A user data access method, device and electronic equipment

Abstract

The application provides a user data access method and device and electronic equipment; the method comprises: a user data access method, comprising: a second service subject receiving an access request for accessing specific user data sent by a first service subject; analyzing the access request to obtain a data authorization relationship between service subjects corresponding to the specific user in the access request; and returning an access result of the specific user data to the first service subject according to the data authorization relationship between the service subjects. The application adds the data authorization relationship between the service subjects to the access request, and performs access permission control from the stage of sending the access request by the first service subject. The second service subject being accessed returns the access result of the specific user data to the first service subject according to the data authorization relationship, thereby providing full-link data protection between the service subjects and improving the security of specific user data access between different service subjects.

Description

Technical Field

[0001] This invention relates to the field of access control, and more specifically to a method, apparatus, and electronic device for accessing user data. Background Technology

[0002] The protection of personal information is a crucial component of internet governance and a top priority in building a healthy internet. Recent incidents, such as the sale of personal location records and the leakage of e-commerce data, demonstrate that the security of personal information is increasingly becoming a hidden danger in the development and utilization of internet big data.

[0003] Therefore, how to solve the aforementioned personal information security issues has become a technical problem that urgently needs to be addressed by those skilled in the art. Summary of the Invention

[0004] This application provides a method for accessing user data to solve the above-mentioned technical problems from the perspective of user data access.

[0005] The user data access methods provided in this application include:

[0006] The second service entity receives an access request sent by the first service entity for accessing specific user data;

[0007] Parse the access request to obtain the data authorization relationship between service entities corresponding to the specific user contained in the access request;

[0008] Based on the data authorization relationship between the service entities, the access result of the specific user data is returned to the first service entity.

[0009] Optionally, the second service entity receives an access request from the first service entity for accessing specific user data, including:

[0010] The second application corresponding to the second service subject receives the access request for accessing specific user data sent by the first application corresponding to the first service subject;

[0011] The first application is a process for implementing the service functions of the first service entity based on the specific user data; the second application is a process for implementing the service functions of the second service entity based on the specific user data.

[0012] Optionally, parsing the access request to obtain the data authorization relationship between service entities corresponding to the specific user contained in the access request includes:

[0013] Parse the access request to obtain the data authorization bitmap between service entities corresponding to the specific user contained in the access request;

[0014] Based on the data authorization bitmap, the data authorization relationship between the service entities of the specific user is obtained;

[0015] The data authorization bitmap includes several bits, each of which records a one-way authorization relationship for data access between two different service entities corresponding to the specific user.

[0016] Optionally, returning the access result of the specific user data to the first service entity based on the data authorization relationship between the service entities includes:

[0017] Determine whether the specific user data requested by the first application includes data provided by the third application of the third service entity to the second application;

[0018] If the determination result is negative, the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service subject and the second service subject in the data authorization relationship;

[0019] If the determination result is yes, then the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service subject and the second service subject, and the data authorization relationship between the first service subject and the third service subject.

[0020] Optionally, the second application, based on the data authorization relationship between the first service entity and the second service entity in the data authorization relationship, returns the access result of the specific user data to the first application, including:

[0021] Obtain the mapping relationship between service entities and applications sent by the unified management platform for service entities;

[0022] Based on the mapping relationship between the service subject and the application, determine the first service subject corresponding to the first application and the second service subject corresponding to the second application;

[0023] Based on the authorization relationship between the service entities, determine whether to authorize the first service entity to access the second service entity;

[0024] If the authorization relationship authorizes the first service entity to access the second service entity, then the specific user data is returned to the first application through the second application;

[0025] If the first service entity is not authorized to access the second service entity, the second application will return an access failure notification message to the first application.

[0026] Optionally, returning the access result of the specific user data to the first application based on the data authorization relationship between the first service entity and the second service entity, and the data authorization relationship between the first service entity and the third service entity, includes:

[0027] Obtain the mapping relationship between service entities and applications sent by the unified management platform for service entities;

[0028] Based on the mapping relationship between the service subject and the application, determine the first service subject corresponding to the first application, the second service subject corresponding to the second application, and the third service subject corresponding to the third application;

[0029] Based on the authorization relationship between the service entities, determine whether to authorize the first service entity to access the second service entity, and at the same time determine whether to authorize the first service entity to access the first service entity.

[0030] If the authorization relationship authorizes the first service entity to access the second service entity and also authorizes the first service entity to access the third service entity, then the specific service data is returned to the first application through the second application.

[0031] If the first service entity is not authorized to access the second service entity, and / or the first service entity is not authorized to access the third service entity, then the second application returns an access failure notification message to the first application.

[0032] The user data access methods provided in this application include:

[0033] The first service provider obtains the user information of a specific user based on the data access instruction corresponding to that specific user.

[0034] Based on the user information of the specific user, obtain the data authorization relationship between the service entities of the specific user;

[0035] Add the data authorization relationship between the service entities of the specific user to the initial data access request, and generate a data access request corresponding to the specific user;

[0036] The data access request is sent to the second service entity to be accessed.

[0037] Optionally, obtaining the data authorization relationship between the service providers of the specific user based on the user information of the specific user includes:

[0038] Parse the data access instruction to obtain the specific user identifier in the data access instruction;

[0039] Based on the identifier of the specific user, obtain the data authorization bitmap between the service entities corresponding to the specific user;

[0040] Based on the data authorization bitmap, the data authorization relationship between the service entities of the specific user is obtained.

[0041] Optionally, the data authorization bitmap includes several bits, each of which records a one-way authorization relationship for data access between two different service entities corresponding to the specific user.

[0042] Optionally, the data authorization relationship between the service entities can be updated in the following ways:

[0043] Parse the data access instruction to obtain a specific user identifier in the data access instruction and a first authorization relationship in the data access instruction. The first authorization relationship in the data access instruction includes: the authorization relationship between the first service subject and the second service subject.

[0044] Based on the user identifier of the specific user, obtain a first initial data authorization bitmap between the service entities of the specific user; determine whether the authorization relationship between the first service entity and the second service entity in the first initial data authorization bitmap is consistent with the first authorization relationship;

[0045] If the determination result is yes, then the first initial data authorization bitmap is used as the data authorization bitmap;

[0046] If the determination result is negative, then the first initial data authorization bitmap is updated according to the first data authorization relationship to obtain the updated data authorization bitmap.

[0047] Optionally, updating the first initial data authorization bitmap according to the first data authorization relationship to obtain the updated data authorization bitmap includes:

[0048] Determine whether the first initial data authorization bitmap contains bits representing the authorization relationship between the first service entity and the second service entity;

[0049] If the determination result is that the bit is included, then it is further determined whether the authorization relationship recorded in the bit is consistent with the first authorization relationship;

[0050] If the judgment result is consistent, then the first initial data authorization bitmap is used as the data authorization bitmap;

[0051] If the judgment result is inconsistent, then update the bit to make the authorization relationship recorded in the bit consistent with the first authorization relationship;

[0052] If the determination result is that the bit is not included, then the bit is added to the first initial data authorization bitmap to obtain the data authorization bitmap after adding the bit, wherein the authorization relationship recorded in the bit is consistent with the first authorization relationship.

[0053] Optionally, the method further includes setting a data authorization bitmap for the data authorization relationship between service entities of the specific user in the following manner:

[0054] The first service entity obtains the authorization relationship between itself and at least one other service entity based on the authorization instructions between service entities corresponding to a specific user;

[0055] Parse the authorization instruction between the service entities to obtain the user identifier in the authorization instruction between the service entities;

[0056] Based on the specific user identifier, obtain the second initial data authorization bitmap between the service entities of the specific user;

[0057] Based on the authorization relationship between the first service entity and at least one other service entity, the second initial data authorization bitmap is set.

[0058] This application also provides a user data access device, including:

[0059] The receiving module is used for the second service entity to receive the access request sent by the first service entity for accessing specific user data;

[0060] The parsing module is used to parse the access request and obtain the data authorization relationship between service entities corresponding to the specific user contained in the access request;

[0061] The return module is used to return the access result of the specific user data to the first service entity based on the data authorization relationship between the service entities.

[0062] This application also provides a user data access device, including:

[0063] In the user information acquisition module, the first service entity obtains the user information of a specific user based on the data access instruction corresponding to that specific user.

[0064] The authorization relationship acquisition module obtains the data authorization relationship between the service entities of the specific user based on the user information of the specific user;

[0065] The access request generation module adds the data authorization relationship between the service entities of the specific user to the initial data access request and generates a data access request corresponding to the specific user.

[0066] The access request sending module sends the data access request to the second service entity to be accessed.

[0067] This application also provides an electronic device, including:

[0068] processor;

[0069] The memory stores a program for a method, which, when read and executed by the processor, performs the following method: a second service entity receives an access request from a first service entity for accessing specific user data; parses the access request to obtain a data authorization relationship between service entities corresponding to the specific user contained in the access request; and returns the access result of the specific user data to the first service entity according to the data authorization relationship between the service entities.

[0070] This application also provides an electronic device, including:

[0071] processor;

[0072] The memory stores a program for a method, which, when read and executed by the processor, performs the following method: a first service entity obtains user information of a specific user based on a data access instruction corresponding to that specific user; obtains a data authorization relationship between service entities of the specific user based on the user information of the specific user; adds the data authorization relationship between service entities of the specific user to an initial data access request, generating a data access request corresponding to the specific user; and sends the data access request to a second service entity to be accessed.

[0073] Compared with the prior art, this application has the following advantages:

[0074] The user data access method provided in this application includes: a second service entity receiving an access request from a first service entity for accessing specific user data; parsing the access request to obtain a data authorization relationship between service entities corresponding to the specific user contained in the access request; and returning an access result of the specific user data to the first service entity according to the data authorization relationship between the service entities. This solution, by adding a data authorization relationship between service entities to the access request, performs access control from the stage when the first service entity issues the access request. The accessed second service entity also returns the access result of the specific user data to the first service entity according to the data authorization relationship, providing end-to-end data protection between service entities and improving the security of access to specific user data between different service entities. Attached Figure Description

[0075] Figure 1aA schematic diagram illustrating the application scenario of the user data access method provided in the embodiments of this application;

[0076] Figure 1 This is a flowchart of a user data access method provided in the first embodiment of this application;

[0077] Figure 2a Data license bitmap provided for the first embodiment of this application;

[0078] Figure 2b This is a schematic diagram of the data licensing relationship of the system in the first embodiment of this application;

[0079] Figure 3 A flowchart illustrating a user data access method provided in the second embodiment of this application;

[0080] Figure 4 This is a schematic diagram of the user data access device structure provided in the third embodiment of this application;

[0081] Figure 5 This is a schematic diagram of the user data access device structure provided in the fourth embodiment of this application;

[0082] Figure 6 This is a schematic diagram of the electronic device structure provided in the fifth embodiment of this application. Detailed Implementation

[0083] Numerous specific details are set forth in the following description to provide a full understanding of this application. However, this application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this application. Therefore, this application is not limited to the specific embodiments disclosed below.

[0084] This application provides a method, apparatus, and electronic device for accessing user data, which will be described in detail in the following embodiments.

[0085] The core of the user data access method provided in this application is to construct an access request for specific user data containing the authorization relationship between the service entities corresponding to a specific user, based on the authorization intention between the service entities. After the second service entity to be accessed receives the access request, it returns the access result of the specific user data to the first service entity that issued the specific user data access request according to the authorization relationship between the service entities.

[0086] To illustrate this application more clearly, we will first introduce the application scenarios of the user data access request method provided in the embodiments of this application.

[0087] Please refer to Figure 1a This is a schematic diagram illustrating an application scenario of the user data access method provided in the scenario embodiment of this application.

[0088] The scenario embodiments provided in this application apply to a terminal device 101 of a specific user. That is, the specific user holds the terminal device 101. The terminal device 101 can be a mobile phone, a laptop computer, or a tablet computer, etc.

[0089] The terminal device 101 is equipped with a first service entity 102 and a second service entity 103. Here, it is assumed that the first service entity 102 is used to provide food delivery services, and the second service entity 103 is used to provide location services.

[0090] During the process of a specific user selecting a food delivery service and configuring the delivery address through the first service entity 102, if the first service entity 102 needs to access the user's current location data in the second service entity 103, a pop-up window will appear on the display page corresponding to the first service entity 102 asking "Allow the first service entity to access the current location data in the second service entity?". If the user selects the "Always Allow" button in the pop-up window, it means that the first service entity 102 can access the specific user's current location data in the second service entity at any time as needed. Subsequently, the first service entity 102 sends an access request to the second service entity 103 to access the current location data. This access request includes the data authorization relationship between the first service entity 102 and the second service entity 103 (i.e., the first service entity 102 can access the specific user's current location data in the second service entity 103).

[0091] After receiving the access request, the second service entity 103 parses the access request to obtain the authorization relationship between the first service entity 102 and the second service entity 103 (i.e., the first service entity 102 can access the current location information of the specific user in the second service entity 103). The second service entity 103 returns the current location data of the specific user to the first service entity 102.

[0092] It is understood that the scenarios provided in the above embodiments of this application are not intended to limit the specific use scenarios of the embodiments of this application. The first service subject and the second service subject in the use scenario of the method can also be service subjects that provide other services. This application does not limit them.

[0093] The user data access method provided in the first embodiment of this application is applied to a second service entity to be accessed. Please refer to... Figure 1 This is a flowchart of a user data access method provided in the first embodiment of this application. The method includes steps S101 to S103.

[0094] Step S101: The second service entity receives an access request sent by the first service entity for accessing specific user data.

[0095] In one optional embodiment of this application, the service entity can be understood as a functional module in an application that implements a specific function, such as a module that implements location functionality, a module that implements payment functionality, etc. In another optional embodiment of this application, if the application can only implement one function, the application can also be regarded as the service entity, and this application is not limited in this respect. In step S101, the first service entity is the service entity that sends the data service request, and the second service entity is the service entity that receives the access request.

[0096] The specific user data refers to the user data within the service entity. For example, if the first service entity and the second service entity are an application installed on a user's terminal device, and the second service entity is used to provide location services to the user holding the terminal device, then the specific user is the user holding the terminal device, and the specific user's data is the specific user's location data.

[0097] In actual implementation, the specific application sending the access request can be a first application within a first service entity, and correspondingly, the specific application receiving the access request can be a second application within a second service entity. Here, an application can be understood as a process that implements the service functions of the first and second service entities based on the specific service data. The implementation of each service entity is often built upon several applications. When the first service entity sends a data access request to the second service entity, from a deeper perspective, it is actually an application of the first service entity (i.e., the aforementioned first application) sending a data access request to an application of the second service entity (i.e., the aforementioned second application).

[0098] To facilitate understanding of the steps described in S101 above, the following description will be provided in conjunction with specific usage scenarios:

[0099] Suppose an app includes a first service entity and a second service entity, where the first service entity provides food delivery ordering services and the second service entity provides location services.

[0100] In the process of providing food delivery ordering services, the first service provider needs to access the location data of the second service provider.

[0101] In practical applications, the second service entity actually obtains the location data of the specific user through the underlying application process. Here, the second application in the second service entity is actually an underlying application process of the second service entity.

[0102] Similarly, the first service provider needs to obtain the location data of the specific user in order to provide food delivery services to that user. This process is actually implemented through the underlying application process of the first service provider; here, the first application in the first service provider is actually an underlying application process of the first service provider.

[0103] In another embodiment of this application, the service entity may also obtain the specific user's data by calling a service interface. This application does not limit this method; the process by which the service entity obtains the specific user's data by calling the service interface is the same as the process described above where the service entity obtains the specific user's data through the underlying application process. To facilitate understanding of the technical solution claimed in this application, this embodiment only uses the application scenario where the service entity obtains user data through the underlying application process as an example to provide a detailed description of this application.

[0104] Step 102: Parse the access request to obtain the data authorization relationship between service entities corresponding to the specific user contained in the access request.

[0105] In the first embodiment of this application, the data authorization relationship between the service entities of the specific user is granted by the specific user before the first service entity sends the access request to the second service entity. The specific user corresponds to a specific user of the APP application, and in this embodiment, the specific user has control over their own data.

[0106] In practical applications, to help a specific user understand the source and target of data access, the system typically uses "first service entity" to refer to the first application and "second service entity" to refer to the second application, inquiring about the authorization relationship between the two. That is, when a specific user accesses specific user data in the second service entity through the first service entity, the system first sends authorization information to the specific user, asking whether they allow the first service entity to access the specific user data in the second service entity.

[0107] It is understandable that both the first service entity and the second service entity provide services to the specific user, and the user data stored in the first service entity and the second service entity is personal data related to the specific user's own situation.

[0108] If a specific user allows the first service entity to access specific user data in the second service entity, the authorization relationship between the first and second service entities is considered to be: the first service entity can access specific user data in the second service entity; conversely, if the user does not allow access, the authorization relationship is: the first service entity cannot access specific user data in the second service entity. This authorization relationship can be set via a dialog box before the first service entity sends its first data access request to the second service entity, as shown in the example in the previous application scenario diagram. Alternatively, the authorization relationship can be set by the installer reminding the specific user to set it when the APP containing the first service entity is installed. Furthermore, the authorization relationship can also be set through the settings function within the APP program.

[0109] In one optional embodiment of this application, the data authorization relationship between the service entities is stored in a data authorization bitmap, and the data authorization bitmap is stored in the access request.

[0110] like Figure 2a As shown, it is a data license bitmap provided in the first embodiment of this application.

[0111] The data authorization bitmap is specifically a bitmap structure, which is actually a directed graph with strong connectivity. Assuming a specific user corresponds to n service entities, this connected graph records the one-way authorization relationships between n(n-1) service entities. These authorization relationships are specifically represented by bits in the data bitmap. Each bit records the one-way authorization relationship between two service entities with a dependency relationship, for example, whether the first service entity has the right to access the service authorization data in the second service entity. In practical applications, each bit of the data authorization bitmap corresponds to two service entities with a dependency relationship in a preset manner. After determining the required authorization information, the authorization relationships between the service entities can be directly filled into the service entity authorization bitmap. In the data authorization bitmap, 1 represents that the specific user has authorized, and 0 represents that the user has not authorized. The data authorization bitmap described above can have an initial value, and the bits mentioned in the initial value are generally set to "0", that is, by default, data access between services is not allowed. By setting the authorization relationship at a certain operation node by a specific user, the specific "bit" can be updated to "1". See the description of authorization relationship settings above for specific operation nodes.

[0112] The service authorization bitmap provided in the first embodiment of this application has the advantage of dynamic expansion. In practical applications, the data authorization bitmap is backward compatible and uniformly defines the interdependent service entities represented by each bit in the bitmap. Once the service entities are determined, they remain unchanged, and the length of subsequent bits can be dynamically increased as needed. In addition, if the authorization relationship represented by a certain bit changes or is not used for a long time, that bit can be reclaimed to save bitmap space.

[0113] In practical applications, the first service entity parses the access request to obtain the service entity authorization bitmap corresponding to the specific user contained in the access request, and then obtains the data authorization relationship between the service entities of the specific user based on the data authorization bitmap.

[0114] To facilitate understanding of the data authorization bitmap provided in the first embodiment of this application, the following is combined with... Figure 2b Regarding the Figure 2a To explain, the aforementioned Figure 2b This is a schematic diagram of the data licensing relationship of the system in the first embodiment of this application.

[0115] The Figure 2b The graph includes: Service Entity 1, Service Entity 2, Service Entity 3, Service Entity 4, and Service Entity 5. Service Entity 1 points to Service Entity 2, and a 1 on the graph between them indicates that Service Entity 1 can access Service Entity 2, but Service Entity 2 cannot access Service Entity 1. Similarly, Figure 2b Service Entity 1 can also access Service Entity 3, but Service Entity 3 cannot access Service Entity 1;

[0116] Furthermore, service subject 2 can access service subject 4 and service subject 5, but service subject 4 and service subject 5 cannot access service subject 2; service subject 4 can also access service subject 5, but service subject 5 cannot access service subject 4.

[0117] exist Figure 2a In this context, each bit corresponds to two different service entities. For example, suppose... Figure 2a The first bit in the representation indicates whether service subject 1 can access service subject 2, according to... Figure 2b As shown in the relationship, service subject 1 can access service subject 2, therefore the number corresponding to the first bit is 1.

[0118] Step S103: Based on the data authorization relationship between the service entities, return the access result of the specific user data to the first service entity.

[0119] In one alternative implementation, if the specific user data requested by the first application of the first service subject all originates from the second application of the second service subject, then after the second service subject parses the access request and obtains the data authorization bitmap between the service subjects, it can directly return the access result of the specific user data to the first application based on the authorization relationship between the first and second service subjects in the data authorization bitmap.

[0120] In another optional embodiment of this application, if some or all of the specific user data requested by the first application of the first service entity is provided to the second application of the second service entity by an application of another service entity, then after parsing the access request, the second service entity needs to combine the authorization relationship between the first service entity and the second service entity, as well as the authorization relationship between the first service entity and the other service entities, in the data authorization bitmap, and return the access result of the specific user data to the first application. (Here, the other service entities do not include the first service entity and the second service entity).

[0121] To facilitate understanding of the steps described in step 103 above, the term "third service subject" will be used to refer to the other service subjects, and "third application" will be used to refer to a certain application among the other service subjects. Step S103 will be explained in detail in conjunction with steps S103-1 to S103-3 below.

[0122] Step 103-1: Determine whether the specific user data requested by the first application includes data provided by the third application of the third service entity to the second application;

[0123] Step 103-2: If the judgment result is negative, the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service subject and the second service subject in the data authorization relationship;

[0124] That is, if all the specific user data requested by the first application comes from the second application, and if the data authorization relationship obtained by parsing the access request indicates that the first service entity is authorized to access the second service entity, then the specific service data is returned to the first service entity.

[0125] If the data authorization relationship obtained from parsing the access request indicates that the first service entity is not authorized to access the second service entity, then an access failure notification message is returned to the second service entity.

[0126] Since this name information of the service provider is for the convenience of the specific user to understand and set authorization relationships, the application itself does not know which service provider it belongs to. Therefore, in actual application, the second application also needs to clarify which service provider its data belongs to and which service provider the first application data belongs to.

[0127] To address the aforementioned issues, this application establishes a mapping relationship between service entities and applications through a unified service entity management platform. This facilitates the second application in identifying its corresponding second service entity and the first service entity identified by the first application.

[0128] Specifically, the second application, based on the data authorization relationship between the first service entity and the second service entity in the data authorization relationship, returns the access result of the specific user data to the first application, including:

[0129] Obtain the mapping relationship between service entities and applications sent by the unified management platform for service entities; determine the first service entity corresponding to the first application and the second service entity corresponding to the second application based on the mapping relationship between service entities; determine whether to authorize the first service entity to access the second service entity based on the authorization relationship between the service entities; if the first service entity is authorized to access the second service entity in the authorization relationship, return the specific user data to the first application through the second application; if the first service entity is not authorized to access the second service entity, return an access failure notification message to the first application through the second application.

[0130] The unified management platform for service entities refers to a unified console for service entities. The mapping relationship between service entities and applications can be defined in the unified management platform for service entities and then distributed to the second application. The second application determines the second service entity corresponding to the mapping relationship and the first service entity corresponding to the first application. After determining the second service entity and the first service entity, the authorization relationship between the two is further determined, and the access result is returned to the first application according to the authorization relationship.

[0131] Step 103-3: If the judgment result is yes, then the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service subject and the second service subject, and the data authorization relationship between the first service subject and the third service subject in the data authorization relationship.

[0132] That is, if the specific user data is provided to the second application by the third application in the third service entity, and the first application accesses the second application, then in addition to determining whether the first service entity is authorized to access the second service entity, it is also necessary to further determine whether the first service entity is authorized to access the third service entity.

[0133] If the first service entity is authorized to access the second service entity, and the first service entity is also authorized to access the third service entity, then the specific service data is returned to the first service entity.

[0134] If the first service entity is not authorized to access the second service entity, and / or the first service entity is not authorized to access the third service entity, then an access failure notification message is returned to the first service entity.

[0135] Specifically, the second application, based on the data authorization relationship between the first and second service entities and the data authorization relationship between the first and third service entities, returns the access result of the specific user data to the first application, including:

[0136] Obtain the mapping relationship between service entities and applications sent by the unified management platform for service entities; based on the mapping relationship between service entities and applications, determine the first service entity corresponding to the first application, the second service entity corresponding to the second application, and the third service entity corresponding to the third application; based on the authorization relationship between the service entities, determine whether to authorize the first service entity to access the second service entity, and simultaneously determine whether to authorize the first service entity to access the third service entity; if the authorization relationship authorizes the first service entity to access the second service entity and authorizes the first service entity to access the third service entity, then return the specific service data to the first application through the second application; if the first service entity is not authorized to access the second service entity and / or is not authorized to access the third service entity, then return an access failure notification message to the first application through the second application.

[0137] That is, after the second application determines the first service entity corresponding to the first application, the second service entity corresponding to the second application, and the third service entity corresponding to the third application based on the mapping relationship, it further determines the authorization relationship between the three and returns the access result to the first application based on the authorization relationship.

[0138] The method provided in the first embodiment of this application describes the method of accessing user data from the perspective of the service subject to be accessed (i.e., the second service subject). Correspondingly, the second embodiment of this application also provides a method of accessing user data, which further describes the method of accessing user data from the perspective of the access request initiator (i.e., the first service subject). Since the second embodiment of this application is partially similar to the first embodiment described above, the description is relatively simple. For relevant parts, please refer to the description of the first embodiment of this application.

[0139] Please refer to Figure 3 This is a flowchart of a user data access method provided in the second embodiment of this application, which includes steps S301 to S304.

[0140] Step S301: The first service entity obtains the user information of the specific user according to the data access instruction corresponding to the specific user.

[0141] In practical applications, the specific user sends a control access request to the second service entity through the first service entity. Before generating the access request, a data access instruction corresponding to the specific user needs to be generated first, and then the first service entity generates a data access request based on the data access instruction.

[0142] Understandably, the data access request includes user information pointing to the specific user. For example, the user's identifier.

[0143] Step S302: Obtain the data authorization relationship between the service entities of the specific user based on the user information of the specific user.

[0144] Specifically, step S302 is implemented through the following method:

[0145] Step 302-1: Parse the data access instruction to obtain the specific user identifier in the data access instruction;

[0146] Step 302-2: Based on the identifier of the specific user, obtain the data authorization bitmap between the service entities corresponding to the specific user;

[0147] Similar to the first embodiment of this application, the data authorization bitmap is specifically a bitmap structure, which is actually a directed graph with strong connectivity. The data authorization bitmap includes several bits, each of which records a one-way authorization relationship between two different service entities granted by the specific user.

[0148] Step S302-3: Obtain the data authorization relationship between the service entities of the specific user based on the data authorization bitmap.

[0149] The data authorization bitmap can be found in the system's internal memory using the identifier of the specific user as an index. However, in practical applications, the specific user may set a different authorization relationship for a certain access operation than that shown in the data authorization bitmap. Therefore, in this case, the data authorization bitmap also needs to be updated.

[0150] Specifically, the update of the data authorization bitmap is achieved through the following steps 1 to 6:

[0151] Step 1: Parse the data access instruction to obtain the specific user identifier in the data access instruction and the first authorization relationship in the data access instruction. The first authorization relationship in the data access instruction includes: the authorization relationship between the first service subject and the second service subject.

[0152] Step 2: Obtain the initial data authorization bitmap between the service entities of the specific user based on the user identifier of the specific user;

[0153] The initial data authorization bitmap refers to the data bitmap corresponding to the specific user stored internally by the system before an access request is issued. The initial data bitmap also records the data authorization relationships between different service entities set by the specific user during historical operations.

[0154] In practical applications, the data authorization relationships between service entities recorded in the initial data bitmap may not represent the current intentions of a specific user. Therefore, further step 3 below needs to be performed.

[0155] Step 3: Determine whether the authorization relationship between the first service subject and the second service subject in the initial data authorization bitmap is consistent with the first authorization relationship;

[0156] Step 4: If the determination result is yes, then the initial data authorization bitmap is used as the data authorization bitmap;

[0157] Step 5: If the determination result is negative, then update the initial data authorization bitmap according to the first data authorization relationship to obtain the updated data authorization bitmap.

[0158] Specifically, updating the initial data authorization bitmap according to the first data authorization relationship to obtain the updated data authorization bitmap includes:

[0159] Determine whether the initial data authorization bitmap contains bits representing the authorization relationship between the first service entity and the second service entity;

[0160] If the determination result is that the bit is included, then it is further determined whether the authorization relationship recorded in the bit is consistent with the first authorization relationship;

[0161] If the judgment result is consistent, then the initial data authorization bitmap is used as the data authorization bitmap;

[0162] If the judgment result is inconsistent, then update the bit to make the authorization relationship recorded in the bit consistent with the first authorization relationship;

[0163] If the determination result is that the bit is not included, the bit is added to the initial data authorization bitmap to obtain the data authorization bitmap after adding the bit, wherein the authorization relationship recorded in the bit is consistent with the first authorization relationship.

[0164] In another optional embodiment of this application, a data authorization bitmap of the data authorization relationship between the service subjects of the specific user can also be set through steps 6 to 9:

[0165] Step 6: The first service entity obtains the authorization relationship between itself and at least one other service entity according to the authorization instruction between service entities corresponding to a specific user;

[0166] Step 7: Parse the authorization instruction between service entities to obtain the user identifier in the authorization instruction between service entities;

[0167] Step 8: Obtain the second initial data authorization bitmap between the service entities of the specific user based on the specific user identifier;

[0168] The second initial data bitmap does not record the authorization relationship between the first service subject and other service subjects.

[0169] Step 9: Set the second initial data authorization bitmap according to the authorization relationship between the first service subject and at least one other service subject.

[0170] After determining the data authorization bitmap, step S303 is executed to obtain a data access request carrying the data authorization relationship. Step S303 involves adding the data authorization relationship between the service entities of the specific user to the initial data access request, generating a data access request corresponding to the specific user.

[0171] That is, a data access request containing the data authorization relationship between the service entities is generated.

[0172] In this embodiment, the data authorization relationship between the service entities of the specific user is added to the initial data access request, which means adding the data authorization bitmap to the initial data access request. In an optional embodiment of this application, the data authorization bitmap is added to the header of the initial data access request. In addition to the data authorization bitmap, the header of the data access request also includes: user identification information, identification information of the service entity sending the access request, and identification information of the service entity requesting access, so as to accurately deliver the access request to the second service entity.

[0173] Step S304: Send the data access request to the second service subject to be accessed.

[0174] It should be noted that the data authorization bitmap and the service entity's identification information are automatically added to the initial data access request. When a second service entity receives the data access request from another service entity, the data access request automatically carries the service entity's identification and the data authorization bitmap.

[0175] In another optional embodiment of this application, the data access request issued by the first service entity may pass through multiple intermediate service entities before calling the data of the second service entity; that is, the first service entity does not directly call the data of the second service entity.

[0176] In this implementation, except for the first service entity which needs to access the unified management platform of service entities to obtain the data authorization bitmap, other service entities only obtain the data authorization bitmap and the user identification information in the header of the data access, so as to avoid remote data calls by other service entities and improve the overall access efficiency and performance.

[0177] In an alternative embodiment of this application, the data authorization bitmap and the user identification information can be encrypted using a specific encryption method and key to prevent the first service entity and / or other service entities from forging and altering the authorization relationship, thereby deceiving the second service entity into returning data.

[0178] After the second service entity receives the data access request, it begins to execute steps S101 to S103 as described in the first embodiment of this application, so that the second service entity returns the access result to the first service entity.

[0179] In summary, the user data access method provided in this application adds a data authorization relationship between service entities to the access request, thereby controlling access permissions from the stage when the first service entity issues the access request. The second service entity being accessed also returns the access result of the specific user data to the first service entity according to the data authorization relationship, providing end-to-end data protection between service entities and improving the security of access to specific user data between different service entities.

[0180] The third embodiment of this application provides a user data access device, which corresponds to the method described in the first embodiment of this application. Please refer to [link / reference]. Figure 4 This is a schematic diagram of the user data access device structure provided in the third embodiment of this application. Since this device embodiment is basically similar to the above method embodiment, the description is relatively simple. For relevant parts, please refer to the description of the first embodiment above.

[0181] The user data access device provided in the third embodiment of this application includes:

[0182] The receiving module 401 is used for the second service entity to receive the access request sent by the first service entity for accessing specific user data;

[0183] Parsing module 402 is used to parse the access request and obtain the data authorization relationship between service entities corresponding to the specific user contained in the access request;

[0184] The return module 403 is used to return the access result of the specific user data to the first service subject according to the data authorization relationship between the service subjects.

[0185] As one embodiment, the second service entity receives an access request from the first service entity for accessing specific user data, including:

[0186] The second application corresponding to the second service subject receives the access request for accessing specific user data sent by the first application corresponding to the first service subject;

[0187] The first application is a process for implementing the service functions of the first service entity based on the specific user data; the second application is a process for implementing the service functions of the second service entity based on the specific user data.

[0188] As one embodiment, parsing the access request to obtain the data authorization relationship between service entities corresponding to the specific user contained in the access request includes:

[0189] Parse the access request to obtain the data authorization bitmap between service entities corresponding to the specific user contained in the access request;

[0190] Based on the data authorization bitmap, the data authorization relationship between the service entities of the specific user is obtained;

[0191] The data authorization bitmap includes several bits, each of which records a one-way authorization relationship for data access between two different service entities corresponding to the specific user.

[0192] As one embodiment, returning the access result of the specific user data to the first service entity based on the data authorization relationship between the service entities includes:

[0193] Determine whether the specific user data requested by the first application includes data provided by the third application of the third service entity to the second application;

[0194] If the determination result is negative, the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service subject and the second service subject in the data authorization relationship;

[0195] If the determination result is yes, then the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service subject and the second service subject, and the data authorization relationship between the first service subject and the third service subject.

[0196] As one embodiment, the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service subject and the second service subject in the data authorization relationship, including:

[0197] Obtain the mapping relationship between service entities and applications sent by the unified management platform for service entities;

[0198] Based on the mapping relationship between the service subject and the application, determine the first service subject corresponding to the first application and the second service subject corresponding to the second application;

[0199] Based on the authorization relationship between the service entities, determine whether to authorize the first service entity to access the second service entity;

[0200] If the authorization relationship authorizes the first service entity to access the second service entity, then the specific user data is returned to the first application through the second application;

[0201] If the first service entity is not authorized to access the second service entity, the second application will return an access failure notification message to the first application.

[0202] As one embodiment, returning the access result of the specific user data to the first application based on the data authorization relationship between the first service entity and the second service entity, and the data authorization relationship between the first service entity and the third service entity, includes:

[0203] Obtain the mapping relationship between service entities and applications sent by the unified management platform for service entities;

[0204] Based on the mapping relationship between the service subject and the application, determine the first service subject corresponding to the first application, the second service subject corresponding to the second application, and the third service subject corresponding to the third application;

[0205] Based on the authorization relationship between the service entities, determine whether to authorize the first service entity to access the second service entity, and at the same time determine whether to authorize the first service entity to access the first service entity.

[0206] If the authorization relationship authorizes the first service entity to access the second service entity and also authorizes the first service entity to access the third service entity, then the specific service data is returned to the first application through the second application.

[0207] If the first service entity is not authorized to access the second service entity, and / or the first service entity is not authorized to access the third service entity, then the second application returns an access failure notification message to the first application.

[0208] The fourth embodiment of this application provides another user data access device, which corresponds to the method described in the second embodiment of this application. Please refer to [link / reference]. Figure 5 This is a schematic diagram of the user data access device structure provided in the fourth embodiment of this application. Since this device embodiment is basically similar to the above method embodiment, the description is relatively simple. For relevant parts, please refer to the description of the second embodiment above.

[0209] The user data access device provided in the fourth embodiment of this application includes:

[0210] User information acquisition module 501: The first service entity obtains the user information of a specific user based on the data access instruction corresponding to that specific user.

[0211] The authorization relationship acquisition module 502 acquires the data authorization relationship between the service entities of the specific user based on the user information of the specific user.

[0212] The access request generation module 503 adds the data authorization relationship between the service subjects of the specific user to the initial data access request and generates a data access request corresponding to the specific user.

[0213] The access request sending module 504 sends the data access request to the second service subject to be accessed.

[0214] As one embodiment, obtaining the data authorization relationship between the service providers of the specific user based on the user information of the specific user includes:

[0215] Parse the data access instruction to obtain the specific user identifier in the data access instruction;

[0216] Based on the identifier of the specific user, obtain the data authorization bitmap between the service entities corresponding to the specific user;

[0217] Based on the data authorization bitmap, the data authorization relationship between the service entities of the specific user is obtained.

[0218] As one embodiment, the data authorization bitmap includes several bits, each of which records a one-way authorization relationship for data access between two different service entities corresponding to the specific user.

[0219] As one embodiment, the data authorization relationship between the service entities is updated in the following way:

[0220] Parse the data access instruction to obtain a specific user identifier in the data access instruction and a first authorization relationship in the data access instruction. The first authorization relationship in the data access instruction includes: the authorization relationship between the first service subject and the second service subject.

[0221] Based on the user identifier of the specific user, obtain a first initial data authorization bitmap between the service entities of the specific user; determine whether the authorization relationship between the first service entity and the second service entity in the first initial data authorization bitmap is consistent with the first authorization relationship;

[0222] If the determination result is yes, then the first initial data authorization bitmap is used as the data authorization bitmap;

[0223] If the determination result is negative, then the first initial data authorization bitmap is updated according to the first data authorization relationship to obtain the updated data authorization bitmap.

[0224] As one embodiment, updating the first initial data authorization bitmap according to the first data authorization relationship to obtain the updated data authorization bitmap includes:

[0225] Determine whether the first initial data authorization bitmap contains bits representing the authorization relationship between the first service entity and the second service entity;

[0226] If the determination result is that the bit is included, then it is further determined whether the authorization relationship recorded in the bit is consistent with the first authorization relationship;

[0227] If the judgment result is consistent, then the first initial data authorization bitmap is used as the data authorization bitmap;

[0228] If the judgment result is inconsistent, then update the bit to make the authorization relationship recorded in the bit consistent with the first authorization relationship;

[0229] If the determination result is that the bit is not included, then the bit is added to the first initial data authorization bitmap to obtain the data authorization bitmap after adding the bit, wherein the authorization relationship recorded in the bit is consistent with the first authorization relationship.

[0230] As one embodiment, the method further includes setting a data authorization bitmap for the data authorization relationship between service entities of the specific user in the following manner:

[0231] The first service entity obtains the authorization relationship between itself and at least one other service entity based on the authorization instructions between service entities corresponding to a specific user;

[0232] Parse the authorization instruction between the service entities to obtain the user identifier in the authorization instruction between the service entities;

[0233] Based on the specific user identifier, obtain the second initial data authorization bitmap between the service entities of the specific user;

[0234] Based on the authorization relationship between the first service entity and at least one other service entity, the second initial data authorization bitmap is set.

[0235] Corresponding to the first embodiment of this application, the fifth embodiment of this application also provides an electronic device. Since the embodiment of this electronic device is basically similar to the first embodiment described above, the description is relatively simple. For relevant details, please refer to the description of the first embodiment described above. The electronic device embodiment described below is merely illustrative.

[0236] Please refer to Figure 6 This is a schematic diagram of the electronic device structure provided in the fifth embodiment of this application.

[0237] The electronic device includes: a processor 601;

[0238] The memory 602 is used to store a program for a method, which, when read and executed by the processor, performs the following method: a second service entity receives an access request sent by a first service entity for accessing specific user data; parses the access request to obtain the data authorization relationship between service entities corresponding to the specific user contained in the access request; and returns the access result of the specific user data to the first service entity according to the data authorization relationship between the service entities.

[0239] Corresponding to the second embodiment of this application, the sixth embodiment of this application also provides an electronic device. Since the embodiment of this electronic device is basically similar to the second embodiment described above, the description is relatively simple. For relevant parts, please refer to the description of the second embodiment described above. The electronic device embodiment described below is merely illustrative.

[0240] The electronic device provided in the sixth embodiment of this application is structurally the same as the electronic device provided in the fifth embodiment described above. The electronic device provided in the sixth embodiment of this application also includes:

[0241] Processor 601 and memory 602 are used to store the program of the method.

[0242] Unlike the fifth embodiment described above, in the sixth embodiment of this application, when the program in the memory Y02 is read and executed by the processor, it performs the following method: the first service entity obtains the user information of the specific user according to the data access instruction corresponding to the specific user; obtains the data authorization relationship between the service entities of the specific user according to the user information of the specific user; adds the data authorization relationship between the service entities of the specific user to the initial data access request, and generates a data access request corresponding to the specific user; and sends the data access request to the second service entity to be accessed.

[0243] The seventh embodiment of this application also provides a computer storage medium storing a computer program, which, when executed, implements the methods described in the first or second embodiment above.

[0244] It should be noted that the detailed description of the storage medium provided in the seventh embodiment of this application can be found in the relevant description of the above-mentioned method provided in this application, and will not be repeated here.

[0245] Although this application discloses preferred embodiments as described above, it is not intended to limit this application. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of this application. Therefore, the scope of protection of this application should be determined by the scope defined in the claims of this application.

[0246] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0247] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0248] 1. Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include non-transitory computer-readable media, such as modulated data signals and carrier waves.

[0249] 2. Those skilled in the art will understand that embodiments of this application can be provided as systems or electronic devices. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

Claims

1. A method for accessing user data, characterized in that, include: A second application corresponding to a second service subject receives an access request sent by a first application corresponding to a first service subject for accessing specific user data; wherein, the first application is a process for implementing the service functions of the first service subject based on the specific user data; the second application is a process for implementing the service functions of the second service subject based on the specific user data, and the first service subject and the second service subject are two different applications installed on the user terminal; Parse the access request to obtain a data authorization bitmap between service entities corresponding to a specific user contained in the access request; based on the data authorization bitmap, obtain the data authorization relationship between the service entities of the specific user; wherein, the data authorization bitmap includes several bits, each bit recording a one-way authorization relationship for data access between two different service entities corresponding to the specific user, the data authorization relationship between the service entities of the specific user is granted by the specific user before the first service entity sends the access request to the second service entity; the specific user corresponds to the specific user of the service entity; The system determines whether the specific user data requested by the first application includes data provided by a third application of a third service entity to the second application. If the determination result is no, the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service entity and the second service entity in the data authorization relationship. If the determination result is yes, the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service entity and the second service entity, and the data authorization relationship between the first service entity and the third service entity in the data authorization relationship.

2. The user data access method according to claim 1, characterized in that, The second application, based on the data authorization relationship between the first service entity and the second service entity in the data authorization relationship, returns the access result of the specific user data to the first application, including: Obtain the mapping relationship between service entities and applications sent by the unified management platform for service entities; Based on the mapping relationship between the service subject and the application, determine the first service subject corresponding to the first application and the second service subject corresponding to the second application; Based on the authorization relationship between the service entities, determine whether to authorize the first service entity to access the second service entity; If the authorization relationship authorizes the first service entity to access the second service entity, then the specific user data is returned to the first application through the second application; If the first service entity is not authorized to access the second service entity, the second application will return an access failure notification message to the first application.

3. The user data access method according to claim 1, characterized in that, The step of returning the access result of the specific user data to the first application based on the data authorization relationship between the first service subject and the second service subject, and the data authorization relationship between the first service subject and the third service subject, includes: Obtain the mapping relationship between service entities and applications sent by the unified management platform for service entities; Based on the mapping relationship between the service subject and the application, determine the first service subject corresponding to the first application, the second service subject corresponding to the second application, and the third service subject corresponding to the third application; Based on the authorization relationship between the service entities, determine whether to authorize the first service entity to access the second service entity, and at the same time determine whether to authorize the first service entity to access the first service entity. If the authorization relationship authorizes the first service entity to access the second service entity and authorizes the first service entity to access the third service entity, then specific service data is returned to the first application through the second application; If the first service entity is not authorized to access the second service entity, and / or the first service entity is not authorized to access the third service entity, then the second application returns an access failure notification message to the first application.

4. A method for accessing user data, characterized in that, include: The first service provider obtains the user information of a specific user based on the data access instruction corresponding to that specific user. Parse the data access instruction to obtain a specific user identifier in the data access instruction; based on the specific user identifier, obtain a data authorization bitmap between the service entities corresponding to the specific user; According to the data authorization bitmap, the data authorization relationship between the service entities of the specific user is obtained. The data authorization relationship between the service entities of the specific user is granted by the specific user before the first service entity sends a data access request to the second service entity. The specific user corresponds to the specific user of the service entity. The data authorization bitmap includes several bits, and each bit records the one-way authorization relationship between two different service entities corresponding to the specific user regarding data access. The first service entity and the second service entity are two different applications installed on the user terminal. Add the data authorization relationship between the service entities of the specific user to the initial data access request, and generate a data access request corresponding to the specific user; Send the data access request to the second service entity to be accessed; The data authorization relationship between the service entities is updated in the following way: Parse the data access instruction to obtain a specific user identifier and a first authorization relationship in the data access instruction. The first authorization relationship in the data access instruction includes: the authorization relationship between the first service entity and the second service entity. Based on the user identifier of the specific user, obtain a first initial data authorization bitmap between the service entities of the specific user. Determine whether the authorization relationship between the first service entity and the second service entity in the first initial data authorization bitmap is consistent with the first authorization relationship. If the determination result is yes, then use the first initial data authorization bitmap as the data authorization bitmap. If the determination result is no, then update the first initial data authorization bitmap according to the first authorization relationship to obtain the updated data authorization bitmap.

5. The user data access method according to claim 4, characterized in that, The step of updating the first initial data authorization bitmap according to the first authorization relationship to obtain the updated data authorization bitmap includes: Determine whether the first initial data authorization bitmap contains bits representing the authorization relationship between the first service entity and the second service entity; If the determination result is that the bit is included, then it is further determined whether the authorization relationship recorded in the bit is consistent with the first authorization relationship; If the judgment result is consistent, then the first initial data authorization bitmap is used as the data authorization bitmap; If the judgment result is inconsistent, then update the bit to make the authorization relationship recorded in the bit consistent with the first authorization relationship; If the determination result is that the bit is not included, then the bit is added to the first initial data authorization bitmap to obtain the data authorization bitmap after adding the bit, wherein the authorization relationship recorded in the bit is consistent with the first authorization relationship.

6. The user data access method according to claim 4, characterized in that, The method further includes setting a data authorization bitmap for the data authorization relationship between the service entities of the specific user in the following manner: The first service entity obtains the authorization relationship between itself and at least one other service entity based on the authorization instructions between service entities corresponding to a specific user; Parse the authorization instruction between the service entities to obtain the user identifier in the authorization instruction between the service entities; Based on the specific user identifier, obtain the second initial data authorization bitmap between the service entities of the specific user; Based on the authorization relationship between the first service entity and at least one other service entity, the second initial data authorization bitmap is set.

7. A user data access device, characterized in that, include: The receiving module is used for the second application of the second service subject to receive an access request sent by the first application of the first service subject for accessing specific user data; wherein, the first application is a process for implementing the service functions of the first service subject based on the specific user data; the second application is a process for implementing the service functions of the second service subject based on the specific user data, and the first service subject and the second service subject are two different applications installed on the user terminal; The parsing module is used to parse the access request to obtain a data authorization bitmap between service entities corresponding to a specific user contained in the access request; and to obtain the data authorization relationship between the service entities of the specific user based on the data authorization bitmap; wherein, the data authorization bitmap includes several bits, each bit recording a one-way authorization relationship for data access between two different service entities corresponding to the specific user, and the data authorization relationship between the service entities of the specific user is granted by the specific user before the first service entity sends the access request to the second service entity; the specific user corresponds to the specific user of the service entity; The return module is used to determine whether the specific user data requested by the first application includes data provided by the third application of the third service entity to the second application; if the determination result is no, the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service entity and the second service entity in the data authorization relationship; if the determination result is yes, the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service entity and the second service entity, and the data authorization relationship between the first service entity and the third service entity in the data authorization relationship.

8. A user data access device, characterized in that, include: In the user information acquisition module, the first service entity obtains the user information of a specific user based on the data access instruction corresponding to that specific user. The authorization relationship acquisition module parses the data access instruction to obtain a specific user identifier in the data access instruction; and obtains a data authorization bitmap between the service entities corresponding to the specific user based on the specific user identifier. According to the data authorization bitmap, the data authorization relationship between the service entities of the specific user is obtained. The data authorization relationship between the service entities of the specific user is granted by the specific user before the first service entity sends a data access request to the second service entity. The specific user corresponds to the specific user of the service entity. The data authorization bitmap includes several bits, and each bit records the one-way authorization relationship between two different service entities corresponding to the specific user regarding data access. The first service entity and the second service entity are two different applications installed on the user terminal. The access request generation module adds the data authorization relationship between the service entities of the specific user to the initial data access request and generates a data access request corresponding to the specific user. The access request sending module sends the data access request to the second service entity to be accessed; The data authorization relationship between the service entities is updated in the following way: Parse the data access instruction to obtain a specific user identifier and a first authorization relationship in the data access instruction. The first authorization relationship in the data access instruction includes: the authorization relationship between the first service entity and the second service entity. Based on the user identifier of the specific user, obtain a first initial data authorization bitmap between the service entities of the specific user. Determine whether the authorization relationship between the first service entity and the second service entity in the first initial data authorization bitmap is consistent with the first authorization relationship. If the determination result is yes, then use the first initial data authorization bitmap as the data authorization bitmap. If the determination result is no, then update the first initial data authorization bitmap according to the first authorization relationship to obtain the updated data authorization bitmap.

9. An electronic device, characterized in that, include: processor; A memory is used to store a program for a method, which, when read and executed by the processor, performs the following method: a second application corresponding to a second service entity receives an access request sent by a first application corresponding to a first service entity for accessing specific user data; wherein the first application is a process for implementing the service functions of the first service entity based on the specific user data; the second application is a process for implementing the service functions of the second service entity based on the specific user data, and the first service entity and the second service entity are two different applications installed on the user terminal; the access request is parsed to obtain a data authorization bitmap between service entities corresponding to the specific user contained in the access request; and the data authorization relationship between service entities of the specific user is obtained according to the data authorization bitmap; wherein the data authorization bitmap includes several bits, and each bit records two different service entities corresponding to the specific user. The data authorization relationship between the service entities of the specific user is granted by the specific user before the first service entity sends the access request to the second service entity; the specific user corresponds to the specific user of the service entity; it is determined whether the specific user data requested by the first application includes data provided by the third application of the third service entity to the second application; if the determination result is no, the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service entity and the second service entity; if the determination result is yes, the second application returns the access result of the specific user data to the first application according to the data authorization relationship between the first service entity and the second service entity, and the data authorization relationship between the first service entity and the third service entity.

10. An electronic device, characterized in that, include: processor; A memory for storing a program of a method, which, when read and executed by the processor, performs the following method: a first service entity obtains user information of a specific user based on a data access instruction corresponding to that specific user; parses the data access instruction to obtain a specific user identifier in the data access instruction; and obtains a data authorization bitmap between service entities corresponding to the specific user based on the specific user identifier. Based on the data authorization bitmap, the data authorization relationship between the service entities of the specific user is obtained. This data authorization relationship is granted by the specific user before the first service entity sends a data access request to the second service entity. The specific user corresponds to a specific user of the service entity. The data authorization bitmap includes several bits, each bit recording a one-way authorization relationship for data access between two different service entities corresponding to the specific user. The first service entity and the second service entity are two different applications installed on the user's terminal. The data authorization relationship between the service entities of the specific user is added to the initial data access request to generate a data access request corresponding to the specific user. The data access request is then sent to the second service entity to be accessed. The data authorization relationship between the service entities is updated in the following manner: parsing the data access instruction to obtain a specific user identifier and a first authorization relationship in the data access instruction, wherein the first authorization relationship in the data access instruction includes: the authorization relationship between the first service entity and the second service entity; obtaining a first initial data authorization bitmap between the service entities of the specific user based on the user identifier of the specific user; determining whether the authorization relationship between the first service entity and the second service entity in the first initial data authorization bitmap is consistent with the first authorization relationship; if the determination result is yes, then the first initial data authorization bitmap is used as the data authorization bitmap; if the determination result is no, then the first initial data authorization bitmap is updated according to the first authorization relationship to obtain the updated data authorization bitmap.

Images