Access control method, apparatus and device

Abstract

The application provides an access control method, device and equipment, applied to the technical field of information security, and the method comprises the steps of: obtaining a service processing request, wherein the service processing request comprises the identification of a first service and user information; determining a plurality of first ports corresponding to the first service, and determining a target port in the plurality of first ports; determining a permission verification result according to the user information and the target port; when the permission verification result is a verification success, performing service processing according to the service processing request. The complexity of user permission verification is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to an access control method, device and equipment. BACKGROUND

[0002] When a user accesses a business system (such as an information query system) through a terminal device, a server needs to verify the identity of the user to determine whether the user can access the business system.

[0003] At present, when a user accesses a business system through a terminal device, a server needs to obtain all application programming interfaces (APIs) required for accessing the business system, and verifies the identity of the user through a verification unit corresponding to each API. When all the APIs are verified successfully, the user can access the business system. However, in the above method, a corresponding verification unit needs to be set for each API, and when the number of APIs is large, the complexity of user permission verification is high. SUMMARY

[0004] The present application provides an access control method, device and equipment, which are used to solve the technical problem of high complexity of user permission verification in the prior art.

[0005] In a first aspect, the present application provides an access control method, which comprises the following steps:

[0006] obtaining a business processing request, wherein the business processing request comprises the identity of a first business and user information;

[0007] determining a plurality of first ports corresponding to the first business, and determining a target port in the plurality of first ports;

[0008] determining a permission verification result according to the user information and the target port;

[0009] when the permission verification result is verification success, performing business processing according to the business processing request.

[0010] In a possible implementation, the plurality of first ports corresponding to the first business are determined, which comprises the following steps:

[0011] determining whether the first business has a verification requirement;

[0012] when it is determined that the first business has the verification requirement, determining the plurality of first ports corresponding to the first business.

[0013] In a possible implementation, whether the first business has the verification requirement is determined, which comprises the following steps:

[0014] obtaining a target uniform resource locator (URL) corresponding to the first service;

[0015] determining whether the first service has a verification requirement according to the URL.

[0016] In a possible implementation, when it is determined that the first service has the verification requirement, a plurality of first ports corresponding to the first service are determined, including:

[0017] When it is determined that the first service has the verification requirement, a first correspondence relationship is obtained, the first correspondence relationship including a plurality of service identifiers and a plurality of ports corresponding to each service identifier;

[0018] According to the identifier of the first service and the first correspondence relationship, a plurality of first ports corresponding to the first service are determined.

[0019] In a possible implementation, a target port is determined from the plurality of first ports, including:

[0020] obtaining a calling sequence between the plurality of first ports;

[0021] According to the calling sequence between the plurality of first ports, the target port is determined from the plurality of first ports.

[0022] In a possible implementation, according to the calling sequence between the plurality of first ports, the target port is determined from the plurality of first ports, including:

[0023] According to the calling sequence between the plurality of first ports, a root port corresponding to the first service is determined from the plurality of first ports, the root port being a first port called by the first service;

[0024] The root port corresponding to the first service is determined as the target port.

[0025] In a possible implementation, the user information includes a user identifier; according to the user information and the target port, a permission verification result is determined, including:

[0026] determining a target permission identifier corresponding to the target port;

[0027] determining whether the user identifier corresponds to the target permission identifier;

[0028] If yes, it is determined that the permission verification result is a verification success;

[0029] If no, it is determined that the permission verification result is a verification failure.

[0030] In a possible implementation, the method further includes:

[0031] obtain port access information corresponding to the first service, the port access information including the multiple first ports corresponding to the first service and calling sequences between the multiple first ports;

[0032] configure permission identifiers of the multiple first ports according to the port access information.

[0033] In a possible implementation, the configuring of the permission identifiers of the multiple first ports according to the port access information includes:

[0034] determining a root port corresponding to the first service in the multiple first ports according to the port access information, the root port being a first port called by the first service;

[0035] generating a permission identifier corresponding to the root port;

[0036] setting permission identifiers of other ports in the multiple first ports except the root port according to the permission identifier corresponding to the root port.

[0037] In a possible implementation, the generating of the permission identifier corresponding to the root port includes:

[0038] obtaining an access path corresponding to the root port;

[0039] generating the permission identifier corresponding to the root port according to the access path corresponding to the root port.

[0040] In a possible implementation, the setting of the permission identifiers of the other ports in the multiple first ports except the root port according to the permission identifier corresponding to the root port includes:

[0041] setting the permission identifier corresponding to the root port as the permission identifiers of the other ports in the multiple first ports except the root port.

[0042] In a second aspect, the present application provides an access control apparatus, which includes a first obtaining module, a first determining module, a second determining module and a processing module, wherein:

[0043] The first obtaining module is configured to obtain a service processing request, the service processing request including an identifier of a first service and user information;

[0044] The first determining module is configured to determine multiple first ports corresponding to the first service and determine a target port in the multiple first ports;

[0045] The second determining module is configured to determine a permission verification result according to the user information and the target port.

[0046] The processing module is configured to perform the service processing according to the service processing request when the permission verification result is a verification success.

[0047] In a possible implementation, the first determining module is specifically configured to:

[0048] determine whether the first service has a verification requirement;

[0049] determine a plurality of first ports corresponding to the first service when it is determined that the first service has the verification requirement.

[0050] In a possible implementation, the first determining module is specifically configured to:

[0051] obtain a target uniform resource locator (URL) corresponding to the first service;

[0052] determine whether the first service has a verification requirement according to the URL.

[0053] In a possible implementation, the first determining module is specifically configured to:

[0054] obtain a first correspondence relationship including a plurality of service identifiers and a plurality of ports corresponding to each service identifier when it is determined that the first service has the verification requirement;

[0055] determine a plurality of first ports corresponding to the first service according to the identifier of the first service and the first correspondence relationship.

[0056] In a possible implementation, the first determining module is specifically configured to:

[0057] obtain a calling sequence between the plurality of first ports;

[0058] determine the target port from the plurality of first ports according to the calling sequence between the plurality of first ports.

[0059] In a possible implementation, the first determining module is specifically configured to:

[0060] determine a root port corresponding to the first service from the plurality of first ports according to the calling sequence between the plurality of first ports, the root port being a first port called by the first service;

[0061] determine the root port corresponding to the first service as the target port.

[0062] In a possible implementation, the first determining module is specifically configured to:

[0063] determine a target permission identifier corresponding to the target port;

[0064] determine whether the user identifier corresponds to the target permission identifier;

[0065] if yes, determine that the permission verification result is a verification success;

[0066] if no, determine that the permission verification result is a verification failure.

[0067] In a possible implementation, the access control apparatus further includes a second acquisition module, which is configured to:

[0068] acquire port access information corresponding to the first service, the port access information including the multiple first ports corresponding to the first service and a calling sequence between the multiple first ports;

[0069] configure permission identifiers of the multiple first ports according to the port access information.

[0070] In a possible implementation, the second acquisition module is specifically configured to:

[0071] determine a root port corresponding to the first service in the multiple first ports according to the port access information, the root port being a first port called by the first service;

[0072] generate a permission identifier corresponding to the root port;

[0073] set permission identifiers of other ports in the multiple first ports except the root port according to the permission identifier corresponding to the root port.

[0074] In a possible implementation, the second acquisition module is specifically configured to:

[0075] acquire an access path corresponding to the root port;

[0076] generate the permission identifier corresponding to the root port according to the access path corresponding to the root port.

[0077] In a possible implementation, the second acquisition module is specifically configured to:

[0078] set the permission identifier corresponding to the root port as the permission identifiers of the other ports in the multiple first ports except the root port.

[0079] In a third aspect, an embodiment of the present disclosure provides a terminal device, including a processor and a memory.

[0080] The memory stores computer execution instructions.

[0081] The processor executes computer execution instructions stored in the memory, so that the at least one processor executes the access control method as described in the first aspect and various possible designs of the first aspect.

[0082] In a fourth aspect, the embodiments of the present disclosure provide a computer readable storage medium, and the computer readable storage medium stores computer execution instructions, and when a processor executes the computer execution instructions, the access control method as described in the first aspect and various possible designs of the first aspect is implemented.

[0083] In a fifth aspect, the embodiments of the present disclosure provide a computer program product, and the computer program product includes a computer program, and when a processor executes the computer program, the access control method as described in the first aspect and various possible designs of the first aspect is implemented.

[0084] The present application provides an access control method, device and equipment, the server acquires the service access request, and the service access request includes the identification of the first service and the user information, determines the plurality of first ports corresponding to the first service, and determines the target port in the plurality of first ports, determines the permission verification result according to the user information and the target port, and when the permission verification result is verification success, the service processing request is processed according to the service processing request. In the above method, when the server acquires the service access request, the server can perform permission verification on the user information according to one of the plurality of first ports corresponding to the first service, so that when the user uses the terminal equipment to access the first service, the server only needs to perform permission verification once, and the permission verification result corresponding to the user can be obtained, thereby reducing the complexity of user permission verification. BRIEF DESCRIPTION OF DRAWINGS

[0085] Figure 1 A service scenario schematic diagram is provided for the embodiments of the present application;

[0086] Figure 2 A flowchart of an access control method is provided for the embodiments of the present application;

[0087] Figure 3 A structure schematic diagram of a resource access tree is provided for the embodiments of the present application;

[0088] Figure 4 A process schematic diagram of determining a permission verification result is provided for the embodiments of the present application;

[0089] Figure 5 A method flowchart of configuring a permission identifier is provided for the embodiments of the present application;

[0090] Figure 6 A process schematic diagram of an access control method is provided for the embodiments of the present application;

[0091] Figure 7 A structural schematic diagram of an access control device provided in an embodiment of the present application is shown in FIG. 1.

[0092] Figure 8 A structural schematic diagram of another access control device provided in an embodiment of the present application is shown in FIG. 2.

[0093] Figure 9 A hardware structural schematic diagram of a terminal device provided in the present application is shown in FIG. 3. DETAILED DESCRIPTION

[0094] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The following description is only exemplary and is not intended to limit the scope, applicability or configuration of the application. Rather, the scope of the protection is defined by the claims and the embodiments described herein are intended to be illustrative, and not restrictive, of the scope of the application.

[0095] It should be noted that, in this document, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0096] In the technical solutions of the present application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data, etc. comply with relevant laws and regulations and do not violate public order and good customs.

[0097] In the related art, when a user uses a terminal device to access a service system, a server needs to verify the identity of the user to determine whether the user can access the service system. For example, when the user uses the terminal device to query personal information in a bank, the bank server needs to verify whether the user can query the corresponding personal information. At present, the server needs to obtain all APIs required for accessing the service system, and verifies the identity of the user through a verification unit corresponding to each API. When all APIs are verified successfully, the user can access the service system. For example, the API corresponding to the service system A is interface A and interface B. When the user uses the terminal device to access the service system A, the verification systems corresponding to interface A and interface B can respectively verify the authority of the user. When the two verification systems are verified successfully, the user can access the service system. However, each API needs to set a corresponding verification unit. When the number of APIs is large, the complexity of user authority verification is high.

[0098] To solve the technical problem of high complexity of user authority verification in the related art, the embodiment of the present application provides an access control method. The server obtains a service access request including the identification of a first service and user information. When the server determines that the first service has verification requirements, the server determines a plurality of first ports corresponding to the first service, and obtains the calling order between the plurality of first ports. The server determines a target port in the plurality of first ports according to the calling order, and determines an authority verification result according to the user information and the target port. When the authority verification result is verification success, the server performs service processing according to the service processing request. In this way, since the server can perform authority verification on the user information according to one of the plurality of first ports corresponding to the first service, when the user uses the terminal device to access the first service, the server only needs to perform authority verification once to obtain the authority verification result corresponding to the user, thereby reducing the complexity of user authority verification.

[0099] In the following, the application scenario of the embodiment of the present application is introduced. Figure 1 The application scenario of the embodiment of the present application is introduced.

[0100] Figure 1 A service scenario provided by the embodiment of the present application is provided. Please refer to Figure 1 , which includes a terminal device and a server. The server is in communication connection with the terminal device. The server can be connected with a service system A and a service system B. The service system A can perform service A processing, and the service system B can perform service B processing. The calling interface corresponding to the service system A includes interface A and interface B, and the calling interface corresponding to the service system B includes interface C and interface D.

[0101] Please refer to Figure 1When the terminal device sends the processing request of the service B to the server, the server determines that the processing request needs to call the interface C and the interface D in the service system B, and determines that the permission verification result is successful by processing the user information in the processing request and the interface C, and then processes the service B. In this way, when the terminal device sends the processing request of the service B to the server, if the permission verification result of the interface C of the service system B of the server is successful, the server can process the service B in the service system B, and the server does not need to perform permission verification on the interface D in the service system B. Therefore, the server only needs to perform permission verification once to obtain the permission verification result corresponding to the user, thereby reducing the complexity of user permission verification.

[0102] The technical solutions of the present disclosure and how the technical solutions of the present disclosure solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present disclosure will be described below with reference to the accompanying drawings.

[0103] Figure 2 A flowchart of an access control method provided by an embodiment of the present application is shown in FIG. 1. The method can include the following steps. Figure 2 The method can include the following steps.

[0104] S201, obtaining a service processing request.

[0105] The execution subject of the embodiment of the present application can be a server, or an access control device provided in the server. The access control device can be implemented by software, or by a combination of software and hardware.

[0106] Optionally, the service processing request can be a service access request. For example, the service processing request can be a request to access a page, a request to access an application program, a request to access a database, etc. The service processing request includes the identification of the first service and user information. Optionally, the identification of the first service is the identification of the service to be processed. For example, if the user accesses the service system A through the terminal device, the identification of the first service is the identification of the service system A, and if the user accesses the service system B through the terminal device, the identification of the first service is the identification of the service system B. For example, the identification of the first service can be the ID of the system to be accessed, the address of the system to be accessed, etc. The user information can be the identity information of the user. For example, the user information can be the account of the user, the ID of the user, etc.

[0107] Optionally, the server can receive a service processing request sent by the terminal device. For example, when a user accesses a corresponding page or application program through the terminal device, the terminal device sends a service processing request to the server, and when the service processing request is processed, the terminal device can access the corresponding page or application program. For example, when the user clicks the application program of the terminal device, the terminal device generates a service access request including user information and an application program identifier, and after the server receives the service access request, it can be determined whether the user can access the application program.

[0108] S202, a plurality of first ports corresponding to the first service are determined, and a target port is determined in the plurality of first ports.

[0109] Optionally, the first port can be a calling port corresponding to the first service. For example, if the first service is to access service system A, the first port can be a port required to be called to access service system A. For example, if a user queries the user loan information of a bank through a terminal device, the server needs to call the bank page interface, the user grouping interface, the loan page interface, the query interface, etc., to query the user's loan information.

[0110] Optionally, the plurality of first ports corresponding to the first service can be determined according to the following possible implementation manner: it is judged whether the first service has a verification requirement. Optionally, the verification requirement is a condition when the server executes the first service. For example, when the terminal device accesses service system A, if service system A is a private service system, the terminal device accessing service system A needs to have a verification requirement, and if service system A is a service system that can be accessed by any user, the terminal device does not need to be verified when accessing service system A, and service system A does not have a verification requirement.

[0111] Optionally, whether the first service has a verification requirement can be determined according to the following possible implementation manner: a target uniform resource locator system URL corresponding to the first service is obtained. The URL can be an identifier corresponding to the first service. For example, the URL can be an address corresponding to the first service. It is judged whether the first service has a verification requirement according to the URL. Optionally, whether the first service has a verification requirement can be determined in a preset database according to the URL. The preset database includes a plurality of URLs corresponding to services, and each URL indicates a service with a verification requirement. For example, the preset database includes service identifier A, service identifier B, and service identifier C, if the identifier of the first service is service identifier A, it is determined that the first service has a verification requirement, and if the identifier of the first service is service identifier D, it is determined that the first service does not have a verification requirement.

[0112] When it is determined that the first service has the authentication requirement, the server determines the first ports corresponding to the first service. For example, when the server determines that the first service needs to be authenticated, the server determines the first ports corresponding to the first service. When the server determines that the first service does not need to be authenticated, the server does not need to determine the first ports corresponding to the first service.

[0113] Optionally, the server can determine the first ports corresponding to the first service according to the following possible implementation manner: when it is determined that the first service has the authentication requirement, the server acquires the first correspondence. The first correspondence includes a plurality of service identifiers and a plurality of ports corresponding to each service identifier. For example, the first correspondence can be as shown in Table 1:

[0114] Table 1

[0115]

[0116] It should be noted that Table 1 is only an example of the first correspondence and is not a limitation of the first correspondence.

[0117] According to the identifier of the first service and the first correspondence, the server determines the first ports corresponding to the first service. For example, if the identifier of the first service is service identifier 1, the first ports corresponding to the first service include port 1 and port 2. If the identifier of the first service is service identifier 2, the first ports corresponding to the first service include port 3 and port 4.

[0118] Optionally, the target port can be a port to be authenticated. For example, when the terminal device accesses the service system A, the server needs to call port A and port B. If the server authenticates the port A and determines the authentication result, the target port is port A. If the server authenticates the port B and determines the authentication result, the target port is port B.

[0119] Optionally, the target port can be determined in the plurality of first ports according to the following possible implementation manner: the server acquires the calling sequence between the plurality of first ports. Optionally, the calling sequence is the sequence in which the server calls the plurality of first ports. For example, when the terminal device accesses the service system A, the server needs to call port A, port B, and port C. If the server calls port A first, then port B, and finally port C, the calling sequence between the plurality of first ports corresponding to the service system A is: port A, port B, and port C.

[0120] Optionally, when the plurality of first ports corresponding to the first service are preconfigured, the server can acquire the calling sequence of the plurality of first ports. For example, the server can acquire the calling sequence of the plurality of first ports corresponding to the first service by performing forward and reverse resource scanning on the first service.

[0121] According to the calling sequence between the plurality of first ports, the target port is determined in the plurality of first ports. Optionally, the server determines the root port corresponding to the first service in the plurality of first ports according to the calling sequence between the plurality of first ports. The root port is the first port called by the first service. For example, if the server calls port A first and then port B when executing the first service, the root port corresponding to the plurality of first ports of the first service is port A.

[0122] The root port corresponding to the first service is determined as the target port. For example, if the root port corresponding to the first service is port A, the server determines port A as the target port in the plurality of first ports. Optionally, after the server determines the plurality of first ports and the calling sequence of the plurality of first ports, the server can construct a resource access tree corresponding to the first service, and the resource access tree includes all first ports corresponding to the first service and the calling sequence between the plurality of first ports. The server can determine the target port through the resource access tree.

[0123] Next, the resource access tree is described in combination with Figure 3 .

[0124] Figure 3 A structure diagram of a resource access tree provided by an embodiment of the present application is shown. Please refer to Figure 3 , which includes a resource access tree of the first service. The resource access tree of the first service includes an external port, an application A port, an application B port, a module port, and a list port. In the resource access tree, the external port is the root port corresponding to the first service, and the calling sequence of the plurality of first ports when the server processes the first service is: the external port, the application A port, the module port, the list port, and the application B port. Optionally, the server can accurately determine the plurality of first ports corresponding to the first service and the calling relationship between the plurality of first ports according to the resource access tree corresponding to the first service.

[0125] S203, according to the user information and the target port, determine the permission verification result.

[0126] Optionally, the user information can include a user identifier. For example, the user information can be a user account, a user ID, a user fingerprint, a user face, and the like. Optionally, the permission verification result can be determined according to the following possible implementation manner: determining the target permission identifier corresponding to the target port. Optionally, the target permission identifier is a permission identifier configured in advance for the target port. For example, the server can configure a corresponding permission identifier for the target port, and then perform permission verification on the user through the permission identifier.

[0127] determining whether the user identifier corresponds to the target permission identifier. For example, if the user identifier corresponds to multiple permission identifiers that include the target permission identifier, it is determined that the user identifier corresponds to the target permission identifier. If the user identifier corresponds to multiple permission identifiers that do not include the target permission identifier, it is determined that the user identifier does not correspond to the target permission identifier.

[0128] Optionally, in actual application, the server can pre-configure multiple permission identifiers for each user. The server can determine the multiple permission identifiers corresponding to the user according to the user identifier, and then determine whether the target permission identifier is included in the multiple permission identifiers. Optionally, the multiple permission identifiers corresponding to the user can be determined according to a second correspondence between the user identifier and the permission identifier. The second correspondence can include multiple user identifiers and at least one permission identifier corresponding to each user identifier. For example, the second correspondence between the user identifier and the permission identifier can be as shown in Table 2:

[0129] Table 2

[0130]

[0131]

[0132] It should be noted that Table 2 is only an example of the second correspondence and is not a limitation of the second correspondence.

[0133] According to the user identifier and the second correspondence, the multiple permission identifiers corresponding to the user identifier are determined. For example, if the user identifier is user identifier 1, the permission identifiers corresponding to the user identifier include permission identifier 1, permission identifier 2, and permission identifier 3; if the user identifier is user identifier 2, the permission identifiers corresponding to the user identifier include permission identifier 4 and permission identifier 5; and if the user identifier is user identifier 3, the permission identifiers corresponding to the user identifier include permission identifier 6.

[0134] Optionally, the server determines whether the user identifier corresponds to the target permission identifier. If yes, it is determined that the permission verification result is verification success. If no, it is determined that the permission verification result is verification failure. For example, the target permission identifier is permission identifier 1. If the server determines that the permission identifiers corresponding to the user identifier include permission identifier 1, permission identifier 2, and permission identifier 3 according to the user identifier, the server determines that the target permission identifier is included in the permission identifiers corresponding to the user identifier, and the server determines that the permission verification result is verification success. If the server determines that the permission identifiers corresponding to the user identifier include permission identifier 2, permission identifier 3, and permission identifier 4 according to the user identifier, the server determines that the target permission identifier is not included in the permission identifiers corresponding to the user identifier, and the server determines that the permission verification result is verification failure.

[0135] In the following, the above-mentioned embodiments will be described in detail in combination with Figure 4The process of determining the permission verification result is described.

[0136] Figure 4 A process diagram for determining the permission verification result is provided in the embodiments of the present application. Please refer to Figure 4 , which comprises a resource access tree of the first service. The resource access tree of the first service comprises an external port, an application port, a module port and a list port. In the resource access tree of the first service, the root port is the external port. The server determines that the permission identifier corresponding to the external port is permission identifier A.

[0137] Please refer to Figure 4 , the server can determine the permission identifier corresponding to the user identifier. The permission identifier corresponding to the user identifier comprises permission identifier A, permission identifier B and permission identifier C. Since the permission identifier corresponding to the user identifier comprises permission identifier A, the permission verification result of the server for the first service is that the verification is passed.

[0138] S204, when the permission verification result is that the verification is successful, the service processing is performed according to the service processing request.

[0139] Optionally, when the permission verification result is that the verification is successful, the server can send the service information corresponding to the first service to the terminal device, so that the terminal device accesses the service information corresponding to the first service. For example, the user accesses the personal credit information of the bank application through the terminal device. If the permission verification result of the server for the user is that the verification is successful, the terminal device can access the personal credit information of the bank application. If the permission verification result of the server for the user is that the verification is failed, the terminal device cannot access the personal credit information of the bank application.

[0140] The embodiments of the present application provide an access control method. The server obtains a service processing request comprising a first service identifier and user information. When it is determined that the first service has a verification requirement, the server obtains a first correspondence relationship between the service identifier and the port, determines a plurality of first ports corresponding to the first service according to the identifier of the first service and the first correspondence relationship, determines a target port in the first ports according to the calling sequence of the plurality of first ports, and determines a permission verification result according to the user information and the target port. When the permission verification result is that the verification is successful, the service processing is performed according to the service processing request. In the above method, according to the first correspondence relationship, the plurality of first ports corresponding to the first service and the calling sequence can be accurately determined, and then the target port can be accurately determined. When the permission of the user accessing the first service is verified according to the user information and the target port, the server only needs to perform permission verification once, and the permission verification result corresponding to the user can be obtained, thereby reducing the complexity of the user permission verification.

[0141] In Figure 2On the basis of the embodiment shown, the access control method in the embodiment of the present application further includes a process of configuring permission identifiers of the plurality of first ports. In the following, the process of configuring the permission identifiers of the plurality of first ports is described in combination with Figure 5 The process of configuring the permission identifiers of the plurality of first ports is described.

[0142] Figure 5 A method flowchart of configuring permission identifiers is provided in the embodiment of the present application. Please refer to Figure 5 The method flowchart includes:

[0143] S501, obtaining port access information corresponding to a first service.

[0144] Optionally, the port access information includes a plurality of first ports corresponding to the first service and a calling sequence between the plurality of first ports. Optionally, the first port can be an API called by the first service.

[0145] Optionally, the server can include a resource collection device, wherein the resource collection device is configured to collect each service in the server and a plurality of first ports corresponding to each service. For example, the resource collection device in the server can collect all resource services (all API interfaces) provided by the business system. For example, in the actual application process, after the server controls the business system to start, all URL paths can be scanned and acquired, and the storage of the API completes the URL path, and then the plurality of first ports corresponding to the business system can be acquired.

[0146] When a service processing request is performed, the same business system can undertake a plurality of services, and the API called by each service can be different. Therefore, the server also needs to determine the corresponding service for the plurality of first ports. For example, the business system can support service A and service B, and the business system includes port A, port B and port C. When service A is performed, port A and port B need to be called, and when service B is performed, port B and port C need to be called. Therefore, the first port corresponding to service A is port A and port B, and the first port corresponding to service B is port B and port C.

[0147] Optionally, the server can comprise a link monitoring device. The server can obtain all ports called during execution of a service and the calling sequence of the ports through the link monitoring device. For example, when a user accesses page A using a terminal device, the terminal device triggers a network request for accessing page A, and the link monitoring device can record the ID of the initial link (i.e., the first port called). The link monitoring device can obtain the external request interface (i.e., the second port called) initiated by the microservice (i.e., page A). If the microservice continues to initiate the external request interface, the link monitoring device can continue to obtain the external request interface until page A is opened. The link monitoring device can obtain all ports called by the server during opening of page A and the calling sequence of the ports. In this way, the server can obtain a plurality of first ports corresponding to the service of accessing page A and the calling sequence of the plurality of first ports.

[0148] The server can obtain all ports provided by the service system through the resource collection device and obtain the ports corresponding to each service and the calling sequence of the ports through the link monitoring device. Thus, the server can obtain the port access information corresponding to the first ports.

[0149] S502, configure the permission identifier of the plurality of first ports according to the port access information.

[0150] Optionally, the permission identifier can be used to verify the port. For example, the permission identifier can be the password of the port. If the permission identifier of the port is included in the access request, the permission verification of the port on the access request is passed. If the permission identifier of the port is not included in the access request, the permission verification of the port on the access request is failed.

[0151] Optionally, the permission identifier of the plurality of first ports can be configured according to the following possible implementation manner: determining the root port corresponding to the first service in the plurality of first ports according to the port access information, wherein the root port is the first port called by the first service. For example, the first ports corresponding to service A include port A, port B and port C. If the first port called by the server during processing of service A is port A, the server determines port A as the root port corresponding to service A.

[0152] Generating the permission identifier corresponding to the root port. Optionally, the permission identifier corresponding to the root port can be generated according to the following possible implementation manner: obtaining the access path corresponding to the root port, and generating the permission identifier corresponding to the root port according to the access path corresponding to the root port. For example, the permission identifier of the root port can be the URL address of the root port. The permission identifier of the root port can also be an identifier in other formats (e.g., Rest API), which is not limited in the embodiment of the application.

[0153] According to the permission identifier corresponding to the root port, the server sets the permission identifiers of the other ports in the plurality of first ports except the root port. Optionally, the server can set the permission identifier corresponding to the root port as the permission identifiers of the other ports in the plurality of first ports except the root port. For example, the first port corresponding to the first service includes port A, port B and port C, wherein the port A is the root port corresponding to the first service. If the permission identifier of the port A generated by the server is identifier A, the server sets the permission identifiers of the port B and the port C as identifier A. If the permission identifier of the port A generated by the server is identifier B, the server sets the permission identifiers of the port B and the port C as identifier B. In this way, the problem of mismatching of the upstream and downstream resource permissions can be solved.

[0154] Optionally, after setting the permission identifiers of the other ports in the plurality of first ports except the root port according to the permission identifier corresponding to the root port, the server can further establish the upstream and downstream relationships among the plurality of first ports. For example, if the plurality of first ports include a port with a deletion function, a port with an addition function or a port with a modification function, after the server configures the permission identifiers for the three kinds of ports, in order to distinguish the upstream and downstream relationships with the root node, the server can configure corresponding identifiers (such as deletion identifier, addition identifier or modification identifier) for the three kinds of ports. In this way, if the user permission includes the permissions of the three kinds of ports (for example, the user permission includes the deletion identifier, the addition identifier or the modification identifier), the default user permission also includes the permission of the root node.

[0155] The embodiment of the application provides a method for configuring a permission identifier. The server can obtain port access information corresponding to a first service, wherein the port access information includes a plurality of first ports corresponding to the first service and a calling sequence among the plurality of first ports. According to the port access information, the server determines a root port corresponding to the first service in the plurality of first ports. The server generates a permission identifier corresponding to the root port, and sets the permission identifier corresponding to the root port as the permission identifiers of the other ports in the plurality of first ports except the root port. In this way, the server can set the permission identifiers of all the first ports corresponding to each service as the permission identifier of the root port. When processing the service, the server only needs to verify the permission corresponding to the root port, and does not need to verify the permissions of the other ports. This can not only reduce the complexity of adding the permission identifier, but also reduce the complexity of verifying the user permission.

[0156] On the basis of any one of the above embodiments, the following will be described in combination with Figure 6 The process of the above access control method is described.

[0157] Figure 6 The process of the access control method provided by the embodiment of the application is described. Please refer to Figure 6, including terminal equipment and a server. The terminal equipment sends a service processing request to the server, wherein the service processing request includes an identification of a first service and a user identification. The server determines, according to the first service identification, that a first port corresponding to the first service identification includes port A, port B and port C. When processing the first service, the server first calls port A, then calls port B, and finally calls port C.

[0158] See Figure 6 , the server determines port A as a root port corresponding to the first service, and obtains a target permission identification of port A as permission identification A. The server obtains a permission identification corresponding to the user identification according to the user identification, wherein the permission identification corresponding to the user identification includes permission identification A and permission identification B. Since the permission identification corresponding to the user identification includes permission identification A, the permission verification result of the first service is verified, and the server can process the first service. In this way, the server only needs to perform permission verification once to obtain the permission verification result corresponding to the user, which not only reduces the complexity of adding permission identifications, but also reduces the complexity of user permission verification.

[0159] Figure 7 A structural schematic diagram of an access control device provided by an embodiment of the present application. See Figure 7 The access control device 10 includes a first acquisition module 11, a first determination module 12, a second determination module 13 and a processing module 14, wherein:

[0160] The first acquisition module 11 is configured to acquire a service processing request, wherein the service processing request includes an identification of a first service and user information;

[0161] The first determination module 12 is configured to determine a plurality of first ports corresponding to the first service, and determine a target port in the plurality of first ports;

[0162] The second determination module 13 is configured to determine a permission verification result according to the user information and the target port;

[0163] The processing module 14 is configured to, when the permission verification result is verified successfully, perform service processing according to the service processing request.

[0164] In a possible implementation, the first determination module 12 is specifically configured to:

[0165] determine whether the first service has verification requirements;

[0166] determine a plurality of first ports corresponding to the first service when it is determined that the first service has verification requirements.

[0167] In a possible implementation, the first determining module 12 is specifically configured to:

[0168] obtain a target uniform resource locator (URL) corresponding to the first service;

[0169] determine whether the first service has a verification requirement according to the URL.

[0170] In a possible implementation, the first determining module 12 is specifically configured to:

[0171] obtain a first correspondence relationship including a plurality of service identifiers and a plurality of ports corresponding to each service identifier, when it is determined that the first service has a verification requirement.

[0172] determine a plurality of first ports corresponding to the first service according to the identifier of the first service and the first correspondence relationship.

[0173] In a possible implementation, the first determining module 12 is specifically configured to:

[0174] obtain a calling sequence between the plurality of first ports;

[0175] determine the target port from the plurality of first ports according to the calling sequence between the plurality of first ports.

[0176] In a possible implementation, the first determining module 12 is specifically configured to:

[0177] determine a root port corresponding to the first service from the plurality of first ports according to the calling sequence between the plurality of first ports, the root port being a first port called by the first service;

[0178] determine the root port corresponding to the first service as the target port.

[0179] In a possible implementation, the first determining module 12 is specifically configured to:

[0180] determine a target permission identifier corresponding to the target port;

[0181] determine whether the user identifier corresponds to the target permission identifier;

[0182] if yes, determine that the permission verification result is a verification success;

[0183] if no, determine that the permission verification result is a verification failure.

[0184] The access control apparatus provided in the embodiment can be used to execute the technical solutions of the method embodiments, and has similar implementation principles and technical effects, which will not be described here again.

[0185] Figure 8 Another structure schematic diagram of an access control device provided by an embodiment of the present application is provided. Figure 7 Based on the embodiment shown, please refer to Figure 8 The access control device 10 further comprises a second acquisition module 15, which is configured to:

[0186] acquire port access information corresponding to the first service, wherein the port access information comprises the multiple first ports corresponding to the first service and a calling sequence between the multiple first ports;

[0187] configure the permission identifier of the multiple first ports according to the port access information.

[0188] In a possible implementation, the second acquisition module 15 is specifically configured to:

[0189] determine a root port corresponding to the first service from the multiple first ports according to the port access information, wherein the root port is the first port called by the first service;

[0190] generate the permission identifier corresponding to the root port;

[0191] set the permission identifier of the other ports except the root port from the multiple first ports according to the permission identifier corresponding to the root port.

[0192] In a possible implementation, the second acquisition module 15 is specifically configured to:

[0193] acquire an access path corresponding to the root port;

[0194] generate the permission identifier corresponding to the root port according to the access path corresponding to the root port.

[0195] In a possible implementation, the second acquisition module 15 is specifically configured to:

[0196] set the permission identifier corresponding to the root port as the permission identifier of the other ports except the root port from the multiple first ports.

[0197] The access control device provided by the embodiment can be used to execute the technical solutions of the method embodiments, and has similar implementation principles and technical effects, which will not be described here again.

[0198] Figure 9 A hardware structure schematic diagram of a terminal device provided by the present application is provided. Please refer to Figure 9The terminal device 20 can include a processor 21 and a memory 22, wherein the processor 21 and the memory 22 can communicate; for example, the processor 21 and the memory 22 communicate through a communication bus 23, the memory 22 is configured to store program instructions, and the processor 21 is configured to invoke the program instructions in the memory to perform the access control method shown in any method embodiment described above.

[0199] Optionally, the terminal device 20 can further include a communication interface, and the communication interface can include a transmitter and / or a receiver.

[0200] Optionally, the processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor and the like. The steps of the method disclosed in the present application can be directly embodied as hardware processor execution, or executed by a combination of hardware and software modules in the processor.

[0201] The present application provides a readable storage medium, and the readable storage medium stores a computer program; the computer program is used to implement the access control method according to any of the above embodiments.

[0202] The present application provides a computer program product, and the computer program product includes instructions, when the instructions are executed, the computer executes the access control method.

[0203] All or part of the steps of the above method embodiments can be completed by program instruction related hardware. The foregoing program can be stored in a readable memory. When the program is executed, the steps of the foregoing method embodiments are executed; and the foregoing memory (storage medium) includes: a read-only memory (English: read-only memory, abbreviation: ROM), a RAM, a flash memory, a hard disk, a solid state disk, a magnetic tape (English: magnetic tape), a floppy disk (English: floppy disk), an optical disc (English: optical disc) and any combination thereof.

[0204] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and combinations of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable processing unit to produce a machine, so that the instructions executed by the computer or other programmable processing unit generate a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 one or more flows and / or blocks

[0205] These computer program instructions can also be stored in a computer-readable memory that can direct the computer or other programmable processing unit to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including instruction devices that implement the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 one or more flows and / or blocks

[0206] These computer program instructions can also be loaded onto a computer or other programmable processing unit, so that a series of operation steps are performed on the computer or other programmable processing unit to produce a computer-implemented process, so that the instructions executed on the computer or other programmable processing unit provide steps for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 Figure 1 one or more flows and / or blocks

[0207] Obviously, those skilled in the art can make various modifications and variations to the embodiments of the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

[0208] In the present application, the term "includes" and its variants can refer to non-limiting inclusion; the term "or" and its variants can refer to "and / or". In the present application, the terms "first", "second", etc. are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. In the present application, "multiple" refers to two or more. "And / or", which describes the relationship between the associated objects, means that there can be three relationships, for example, A and / or B, which means that there are three cases: A alone, A and B together, and B alone. The character " / " generally represents an "or" relationship between the associated objects.

Claims

1. An access control method characterized by, The method comprises: obtaining a service processing request, wherein the service processing request comprises an identifier of a first service and user information; determining a plurality of first ports corresponding to the first service, and obtaining a calling sequence between the plurality of first ports; the first port is an API called by the first service; determining a root port corresponding to the first service in the plurality of first ports according to the calling sequence between the plurality of first ports, wherein the root port is a first port called by the first service; determining the root port corresponding to the first service as a target port; determining a permission verification result for the first service according to a user identifier in the user information and a target permission identifier of the target port; when the permission verification result is a verification success, performing service processing according to the service processing request; The method further comprises: in a link monitoring process, obtaining port access information corresponding to the first service, wherein the port access information comprises the plurality of first ports corresponding to the first service and the calling sequence between the plurality of first ports; determining the root port corresponding to the first service in the plurality of first ports according to the port access information; generating a permission identifier corresponding to the root port; the permission identifier is used for verifying a port; setting the permission identifier corresponding to the root port as a permission identifier of a port other than the root port in the plurality of first ports.

2. The method of claim 1, wherein, Determining a plurality of first ports corresponding to the first service comprises: determining whether the first service has a verification requirement; when it is determined that the first service has a verification requirement, determining the plurality of first ports corresponding to the first service.

3. The method of claim 2, wherein, Determining whether the first service has a verification requirement comprises: obtaining a target uniform resource locator (URL) corresponding to the first service; determining whether the first service has a verification requirement according to the URL.

4. The method according to claim 2 or 3, characterized in that, When it is determined that the first service has a verification requirement, determining the plurality of first ports corresponding to the first service comprises: when it is determined that the first service has a verification requirement, obtaining a first correspondence relationship, wherein the first correspondence relationship comprises a plurality of service identifiers and a plurality of ports corresponding to each service identifier; determining the plurality of first ports corresponding to the first service according to the identifier of the first service and the first correspondence relationship.

5. The method of claim 1, wherein, Determining a permission verification result for the first service according to a user identifier in the user information and a target permission identifier of the target port comprises: determining whether the user identifier corresponds to the target permission identifier; if yes, determining that the permission verification result is a verification success; if no, determining that the permission verification result is a verification failure.

6. The method of claim 1, wherein, Generating a permission identifier corresponding to the root port comprises: obtaining an access path corresponding to the root port; generating the permission identifier corresponding to the root port according to the access path corresponding to the root port.

7. An access control device, characterized in that The method comprises a first obtaining module, a second obtaining module, a first determining module, a second determining module, and a processing module, wherein: the first obtaining module is configured to obtain a service processing request, wherein the service processing request comprises an identifier of a first service and user information; The first determining module is configured to determine a plurality of first ports corresponding to the first service, and to acquire a calling sequence between the plurality of first ports; the first port is an API called by the first service; According to the calling sequence between the plurality of first ports, a root port corresponding to the first service is determined from the plurality of first ports; the root port is a first port called by the first service; The root port corresponding to the first service is determined as a target port; The second determining module is configured to determine a permission verification result for the first service according to a user identifier in the user information and a target permission identifier of the target port; The processing module is configured to perform service processing according to the service processing request when the permission verification result is a verification success; The second acquiring module is configured to acquire port access information corresponding to the first service in a link monitoring process; the port access information includes the plurality of first ports corresponding to the first service and the calling sequence between the plurality of first ports; According to the port access information, the root port corresponding to the first service is determined from the plurality of first ports; A permission identifier corresponding to the root port is generated; the permission identifier is used for verifying a port; The permission identifier corresponding to the root port is set as a permission identifier of other ports in the plurality of first ports except the root port.

8. A terminal device, comprising: Comprise: A processor and a memory; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory, so that the processor executes the access control method in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions; when the processor executes the computer execution instructions, the access control method in any one of claims 1 to 6 is realized.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the access control method in any one of claims 1 to 6.

Images