Access permission status determination system, method, electronic device and storage medium

Abstract

The present invention relates to the field of secure access technology, and discloses an access permission status determination system, method, electronic device, and storage medium. The system obtains application information and application tags corresponding to each original application, sends the corresponding application information to each original application, and sends authorization information to each original application with a service tag, so that the access application generates an access signature based on the corresponding application information, and the service application determines the access permission status of the access application to the service application based on the access signature and authorization information. By distributing application information and authorization information to the original application, no distinction is made between the access application and the service application. The access application and the service application perform mutual access authentication with each other through the application information and authorization information, so that the access authentication between applications no longer relies on the gateway layer, avoiding excessive workload of the gateway, thereby improving the access efficiency between applications.

Description

Technical Field

[0001] The present invention relates to the field of secure access technology, and in particular to an access permission status determination system, method, electronic device and storage medium. Background Art

[0002] With the continuous advancement of technology and the continuous development of enterprise business, enterprises need to create a large number of enterprise applications to implement auxiliary business through enterprise applications. Typically, enterprise applications include access applications and service applications. Access applications and service applications are connected through a gateway, and access between applications is authenticated at the gateway layer.

[0003] However, due to the large number of interface calls between applications and the large number of service applications accessed by the gateway, the gateway workload is too heavy, which reduces the authentication speed of application access and even causes abnormal gateway responses, resulting in low access efficiency between applications. Summary of the Invention

[0004] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical elements or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0005] In view of the above-mentioned shortcomings of the prior art, the present invention discloses an access permission status determination system, method, electronic device and storage medium to improve the access efficiency between applications.

[0006] The present invention discloses an access permission status determination system, comprising: an acquisition module, used to obtain application information and application tags corresponding to each original application, wherein the application tags include at least one of service tags and access tags; a distribution module, used to send corresponding application information to each original application, and send authorization information to each original application with the service tag, wherein the authorization information is obtained by granting access authorization to each original application; multiple original applications, including access applications and service applications, wherein the access application is used to generate an access signature based on the corresponding application information, and the service application is used to determine the access permission status of the access application to the service application based on the access signature and the authorization information, wherein the access application includes any original application with the access tag, and the service application includes any original application with the service tag.

[0007] Optionally, the system further includes: an application creation module for establishing a new original application; and a port entry module for acquiring application registration information of the service application and entering an external port into the service application according to the application registration information.

[0008] Optionally, the system also includes a key management module, which is used to: obtain an encryption key, where the encryption key is obtained by encrypting a preset access key; if a key acquisition request is received from any of the original applications, extract data from the application information corresponding to the original application to obtain application permission information; determine the acquisition permission status corresponding to the key acquisition request based on the application permission information; if the acquisition permission status is acquisition permission, decrypt the encryption key to obtain the access key, and send the access key to the original application.

[0009] Optionally, the access application generates an access signature in the following manner: obtaining the access key and performing data extraction on application information corresponding to the access application to obtain a token value; and encrypting the token value according to the access key to obtain an access signature.

[0010] Optionally, the service application determines the access permission status of the access application to the service application in the following manner: obtaining the access key; performing signature verification on the access signature using the access key to obtain a signature verification result, and at the same time, authenticating the access application according to the preset authentication service and the authorization information to obtain the access permission status corresponding to the access application; if the signature verification result is passed and the access permission status is with access permission, the access permission status is determined to be allowed access.

[0011] Optionally, the access application is further used to: obtain a sending interface configuration of the access application; and modify the sending interface configuration so that before the access application sends an application access request to the service application, the access signature is added to the application access request.

[0012] Optionally, the client connects to each of the original applications in sequence through the front-end gateway, the front-end application and the back-end gateway, wherein the client is used to generate a user access request; the front-end gateway is used to send the user access request to the front-end application; the front-end application is used to respond to the user access request and obtain an application access request corresponding to the user access request; the back-end gateway is used to authenticate and authorize the application access request and send the application access request to the corresponding original application.

[0013] The present invention discloses a method for determining an access permission status, comprising: obtaining application information and application tags corresponding to each original application, wherein the application tags include at least one of a service tag and an access tag; sending corresponding application information to each original application, and sending authorization information to each original application with the service tag, wherein the authorization information is obtained by performing access authorization on each original application; determining any original application with the access tag as an access application, the access application being used to generate an access signature according to the corresponding application information; determining any original application with the service tag as a service application, the service application being used to determine the access permission status of the access application to the service application according to the access signature and the authorization information.

[0014] The present invention discloses an electronic device, comprising: a processor and a memory; the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the electronic device executes the above method.

[0015] The present invention discloses a computer-readable storage medium, on which a computer program is stored: when the computer program is executed by a processor, the method described above is implemented.

[0016] Beneficial effects of the present invention:

[0017] By obtaining the application information and application tags corresponding to each original application, sending the corresponding application information to each original application, and sending authorization information to each original application with a service tag, the access application generates an access signature based on the corresponding application information, and the service application determines the access permission status of the access application to the service application based on the access signature and authorization information. In this way, by distributing application information and authorization information to the original application, there is no distinction between the access application and the service application. The access application and the service application authenticate each other through the application information and authorization information. This eliminates the reliance on the gateway layer for access authentication between applications, reduces the workload on the gateway, and improves access efficiency between applications.

[0018] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are incorporated into and constitute a part of the specification, illustrating embodiments consistent with the present application and, together with the specification, serving to explain the principles of the present application. It is obvious that the drawings described below are merely some embodiments of the present application, and a person of ordinary skill in the art can derive other drawings based on these drawings without inventive effort. In the drawings:

[0020] Figure 1 is a schematic structural diagram of an access permission status determination system according to an embodiment of the present invention;

[0021] Figure 2 is a schematic structural diagram of another access permission status determination system according to an embodiment of the present invention;

[0022] Figure 3 1 is a flow chart of a method for determining an access permission status based on an access permission status determination system according to an embodiment of the present invention;

[0023] Figure 4 1 is a flow chart of a method for determining an access permission status in an embodiment of the present invention;

[0024] Figure 5 It is a schematic structural diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following describes the embodiments of the present invention through specific examples. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through different specific embodiments. The details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and sub-samples in the embodiments can be combined with each other unless there is a conflict.

[0026] It should be noted that the illustrations provided in the following embodiments are merely schematic illustrations of the basic concept of the present invention. Therefore, the illustrations only show components related to the present invention and are not drawn according to the number, shape, and size of components in actual implementation. In actual implementation, the type, quantity, and proportion of each component may be changed arbitrarily, and the component layout may also be more complex.

[0027] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it will be apparent to those skilled in the art that the embodiments of the present invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring the embodiments of the present invention.

[0028] In the description and claims of the embodiments of the present disclosure, as well as in the accompanying drawings, the terms "first," "second," and the like are used to distinguish similar items and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate to describe the embodiments of the present disclosure herein. In addition, the terms "including," "having," and any variations thereof are intended to cover non-exclusive inclusions.

[0029] Unless otherwise stated, the term "plurality" means two or more.

[0030] In the embodiment of the present disclosure, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B means: A or B.

[0031] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.

[0032] Combine Figure 1 As shown, an embodiment of the present disclosure provides an access permission status determination system, including an acquisition module 101, a distribution module 102 and multiple original applications 103, wherein the acquisition module 101 is used to obtain application information and application tags corresponding to each original application, wherein the application tag includes at least one of a service tag and an access tag; the distribution module 102 is used to send corresponding application information to each original application, and send authorization information to each original application with a service tag, wherein the authorization information is obtained by granting access authorization to each original application; the original application 103 includes an access application 1031 and a service application 1032, the access application is used to generate an access signature according to the corresponding application information, and the service application is used to determine the access permission status of the access application to the service application according to the access signature and the authorization information, wherein the access application includes any original application with an access tag, and the service application includes any original application with a service tag.

[0033] The access permission status determination system provided by the embodiment of the present disclosure obtains the application information and application tag corresponding to each original application, sends the corresponding application information to each original application, and sends authorization information to each original application with a service tag, so that the access application generates an access signature based on the corresponding application information, and the service application determines the access permission status of the access application to the service application based on the access signature and authorization information. In this way, by distributing application information and authorization information to the original application, without distinguishing between the access application and the service application, the access application and the service application perform mutual access authentication through the application information and authorization information, so that the access authentication between applications no longer depends on the gateway layer, avoiding excessive workload of the gateway, thereby improving the access efficiency between applications. At the same time, without distinguishing between the access application and the service application, when the original application has both an access tag and a service tag, it accesses or provides services through its own behavior, simplifying the steps of distributing information to the application, improving the distribution efficiency, and thus improving the access efficiency between applications.

[0034] Optionally, the access application and the service application are different original applications.

[0035] Optionally, the application information includes an application identifier (appID) and an application secret (appSecret), wherein the application secret is used to represent basic information, interface access permission information, key permission information, etc. of the original application, and the basic information includes application name, application version, etc.

[0036] In some embodiments, the original application stores application information and authorization information in jar format to prevent code intrusion.

[0037] Optionally, the service application is further configured to: generate an access log if the access application accesses the service application.

[0038] Optionally, the service application is further configured to: if an abnormal request for accessing the application is detected, request the server to change the access permission for accessing the application.

[0039] Optionally, the access application is further used to monitor the server in observer mode, and if it is monitored that the access permission of the access application has changed, re-request the authorization code from the server.

[0040] Optionally, the system further includes: an application creation module for establishing a new original application; and a port entry module for acquiring application registration information of the service application and entering an external port into the service application according to the application registration information.

[0041] Optionally, the system also includes a key management module, which is used to: obtain an encryption key, which is obtained by encrypting a preset access key; if a key acquisition request is received from any original application, extract data from the application information corresponding to the original application to obtain application permission information; determine the acquisition permission status corresponding to the key acquisition request based on the application permission information; if the acquisition permission status is that acquisition is allowed, decrypt the encryption key to obtain the access key, and send the access key to the original application.

[0042] Optionally, the access application generates an access signature in the following manner: obtaining an access key, and performing data extraction on application information corresponding to the access application to obtain a token value; and encrypting the token value according to the access key to obtain an access signature.

[0043] In some embodiments, the token value includes an application name.

[0044] Optionally, the service application determines the access permission status of the access application to the service application in the following manner: obtaining an access key; performing signature verification on the access signature using the access key to obtain a signature verification result, and at the same time, authenticating the access application based on a preset authentication service and authorization information to obtain the access permission status corresponding to the access application; if the signature verification result is passed and the access permission status is with access permission, the access permission status is determined to be allowed access.

[0045] In this way, when the service application provides a large number of external interfaces, the access signature and access rights are managed by obtaining modules and distributing modules, and the access permission status of the access application is determined by the access signature and access rights. Without relying on the gateway layer, the service layer can directly perform authentication, making some interfaces inaccessible to authorized access applications.

[0046] Optionally, the preset authentication service includes an authentication SDK.

[0047] Optionally, the access application is further used to: obtain a sending interface configuration of the access application; and modify the sending interface configuration so that the access application adds the access signature to the application access request before sending the application access request to the service application.

[0048] In some embodiments, the access signature is carried in the request header of the application access request.

[0049] Optionally, the client connects to each original application through the front-end gateway, the front-end application and the back-end gateway in sequence, wherein the client is used to generate a user access request; the front-end gateway is used to send the user access request to the front-end application; the front-end application is used to respond to the user access request and obtain the application access request corresponding to the user access request; the back-end gateway is used to authenticate and authorize the application access request and send the application access request to the corresponding original application.

[0050] In some embodiments, one or more of the original application, acquisition module, distribution module, application creation module, port entry module, and key management module in the system are established based on the server side, wherein the server side includes servers, server groups, etc., and may also include desktop computers, laptops, tablets, smart phones, smart watches, etc.

[0051] In this way, application information and authorization information are distributed to the original application in the electronic device on the server side, and the access application and the service application authenticate each other's access through the application information and authorization information. Compared with the client's user access request being authenticated through the gateway, the access authentication between applications no longer relies on the gateway layer, but is directly authorized on the server side, avoiding excessive workload on the gateway, thereby improving the access efficiency between applications.

[0052] Optionally, the backend gateway is also used to: monitor and scan the front-end application and the original application; perform route distribution and route flow control.

[0053] In some embodiments, the front-end application and the access application correspond through the back-end gateway, including one or more of Nest, Vulcan, mall application, cloud warehouse application, GUC, etc., and the service application includes one or more of order service application, inventory service application, membership service application, payment service application, third-party service application, etc.

[0054] Combine Figure 2 As shown, the embodiment of the present disclosure provides an access permission status determination system, including a server side 201, a client side 202, a front-end gateway 203, a front-end application 204, and a back-end gateway 205, wherein the server side 201 includes an acquisition module 101, a distribution module 102, multiple original applications 103, an application creation module 104, a port entry module 105 and a key management module 106, the acquisition module 101 is used to obtain application information and application tags corresponding to each original application, wherein the application tag includes at least one of a service tag and an access tag; the distribution module 102 is used to send corresponding application information to each original application, and send authorization information to each original application with a service tag, wherein the authorization information is obtained by granting access to each original application; the multiple original applications 103 include an access application 1031 and a service application 1032, the access application is used to generate an access signature according to the corresponding application information, and the service application is used to determine the access permission status of the access application to the service application according to the access signature and the authorization information, wherein the access application includes any original application with an access tag , the service application includes any original application with a service tag; the application creation module 104 is used to establish a new original application; the port entry module 105 is used to obtain the application registration information of the service application, and enter the external port to the service application according to the application registration information; the key management module 106 is used to obtain the encryption key, and the encryption key is obtained by encrypting the preset access key; if a key acquisition request sent by any original application is received, the application information corresponding to the original application is extracted to obtain the application permission information; the acquisition permission status corresponding to the key acquisition request is determined according to the application permission information; if the acquisition permission status is allowed to acquire, the encryption key is decrypted to obtain the access key, and the access key is sent to the original application; the client 202 is used to generate a user access request; the front-end gateway 203 is used to send the user access request to the front-end application; the front-end application 204 is used to respond to the user access request and obtain the application access request corresponding to the user access request; the back-end gateway 205 is used to authenticate and authorize the application access request, and send the application access request to the corresponding original application

[0055] The access permission status determination system provided by the embodiments of the present disclosure obtains application information and application tags corresponding to each original application, sends the corresponding application information to each original application, and sends authorization information to each original application with a service tag. This allows the access application to generate an access signature based on the corresponding application information, and allows the service application to determine the access permission status of the access application to the service application based on the access signature and authorization information. This system has the following advantages:

[0056] 1. By distributing application information and authorization information to the original application, there is no distinction between access applications and service applications. Access applications and service applications authenticate each other through application information and authorization information. This makes the access authentication between applications no longer dependent on the gateway layer, avoids excessive gateway workload, and thus improves the access efficiency between applications;

[0057] 2. It does not distinguish between access applications and service applications. When the original application has both access tags and service tags, it can access or provide services through its own behavior, simplifying the steps of distributing information to applications, improving distribution efficiency, and thus improving access efficiency between applications.

[0058] 3. When a service application provides a large number of external interfaces, the server manages access signatures and access permissions, and determines the access permission status of the access application through access signatures and access permissions. It does not rely on the gateway layer. The service layer can directly perform authentication, making some interfaces inaccessible to authorized access applications.

[0059] Combine Figure 3 As shown, an embodiment of the present disclosure provides an access permission status determination method based on an access permission status determination system, comprising:

[0060] Step S301: the distribution module sends application information to the access application;

[0061] Step S302: the distribution module sends authorization information to the service application;

[0062] Step S303: The access application applies for an access key from the key management module;

[0063] Step S304: The key management module decrypts the encryption key to obtain an access key;

[0064] Step S305: The key management module sends the access key to the access application;

[0065] Step S306: The access application extracts data from the application information corresponding to the access application to obtain a token value;

[0066] Step S307: The access application encrypts the token value according to the access key to obtain an access signature;

[0067] Step S308: The access application sends an application access request to the service application;

[0068] Wherein, the application access request includes an access signature;

[0069] Step S309: The service application applies for an access key from the key management module;

[0070] Step S310: The key management module decrypts the encryption key to obtain an access key;

[0071] Step S311: The key management module sends an access key to the service application;

[0072] Step S312: The service application verifies the access signature using the access key to obtain a signature verification result.

[0073] Step S313: If the signature verification result is passed, the service application authenticates the access application according to the preset authentication service and authorization information to obtain the access permission status;

[0074] In step S314 , if the access permission status is that the access permission is granted, the service application determines the access permission status as access permitted.

[0075] The access permission status determination method based on the access permission status determination system provided by the embodiment of the present disclosure obtains the application information and application tag corresponding to each original application, sends the corresponding application information to each original application, and sends authorization information to each original application with a service tag, so that the access application generates an access signature based on the corresponding application information, and the service application determines the access permission status of the access application to the service application based on the access signature and authorization information. In this way, by distributing application information and authorization information to the original application, without distinguishing between the access application and the service application, the access application and the service application perform mutual access authentication with each other through the application information and authorization information, so that the access authentication between applications no longer relies on the gateway layer, avoiding excessive workload on the gateway, thereby improving the access efficiency between applications.

[0076] Combine Figure 4 As shown, the embodiment of the present disclosure provides a method for determining an access permission status, including:

[0077] Step S401: Obtain application information and application tags corresponding to each original application;

[0078] Wherein, the application tag includes at least one of a service tag and an access tag;

[0079] Step S402: Send corresponding application information to each original application, and send authorization information to each original application with a service tag;

[0080] The authorization information is obtained by granting access authorization to each original application;

[0081] Step S403: any original application with an access tag is determined as an access application, and the access application is used to generate an access signature according to the corresponding application information;

[0082] Step S404: any original application with a service tag is determined as a service application, and the service application is used to determine the access permission status of the access application to the service application based on the access signature and authorization information;

[0083] The access application and the service application are different original applications.

[0084] The access permission status determination method provided by the embodiment of the present disclosure obtains the application information and application tag corresponding to each original application, sends the corresponding application information to each original application, and sends authorization information to each original application with a service tag, so that the access application generates an access signature based on the corresponding application information, and the service application determines the access permission status of the access application to the service application based on the access signature and authorization information. In this way, by distributing application information and authorization information to the original application, without distinguishing between the access application and the service application, the access application and the service application perform mutual access authentication with each other through the application information and authorization information, so that access authentication between applications no longer relies on the gateway layer, avoiding excessive workload on the gateway, and thus improving access efficiency between applications.

[0085] Figure 5 The following is a schematic diagram showing the structure of a computer system suitable for implementing an electronic device according to an embodiment of the present application. Figure 5 The computer system 500 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0086] like Figure 5As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 502 or the program loaded from the storage part 508 into the random access memory (RAM) 503, such as executing the method in the above embodiment. Various programs and data required for system operation are also stored in the RAM 503. The CPU 501, ROM 502 and RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0087] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, and the like; an output section 507 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 508 including a hard disk; and a communication section 509 including a network interface card such as a LAN (Local Area Network) card or a modem. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. Removable media 511, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 510 as needed, so that computer programs read therefrom can be installed into the storage section 508 as needed.

[0088] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 509, and / or installed from a removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the various functions defined in the system of the present application are executed.

[0089] It should be noted that the computer-readable medium shown in the embodiments of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable computer program. This propagated data signal can take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. A computer program embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0090] The embodiments of the present disclosure further provide a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, any one of the methods in the embodiments is implemented.

[0091] Regarding the computer-readable storage media in the embodiments of the present disclosure, those skilled in the art will understand that all or part of the steps in implementing the aforementioned method embodiments can be accomplished by hardware associated with the computer program. The aforementioned computer program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the aforementioned method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0092] The electronic device disclosed in this embodiment includes a processor, a memory, a transceiver, and a communication interface. The memory and the communication interface are connected to the processor and the transceiver and complete communication with each other. The memory is used to store computer programs, the communication interface is used to communicate, and the processor and the transceiver are used to run the computer program, so that the electronic device executes each step of the above method.

[0093] In this embodiment, the memory may include a random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage.

[0094] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a graphics processing unit (GPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0095] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible variations. Unless expressly required, individual components and functions are optional, and the order of operations may vary. Parts and subsamples of some embodiments may be included in or replace parts and subsamples of other embodiments. Moreover, the terms used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to also include the plural forms. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of one or more associated listings. In addition, when used in this application, the term "comprise" and its variations "comprises" and / or comprising refer to the presence of a stated subsample, whole, step, operation, element, and / or component, but do not exclude the presence or addition of one or more other subsamples, wholes, steps, operations, elements, components and / or groups of these. In the absence of further restrictions, an element defined by the statement "comprises a..." does not exclude the presence of other identical elements in the process, method or device that includes the element. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments can be referenced to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can be found in the description of the method part.

[0096] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. Technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present disclosure. Technicians can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0097] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units can be merely a logical functional division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some sub-samples can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units can be selected according to actual needs to implement this embodiment. In addition, the functional units in the embodiments of the present disclosure can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0098] The flowcharts and block diagrams in the accompanying drawings show the possible implementation architectures, functions and operations of the systems, methods and computer program products according to the embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment or part of the code, and the module, program segment or part of the code contains one or more executable instructions for implementing the specified logical functions. In some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, or they can sometimes be executed in the opposite order, which can depend on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in an order different from that disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, or they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified function or action, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A system for determining access permission status, characterized in that: include: an acquisition module, configured to acquire application information and an application tag corresponding to each original application, wherein the application tag includes at least one of a service tag and an access tag; a distribution module, configured to send corresponding application information to each of the original applications, and to send authorization information to each of the original applications having the service tag, wherein the authorization information is obtained by granting access authorization to each of the original applications; a plurality of original applications, including an access application and a service application, the access application being configured to generate an access signature based on corresponding application information, and the service application being configured to determine, based on the access signature and the authorization information, a state of access permission granted by the access application to the service application, wherein the access application includes any original application having the access tag, and the service application includes any original application having the service tag; Application creation module, used to create new original applications; The port entry module is used to obtain the application registration information of the service application and enter the external port into the service application according to the application registration information.

2. The system according to claim 1, wherein: The system further includes a key management module, which is configured to: Obtaining an encryption key, where the encryption key is obtained by encrypting a preset access key; If a key acquisition request is received from any of the original applications, data is extracted from the application information corresponding to the original application to obtain application permission information; Determining an acquisition permission status corresponding to the key acquisition request according to the application permission information; If the acquisition permission status is acquisition permission, the encryption key is decrypted to obtain the access key, and the access key is sent to the original application.

3. The system according to claim 2, characterized in that The access application generates an access signature in the following way: Obtain the access key and extract data from the application information corresponding to the access application to obtain a token value; The token value is encrypted according to the access key to obtain an access signature.

4. The system according to claim 3, characterized in that The service application determines the access permission status of the access application to the service application in the following manner: Obtaining the access key; Performing signature verification on the access signature using the access key to obtain a signature verification result, and at the same time, authenticating the access application according to a preset authentication service and the authorization information to obtain an access permission status corresponding to the access application; If the signature verification result is passed and the access permission status is granted, the access permission status is determined to be access permitted.

5. The system according to claim 1, wherein: The access application is also used to: Obtaining a sending interface configuration for the access application; The sending interface configuration is modified so that before the access application sends the application access request to the service application, the access signature is added to the application access request.

6. The system according to any one of claims 1 to 5, characterized in that The client connects to each of the original applications in sequence through the front-end gateway, the front-end application, and the back-end gateway, wherein: The client is used to generate a user access request; The front-end gateway is used to send the user access request to the front-end application; The front-end application is used to respond to the user access request and obtain an application access request corresponding to the user access request; The backend gateway is used to authenticate and authorize the application access request and send the application access request to the corresponding original application.

7. A method for determining an access permission status, characterized in that: include: Obtaining application information and application tags corresponding to each original application, wherein the application tags include at least one of a service tag and an access tag; Sending corresponding application information to each of the original applications, and sending authorization information to each of the original applications having the service tag, wherein the authorization information is obtained by granting access authorization to each of the original applications; determining any original application having the access tag as an access application, wherein the access application is used to generate an access signature according to corresponding application information; Determine any original application with the service tag as a service application, wherein the service application is used to determine the access permission status of the access application to the service application according to the access signature and the authorization information; Create new original applications; Acquire application registration information of the service application, and enter an external port into the service application according to the application registration information.

8. An electronic device, characterized in that: include: processor and memory; The memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the electronic device performs the method according to claim 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to claim 7 is implemented.

Images