0137] In the embodiment of the present disclosure, the server may obtain a target rule expression that matches the business attribute from the rule library.

[0138] In a possible implementation of the embodiment of the present disclosure, the server can determine the category corresponding to the business attribute and obtain a regular expression matching the category from the rule library as the target regular expression. The regular expression and the category can be stored in the rule library in correspondence.

[0139] For example, this method is applied to a bank's loan process. The loan process may include categories such as home loans, car loans, and consumer loans. If the category to which the business attribute belongs is car loans, a rule expression that matches the car loan category is obtained from the rule library.

[0140] In another possible implementation of the embodiment of the present disclosure, the server may determine the permission name corresponding to the business attribute, and obtain a regular expression matching the permission name from the rule library as the target regular expression. The regular expression and the permission name may be stored in the rule library in correspondence.

[0141] In this way, it is possible to determine target rule expressions that match business attributes in different ways, which can improve the flexibility and applicability of the method.

[0142] In step S14, the target role and business attributes are authenticated according to the target rule expression to determine an authentication result, so as to determine whether the client has the operation authority for the target component according to the authentication result.

[0143] In the embodiment of the present disclosure, the server can perform authentication processing on the target role and business attributes based on the target rule expression to determine the authentication result, and thus can determine whether the client has the operation authority for the target component based on the authentication result. When the client has the operation authority for the target component, the client can be controlled to display the page elements corresponding to the target component, or the user can perform corresponding operations on the target component, such as adding, modifying, etc., and when the client does not have the operation authority for the target component, the user cannot perform corresponding operations on the target component. In this way, it is possible to implement permission control on the user's access to resources in the target page to avoid risk problems caused by lack of permission control or improper operation.

[0144] In a possible implementation of the embodiment of the present disclosure, the server can directly determine whether the client has the operating authority of the target component based on the authentication result, and send an indication information to the client to indicate whether the client has the operating authority of the target component. Accordingly, after receiving the indication information, the client can perform permission control on the target component based on the indication information.

[0145] For example, when the indication information indicates that the client has the permission to operate the target component, the client can display the page elements corresponding to the target component on the target page according to the indication information, so that the user can perform the corresponding operations on the target component. When the indication information indicates that the client does not have the permission to operate the target component, the client may not display the page elements corresponding to the target component on the target page, so that the user cannot perform the corresponding operations on the target component.

[0146] In another possible implementation of the embodiment of the present disclosure, the server may send the authentication result to the client, and the client may determine whether the client has the operation permission for the target component based on the authentication result.

[0147] The authentication method of the embodiment of the present disclosure receives an authentication request sent by a client through a server, wherein the authentication request is generated by the client according to the business identifier and the target role of the target business to which the target component belongs based on the client's login information when the client detects a trigger operation on the target component in the target page currently displayed; in response to the authentication request, the business attribute corresponding to the business identifier is obtained according to the business identifier; a target rule expression matching the business attribute is obtained from a rule library; according to the target rule expression, the target role and the business attribute are authenticated and an authentication result is determined to determine whether the client has the operation permission for the target component according to the authentication result. In this way, the server can authenticate the client to determine whether the client has the operation permission for each component in the page. If the client does not have the operation permission for the component, it cannot perform the corresponding operation on the component, which can improve the security of the system. That is, in the present disclosure, the server can control the access rights of the user logged in on the client to avoid risk problems caused by lack of permission control or improper operation, thereby improving the security of the system. Furthermore, using regular expressions that match business attributes to perform permission verification can be applied to any business scenario, which can improve the applicability of the method.

[0148] In order to clearly explain how the target role and service attributes are authenticated in the above embodiment of the present disclosure, the present disclosure also proposes an authentication method. Figure 2 , the above process is explained in detail.

[0149] Figure 4 It is a flowchart of the authentication method shown in the second embodiment of the present disclosure.

[0150] like Figure 4 As shown, the authentication method may include the following steps S21 to S28.

[0151] In step S21, an authentication request sent by the client is received, wherein the authentication request is generated by the client when it monitors the triggering operation of the target component in the currently displayed target page, determines the target role corresponding to the client based on the client's login information, and is generated based on the business identifier and target role of the target business to which the target component belongs.

[0152] In step S22, in response to the authentication request, the service attribute corresponding to the service identifier is acquired according to the service identifier.

[0153] In step S23, a target rule expression matching the business attribute is obtained from the rule base.

[0154] The execution process of steps S21 to S23 can refer to the execution process of any embodiment of the present disclosure and will not be repeated here.

[0155] In step S24 , a driver for parsing the target regular expression is created.

[0156] In step S25, the driver is used to assign values ​​to the parameters in the target rule expression according to the target role and business attributes to obtain the authentication result.

[0157] In the embodiment of the present disclosure, a driver for parsing a target rule expression may be created, and the driver may be used to assign values ​​to various parameters in the target expression according to the target role and business attributes to obtain an authentication result.

[0158] As an example, we will use JEXL's parsing expression to implement permission parsing. First, we can introduce the JEXL dependency package into the corresponding Spring framework. Then, we can calculate the authentication result through the following steps:

[0159] A. Create an expression engine object (driver);

[0160] B. Get the statement string corresponding to the target regular expression;

[0161] C. Create a Context object (driver) and assign values ​​to the unknown parameters in the target rule expression according to the target role and business attributes;

[0162] D. Use the expression engine to create an expression object (driver), and use the above expression object to calculate the result corresponding to the target rule expression.

[0163] Taking the target rule expression a+b*c as an example, the values ​​of a, b, and c can be determined from the target role and business attributes respectively, and then substituted into the target rule expression. Assuming a=1, b=2, and c=3, the authentication result can be determined to be 7.

[0164] In a possible implementation of the embodiment of the present disclosure, the authentication request sent by the client to the server may also include user attributes determined by the client based on the login information. Accordingly, after receiving the authentication request, the server may use the above-mentioned driver to assign values ​​to the various parameters in the target rule expression according to the target role, business attributes and user attributes to obtain the authentication result.

[0165] That is, the various parameters used for permission determination, referred to as permission condition parameters in this disclosure, may include parameters such as user role, user attributes, and business attributes. For example, permission condition parameters may also include environment attributes, resource attributes, and operation attributes. As an example, the permission condition parameters may be as shown in Table 1, where user role may be as shown in b in Table 1, user attributes may be as shown in a and c in Table 2, and business attributes may be as shown in d, e, m, n, x, and y in Table 1.

[0166] Table 1 Example of permission condition parameters

[0167]

[0168]

[0169] In summary, the present disclosure expresses the access judgment rule of a certain permission in the ABAC mode in the form of an expression statement, and puts the actual role corresponding to the current user logged in on the client and the current actual scenario parameters of the target business into the Context object. Through the above steps, the final authentication result is calculated to determine whether the permission is allowed in the current scenario corresponding to the current user and the target business.

[0170] The configuration of permission condition parameters can be standardized and retrieved from fixed page parameters, network request parameters, backend storage, etc. For example, various types of permission condition parameters can be combined, and each permission condition parameter can be retrieved from various data source scenarios based on transaction lines and unique data identifiers to improve the maintainability of this method.

[0171] It should be noted that integrating various complex permission condition parameters such as user roles and business attributes into the same parameter engine object may cause the following complex problems: adaptation processing of various data types, and / or retrieval processing of multiple data sources.

[0172] For data type adaptation issues, you can use JEXL's flexible functions to introduce some basic types of processing classes, such as digital processing base classes, time processing base classes, and Array processing base classes, into the JEXL engine. For example, for the processing of role permissions, it is necessary to determine whether a certain role exists in the user role list and is located in the list of accessible roles corresponding to the permission. If so, it is determined that the user has the permission to operate the target component. The above scenario is essentially to find out whether there is a union between a set and another set. If so, permission is allowed. If not, permission is not allowed. The above calculation cannot be processed using ordinary expression statements, but can be operated with the help of some methods in the Array class.

[0173] For the problem of extracting and processing data from multiple sources, you can define the priority of the data sources according to the business, and then extract data from each source in turn until the value is obtained.

[0174] In step S26, it is determined whether the authentication result meets the set conditions. If so, step S27 is executed; if not, step S28 is executed.

[0175] In step S27, it is determined whether the client has the operation authority for the target component.

[0176] In the embodiment of the present disclosure, when the authentication result meets the set conditions, it can be determined that the client has the operation authority for the target component.

[0177] In step S28, it is determined that the client does not have the operation authority for the target component.

[0178] In the embodiment of the present disclosure, when the authentication result does not meet the set conditions, it can be determined that the client does not have the operation authority for the target component.

[0179] Still taking the above example as an example, the calculation result of the target rule expression is set to 12 for exemplary explanation. Since the calculation result of the target rule expression (i.e., the authentication result) is 7, it can be determined that the authentication result does not meet the set conditions. At this time, it can be determined that the client does not have the operation permission for the target component.

[0180] The authentication method of the embodiment of the present disclosure creates a driver for parsing a target rule expression; the driver is used to assign values ​​to the various parameters in the target rule expression according to the target role and business attributes to obtain an authentication result; when the authentication result meets the set conditions, it is determined that the client has the operation authority for the target component; when the authentication result does not meet the set conditions, it is determined that the client does not have the operation authority for the target component. In this way, it is possible to effectively assign values ​​to the various parameters in the target rule expression through the driver for parsing the rule expression to obtain an authentication result, so that the client can be effectively authenticated based on the authentication result, which can avoid risk problems caused by lack of permission control or improper operation and improve the security of the system.

[0181] In a possible implementation of the embodiment of the present disclosure, business personnel or technical personnel can configure each rule expression in the rule base according to actual business needs. Figure 5 , the above process is explained in detail.

[0182] Figure 5 It is a flowchart of the authentication method shown in the third embodiment of the present disclosure.

[0183] like Figure 5As shown, based on any of the above embodiments, the authentication method may further include the following steps S31 to S33.

[0184] In step S31, first rule input information is obtained.

[0185] In the embodiment of the present disclosure, the first rule input information is configuration information for the authority rule input by a business person or a technical person.

[0186] As an example, this method is applied to a bank's loan process. Business personnel or technical personnel can flexibly configure various permission rules based on actual business needs or actual application needs to obtain rule input information. For example, the rule input information can be as follows:

[0187] [The business scenario is a loan image, and the loan is in the name of the current processor, and the business status of the loan is in the process of acceptance / investigation / entry / review, and the current login user has the authority of investigator, account manager, etc.] Or, [The business scenario is a loan partner image, and the partnership business status is in the process of acceptance, investigation, entry, review, approval, and the current login user has the authority of partner marketer, etc.]

[0188] Among them, double brackets, "and", and "among" are descriptive conjunctions. Each state corresponds to:

[0189] The business scenario is loan imaging (matetype=01);

[0190] The loan is under the name of the current processor (loanofnowopper=true);

[0191] The business status of the loan is under acceptance / investigation / entry / review (busistat=01 / 02 / 03 / 04);

[0192] The current login user has permissions of investigator, account manager, etc. (roles = J031200035, J031200038...);

[0193] The business scenario is loan partner image (matetype=16);

[0194] The cooperative business status is in the process of acceptance, investigation, entry, review, and approval (coopbusistat=0 / 1 / 2 / 4 / 5);

[0195] The current login user's permissions are among the partner marketers (roles = J031CF0120···).

[0196] In step S32, the first rule input information is parsed to generate a first regular expression.

[0197] In the embodiment of the present disclosure, the first rule input information may be parsed based on natural language processing technology to generate a first regular expression.

[0198] Still using the above example, the first regular expression can be as follows:

[0199] true&&((Arrays.asList(“01”).contains(matetype)&&loanofnowoper&&Arrays.asList(“01”,“02”,“03”,“0 4").contains(busistat)&&roles.removeAll(Arrays.asList("J031200035","J031200038","J031200008","J 031200005","J031200006","J024000038","J031200013","J061B00009")))||(matetype="16"&&Arrays.asL ist("0","1","2","4","5").contains(coopbusistat)&&roles.removeAll(Arrays.asList("J031CF0120"))))

[0200] In step S33, the first rule expression and the first rule input information are added to the rule base accordingly.

[0201] In the embodiment of the present disclosure, the first rule expression and the first rule input information can be added to the rule base accordingly. The rule base can be located in a database backend or some storage middleware (such as redis).

[0202] In a possible implementation of the embodiment of the present disclosure, in order to improve the flexibility and applicability of the method, business personnel or technical personnel can also update each rule expression in the rule base according to actual business needs or application needs. For example, business personnel can edit the rule input information corresponding to each rule expression in the rule base, so that they can parse the edited rule input information to obtain an updated rule expression, and use the updated rule expression to update the original rule expression in the rule base.

[0203] Specifically, when the server detects an edit operation on the second rule input information corresponding to the second rule expression in the rule base, it can edit the second rule input information in response to the edit operation and parse the edited second rule input information to generate an updated second rule expression, thereby using the updated second rule expression to update the second rule expression in the rule base. In this way, dynamic maintenance of each rule expression in the rule base can be achieved to meet actual business needs.

[0204] The authentication method of the disclosed embodiment obtains first rule input information; parses the first rule input information to generate a first rule expression; and adds the first rule expression and the first rule input information to a rule base. This allows business personnel or technical personnel to configure each rule expression in the rule base based on actual application and business requirements, thereby improving the flexibility and applicability of the method. Furthermore, the rule expressions in the rule base can be dynamically maintained, updated, and supplemented to meet actual business needs, further improving the applicability of the method.

[0205] It should be noted that for permission rule configurations in complex scenarios, if business personnel or technical personnel modify the rule expression of a certain scenario, it is likely to affect the rule expressions corresponding to other scenarios. Therefore, it is very important to perform regression testing on each rule expression in the rule library. However, in business testing, it is difficult to perform regression testing on the rule expressions corresponding to all scenarios in the rule library.

[0206] Therefore, in response to the above problems, the present disclosure also proposes an authentication method.

[0207] Figure 6 It is a flowchart of the authentication method shown in the fourth embodiment of the present disclosure.

[0208] like Figure 6 As shown, in Figure 5 Based on the illustrated embodiment, the authentication method may further include the following steps S41 to S43.

[0209] In step S41 , regression testing is performed on each regular expression in the rule base to generate a target test data list.

[0210] In the embodiment of the present disclosure, regression testing may be performed on each rule expression in the rule base to generate target test list data.

[0211] In step S42 , a reference test data list is obtained, wherein the reference test data list is a test data list generated by performing regression testing on each rule expression in the rule base for the first time or the most recent time.

[0212] In an embodiment of the present disclosure, a reference test data list can also be obtained. The reference test data list can be the test list data generated after the regression test is performed on each rule expression in the rule base for the first time, or the reference test data list can also be the test data list generated after the most recent regression test is performed on each rule expression in the rule base.

[0213] In step S43 , the target test data list is compared with the reference test data list to determine target test data in the target test data list that is different from the reference test data list, so as to determine whether there is an abnormal rule expression in the rule base according to the target test data.

[0214] In an embodiment of the present disclosure, the target test data list can be compared with the reference test data list to determine the test data in the target test data list that is different from the reference test data list, which is recorded as target test data in the present disclosure, so that it can be determined whether there are abnormal rule expressions in the rule base based on the target test data.

[0215] As an example, target test data may be provided to business personnel for verification analysis to determine whether there are abnormal rule expressions in the rule base.

[0216] In a possible implementation of the embodiment of the present disclosure, when it is determined that an abnormal rule expression exists in the rule library according to the target test data, a prompt message may be sent to prompt business personnel or technical personnel to update the abnormal rule expression.

[0217] As an example, when the rule base is first built, the area test method can be called to perform regression testing on each rule expression in the rule base to generate an initialization test data list, which is recorded as a reference test data list in this disclosure. The business personnel will browse the reference test data list to determine and check whether the test results of the rule expressions corresponding to each business scenario meet expectations. If they do not meet expectations, the technical personnel will reconfigure the rule expressions in the rule base and re-call the area test method to perform regression testing on each rule expression in the rule base to generate a target test data list. The target test data list is compared with the reference test data list to determine the test data that is inconsistent with the reference test data list and the newly added test data, which are recorded as target test data in this disclosure, so that the business personnel can verify and analyze the target test data. If the target test data does not meet expectations, the technical personnel will reconfigure the rule expressions in the rule base and re-perform regression testing on each rule expression in the rule base.

[0218] Through the above testing method, all rule expressions in the rule library can be traversed, and the test results of each rule expression can be delivered to business personnel for verification. They can also be compared with the test data list generated last time to automatically check whether the newly added or updated rule expressions have any impact on the regression scenario.

[0219] Understandably, in some business scenarios, permission control is no longer solely based on role control, but is interwoven with a variety of complex business status conditions. For example, in a loan file management system, certain account manager roles are limited to modifying documents within a fixed loan process. Once the loan has been approved and has reached the signing stage, the account manager role is prohibited from modifying the application materials or the customer's electronic file. This requires interweaving the loan processing role with the loan process status to dynamically control file modification permissions.

[0220] In order to achieve dynamic control of permissions, in this disclosure, complex permission condition parameters such as user roles, user attributes, environment attributes, resource attributes, business attributes, and operation attributes can be viewed from a scenario perspective on dynamic business pages, and combined with a parsing expression engine to achieve permission control in complex scenarios.

[0221] The working principle is as follows: the server regards user roles, business status, business type, business characteristics and other data as each different scenario, and integrates them into a conditional processing driver as scenario-based conditions. At the same time, the permission rules are stored in the database (referred to as the rule library in this disclosure) in the form of string expressions (referred to as rule expressions in this disclosure). When the system is running, the client sends the obtained role and other conditions to the server through the interface. The server puts the conditions and business number (referred to as business identifier in this disclosure) obtained by the client into the conditional processing driver, and automatically retrieves the business condition parameters (referred to as business attributes in this disclosure) according to the business number to form a business condition parameter integration. Then, according to the permission name or category corresponding to the business condition parameter, the corresponding rule expression is obtained from the rule library, and the user role and business condition parameters and the rule expression are put into the JEXL engine, parsed into the permission control result (referred to as the authentication result in this disclosure), and the permission control result is returned to the client to perform corresponding permission control on the target component of the interaction.

[0222] Adapting permission control to complex scenarios using parsed expressions, treating role conditions as a special scenario and designing rule expressions based on each scenario, can provide a new, fixed routine for the design of permission rules for complex scenarios, making it easier for business and technical personnel to better align permission requirements and interfaces, and improving development flexibility. Furthermore, rule expressions are configurable and can be configured by business and technical personnel through human-computer interaction. The configured rule expressions can then be regression tested using area testing methods, forming a complete permission configuration process that is highly flexible, usable, maintainable, secure, and reliable, allowing for efficient application in scenarios with high system requirements, such as financial systems and government office systems.

[0223] It should be noted that although complex permission rules can be hard-coded in the application according to the business scenario, the above hard-coded method cannot configure the rules and is not very flexible.

[0224] The authentication method of the embodiment of the present disclosure performs regression testing on each rule expression in the rule base to generate a target test data list; obtains a reference test data list, wherein the reference test data list is a test data list generated by the first or most recent regression testing of each rule expression in the rule base; compares the target test data list with the reference test data list to determine the target test data in the target test data list that is different from the reference test data list, so as to determine whether the rule base contains abnormal rule expressions based on the target test data. In this way, regression testing can be performed on each rule expression in the rule base to determine whether there are abnormal rule expressions in the rule base, so that when it is determined that there are abnormal rule expressions in the rule base, relevant personnel can be reminded to modify the abnormal rule expressions to avoid the abnormal rule expressions from bringing risk problems to the upgrade and launch of the system, thereby improving the robustness of the system.

[0225] With the above Figures 1 to 6 Corresponding to the authentication method provided in the embodiment, the present disclosure also provides an authentication device. Figures 1 to 6 The authentication method provided in the embodiment corresponds to the embodiment, so the implementation of the authentication method is also applicable to the authentication device provided in the embodiment of the present disclosure, and will not be described in detail in the embodiment of the present disclosure.

[0226] Figure 7 It is a structural diagram of the authentication device shown in the fifth embodiment of the present disclosure.

[0227] Reference Figure 7 The authentication device 100 may include: a receiving module 110, a responding module 120, an acquiring module 130 and an authentication module 140.

[0228] Among them, the receiving module 110 is configured to receive an authentication request sent by the client, wherein the authentication request is generated by the client when it monitors the trigger operation of the target component in the currently displayed target page, determines the target role corresponding to the client based on the client's login information, and generates it based on the business identifier and target role of the target business to which the target component belongs.

[0229] The response module 120 is configured to respond to the authentication request and obtain the service attribute corresponding to the service identifier according to the service identifier.

[0230] The acquisition module 130 is configured to acquire a target rule expression matching the business attribute from the rule base.

[0231] The authentication module 140 is configured to perform authentication processing on the target role and business attributes according to the target rule expression, determine the authentication result, and determine whether the client has the operation authority for the target component according to the authentication result.

[0232] In a possible implementation of the embodiment of the present disclosure, the acquisition module 130 is configured to: obtain the category corresponding to the business attribute, and obtain the rule expression that matches the category from the rule library as the target rule expression; or obtain the permission name corresponding to the business attribute, and obtain the rule expression that matches the permission name from the rule library as the target rule expression.

[0233] In a possible implementation of the embodiment of the present disclosure, the authentication module 140 is configured to: create a driver for parsing the target rule expression; use the driver to assign values ​​to the various parameters in the target rule expression according to the target role and business attributes to obtain an authentication result; when the authentication result meets the set conditions, determine that the client has the operation authority for the target component; when the authentication result does not meet the set conditions, determine that the client does not have the operation authority for the target component.

[0234] In a possible implementation of an embodiment of the present disclosure, the authentication request also includes user attributes determined by the client based on login information, and the authentication module 140 is configured to: use a driver to assign values ​​to each parameter in the target rule expression based on the target role, business attributes and user attributes to obtain an authentication result.

[0235] In a possible implementation of the embodiment of the present disclosure, the acquisition module 130 is further configured to acquire first rule input information; the authentication device 100 may further include:

[0236] The generating module is configured to parse the first rule input information to generate a first rule expression.

[0237] The adding module is configured to add the first rule expression and the first rule input information to the rule base accordingly.

[0238] In a possible implementation of the embodiment of the present disclosure, the authentication device 100 may further include:

[0239] The monitoring module is configured to monitor an editing operation on second rule input information corresponding to a second rule expression in the rule base.

[0240] The editing module is configured to edit the second rule input information in response to an editing operation.

[0241] The parsing module is configured to parse the edited second rule input information to generate an updated second rule expression.

[0242] The updating module is configured to update the second regular expression in the rule base using the updated second regular expression.

[0243] In a possible implementation of the embodiment of the present disclosure, the authentication device 100 may further include:

[0244] The testing module is configured to perform regression testing on each rule expression in the rule base to generate a target test data list.

[0245] The acquisition module 130 is further configured to acquire a reference test data list, wherein the reference test data list is a test data list generated by performing a regression test on each rule expression in the rule base for the first time or the most recent time.

[0246] The comparison module is configured to compare the target test data list with the reference test data list, determine the target test data in the target test data list that is different from the reference test data list, and determine whether there is an abnormal rule expression in the rule base according to the target test data.

[0247] In a possible implementation of the embodiment of the present disclosure, the authentication device 100 may further include:

[0248] The sending module is configured to send prompt information to prompt the updating of the abnormal rule expression when it is determined according to the target test data that the rule library has an abnormal rule expression.

[0249] The authentication device of the embodiment of the present disclosure receives an authentication request sent by a client through a server, wherein the authentication request is generated by the client according to the target role corresponding to the client according to the login information of the client when monitoring the trigger operation of the target component in the currently displayed target page, and according to the business identifier and the target role of the target business to which the target component belongs; in response to the authentication request, the business attribute corresponding to the business identifier is obtained according to the business identifier; a target rule expression matching the business attribute is obtained from a rule library; according to the target rule expression, the target role and the business attribute are authenticated and an authentication result is determined, so as to determine whether the client has the operation permission for the target component according to the authentication result. In this way, the server can authenticate the client to determine whether the client has the operation permission for each component in the page. If the client does not have the operation permission for the component, it cannot perform the corresponding operation on the component, which can improve the security of the system. That is to say, in the present disclosure, the server can control the access rights of the user logged in on the client to avoid risk problems caused by lack of permission control or improper operation, thereby improving the security of the system. Furthermore, using regular expressions that match business attributes to perform permission verification can be applied to any business scenario, which can improve the applicability of the method.

[0250] In an exemplary embodiment, an electronic device is also provided.

[0251] Among them, electronic equipment includes:

[0252] processor;

[0253] a memory for storing processor-executable instructions;

[0254] The processor is configured to execute instructions to implement the authentication method proposed in any of the aforementioned embodiments.

[0255] As an example, Figure 8 is a structural diagram of an electronic device 200 shown in an exemplary embodiment of the present disclosure, such as Figure 8 As shown, the electronic device 200 may further include:

[0256] The memory 210 and the processor 220, and the bus 230 connecting different components (including the memory 210 and the processor 220), the memory 210 stores a computer program, and when the processor 220 executes the program, the authentication method described in the embodiment of the present disclosure is implemented.

[0257] Bus 230 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures. Examples of these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0258] The electronic device 200 typically includes a variety of electronic device-readable media. These media can be any available media that can be accessed by the electronic device 200, including volatile and non-volatile media, removable and non-removable media.

[0259] The memory 210 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 240 and / or cache memory 250. The electronic device 200 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 260 may be used to read and write non-removable, non-volatile magnetic media ( Figure 8 Not shown, often called a "hard drive"). Although Figure 8 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 230 via one or more data media interfaces. Memory 210 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of various embodiments of the present disclosure.

[0260] A program / utility 280 having a set (at least one) of program modules 270 may be stored, for example, in memory 210. Such program modules 270 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data, each of which, or some combination thereof, may include an implementation of a network environment. Program modules 270 generally implement the functions and / or methods of the embodiments described herein.

[0261] The electronic device 200 can also communicate with one or more external devices 290 (e.g., a keyboard, a pointing device, a display 291, etc.), one or more devices that enable a user to interact with the electronic device 200, and / or any device that enables the electronic device 200 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication can occur via an input / output (I / O) interface 292. Furthermore, the electronic device 200 can also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 293. As shown, the network adapter 293 communicates with other modules of the electronic device 200 via a bus 230. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 200, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0262] The processor 220 executes various functional applications and data processing by running programs stored in the memory 210 .

[0263] It should be noted that the implementation process and technical principles of the electronic device of this embodiment can be found in the aforementioned explanation of the authentication method of the embodiment of the present disclosure, and will not be repeated here.

[0264] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory including instructions. The instructions can be executed by a processor of an electronic device to perform the method provided in any of the above embodiments. Alternatively, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, or the like.

[0265] In an exemplary embodiment, a computer program product is further provided, including a computer program / instruction, wherein the computer program / instruction implements the method proposed in any of the above embodiments when executed by a processor.

[0266] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the following claims.

[0267] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. An authentication method, characterized in that: The method comprises: Receiving an authentication request sent by a client, wherein the authentication request is generated by the client, when detecting a triggering operation on a target component in a currently displayed target page, determining a target role corresponding to the client based on the client's login information, and based on a business identifier of a target business to which the target component belongs and the target role; In response to the authentication request, obtaining, according to the service identifier, a service attribute corresponding to the service identifier; Determine the category corresponding to the business attribute, and obtain a target rule expression matching the category corresponding to the business attribute from a rule library; Authenticating the target role and service attribute according to the target rule expression and determining an authentication result, so as to determine whether the client has the operation authority for the target component according to the authentication result; The step of performing authentication processing on the target role and the business attribute according to the target rule expression and determining an authentication result, so as to determine whether the client has the operation authority for the target component according to the authentication result, includes: Creating a driver for parsing the target regular expression; Using the driver to assign values ​​to the parameters in the target rule expression according to the target role and business attributes to obtain the authentication result; When the authentication result satisfies a set condition, determining that the client has the operation authority for the target component; When the authentication result does not meet the set condition, it is determined that the client does not have the operation authority for the target component.

2. The method according to claim 1, characterized in that The acquiring a target rule expression matching the service attribute from a rule base includes: Obtaining a category corresponding to the business attribute, and obtaining a rule expression matching the category from the rule library as the target rule expression; or, The permission name corresponding to the business attribute is obtained, and a rule expression matching the permission name is obtained from the rule library as the target rule expression.

3. The method according to claim 1, characterized in that The authentication request also includes user attributes determined by the client according to the login information. The driver is used to assign values ​​to various parameters in the target rule expression according to the target role and business attributes to obtain the authentication result, including: The driver is used to assign values ​​to various parameters in a target rule expression according to the target role, the service attributes, and the user attributes to obtain the authentication result.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Obtain first rule input information; Parsing the first rule input information to generate a first regular expression; The first rule expression and the first rule input information are added to the rule base accordingly.

5. The method according to claim 4, characterized in that The method further comprises: monitoring an editing operation on second rule input information corresponding to a second rule expression in the rule base; In response to the editing operation, editing the second rule input information; Parsing the edited second rule input information to generate an updated second rule expression; The second regular expression in the rule base is updated using the updated second regular expression.

6. The method according to claim 5, characterized in that The method further comprises: Performing regression testing on each rule expression in the rule base to generate a target test data list; Acquire a reference test data list, wherein the reference test data list is a test data list generated by performing a regression test on each rule expression in the rule base for the first time or the most recent time; The target test data list is compared with the reference test data list to determine target test data in the target test data list that is different from the reference test data list, so as to determine whether the rule base contains abnormal rule expressions according to the target test data.

7. The method according to claim 6, characterized in that The method further comprises: When it is determined according to the target test data that the rule library contains abnormal rule expressions, prompt information is sent to prompt the abnormal rule expressions to be updated.

8. An authentication device, characterized in that: The device comprises: a receiving module configured to receive an authentication request sent by a client, wherein the authentication request is generated by the client, when detecting a triggering operation on a target component in a currently displayed target page, determining a target role corresponding to the client based on login information of the client, and based on a business identifier of a target business to which the target component belongs and the target role; a response module configured to, in response to the authentication request, obtain a service attribute corresponding to the service identifier according to the service identifier; an acquisition module configured to determine a category corresponding to the business attribute and acquire a target rule expression matching the category corresponding to the business attribute from a rule base; an authentication module configured to perform authentication processing on the target role and business attributes according to the target rule expression, and determine an authentication result, so as to determine whether the client has the operation authority for the target component according to the authentication result; The authentication module is configured to create a driver for parsing the target regular expression; Using the driver to assign values ​​to the parameters in the target rule expression according to the target role and business attributes to obtain the authentication result; When the authentication result satisfies a set condition, determining that the client has the operation authority for the target component; When the authentication result does not meet the set condition, it is determined that the client does not have the operation authority for the target component.

9. The device according to claim 8, characterized in that The acquisition module is configured to: Obtaining a category corresponding to the business attribute, and obtaining a rule expression matching the category from the rule library as the target rule expression; or, The permission name corresponding to the business attribute is obtained, and a rule expression matching the permission name is obtained from the rule library as the target rule expression.

10. The device according to claim 8, characterized in that The authentication request also includes user attributes determined by the client according to the login information, and the authentication module is configured to: The driver is used to assign values ​​to various parameters in a target rule expression according to the target role, the service attributes, and the user attributes to obtain the authentication result.

11. The device according to any one of claims 8 to 10, characterized in that The acquisition module is further configured to acquire first rule input information; The device further comprises: a generating module configured to parse the first rule input information to generate a first regular expression; The adding module is configured to add the first rule expression and the first rule input information to the rule base accordingly.

12. The device according to claim 11, characterized in that The device further comprises: A monitoring module is configured to monitor an editing operation on second rule input information corresponding to a second rule expression in the rule base; an editing module, configured to edit the second rule input information in response to the editing operation; a parsing module configured to parse the edited second rule input information to generate an updated second rule expression; The updating module is configured to update the second regular expression in the rule base by using the updated second regular expression.

13. The device according to claim 12, characterized in that The device further comprises: A testing module is configured to perform regression testing on each rule expression in the rule base to generate a target test data list; The acquisition module is further configured to acquire a reference test data list, wherein the reference test data list is a test data list generated by performing a regression test on each rule expression in the rule base for the first time or the most recent time; The comparison module is configured to compare the target test data list with the reference test data list to determine target test data in the target test data list that is different from the reference test data list, so as to determine whether there is an abnormal rule expression in the rule base according to the target test data.

14. The device according to claim 13, characterized in that The device further comprises: The sending module is configured to send prompt information to prompt the user to update the abnormal rule expression when it is determined according to the target test data that the rule library has an abnormal rule expression.

15. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the authentication method according to any one of claims 1 to 7. 16 . A computer-readable storage medium, wherein when instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the authentication method according to claim 1 .

17. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the authentication method according to any one of claims 1 to 7 is implemented.

Images