Data processing method, device, electronic device and storage medium

Abstract

The present application provides a data processing method, device, electronic device and storage medium, which are applied to a data system, wherein the data system includes a proxy server and multiple service systems, and the data between different service systems are isolated from each other. The method is executed by the proxy server, and the method includes: receiving an interface request carrying an address link; wherein different address links correspond to different service systems; determining a target service system corresponding to the address link; sending the interface request to the target service system so that the target service system performs authentication processing on the interface request, and returns business data that provides business services for the interface request after the authentication processing is passed. The technical solution of the embodiment of the present application provides interface request authentication services for multiple service systems with data isolation.

Description

Technical Field

[0001] The present application relates to the field of secure network technology, and in particular to a data processing method, device, electronic device and storage medium. Background Art

[0002] The interface is generally called by sending an interface request to the data system so that the data system returns the data required to provide business services after successful authentication. However, in order to ensure the integrity of business functions, most data systems currently have multiple service systems. At the same time, in order to ensure the security of data in the service system, most data between service systems are isolated from each other. If an interface request is required to the data system, it is necessary to implement the functional integration development of the data system based on the source code of multiple service systems to meet the business requirements of the interface request.

[0003] However, due to security requirements, the source codes of different service systems are not open and interoperable. Therefore, the data system cannot implement authentication reuse for interface requests for different service systems based on source code development. Summary of the invention

[0004] To solve the above technical problems, the embodiments of the present application provide a data processing method and device, an electronic device, a computer-readable storage medium, and a computer program product.

[0005] According to one aspect of an embodiment of the present application, a data processing method is provided, which is applied to a data system, wherein the data system includes a proxy server and multiple service systems, wherein data between different service systems are isolated from each other, and the method is executed by the proxy server, and the method includes: receiving an interface request carrying an address link; wherein different address links correspond to different service systems; determining a target service system corresponding to the address link; sending the interface request to the target service system so that the target service system performs authentication processing on the interface request, and returns business data that provides business services for the interface request after the authentication processing is passed.

[0006] According to one aspect of an embodiment of the present application, there is provided a data processing method, which is applied to a data system, wherein the data system includes a proxy server and multiple service systems, wherein the multiple service systems include a main system and subsystems constructed based on the main system, and data between different service systems are isolated from each other, and the method is executed by the subsystem, and the method includes: receiving an interface request; wherein the interface request is forwarded by the proxy server to the subsystem based on an address link carried in the interface request; sending the interface request to the main system to perform joint authentication processing on the interface request in the main system; after the joint authentication processing is passed, providing business services for the interface request based on the business data returned by the main system and the business data obtained by the subsystem in response to the interface request.

[0007] According to one aspect of an embodiment of the present application, there is provided a data processing device, which is applied to a data system, wherein the data system includes a proxy server and multiple service systems, wherein data between different service systems are isolated from each other, and the device is configured in the proxy server, and the device includes: an interface request receiving module, configured to receive an interface request carrying an address link; wherein different address links correspond to different service systems; a target service system determining module, configured to determine the target service system corresponding to the address link; and an authentication module, configured to send the interface request to the target service system so that the target service system performs authentication processing on the interface request, and returns business data that provides business services for the interface request after the authentication processing is passed.

[0008] According to one aspect of an embodiment of the present application, there is provided a data processing device, which is applied to a data system, wherein the data system includes a proxy server and multiple service systems, wherein the multiple service systems include a main system and a subsystem built based on the main system, and data between different service systems are isolated from each other, and the device is configured in the subsystem, and the device includes: an interface request acquisition module, configured to receive an interface request; wherein the interface request is forwarded by the proxy server to the subsystem based on an address link carried in the interface request; a joint authentication module, configured to send the interface request to the main system, so as to perform joint authentication processing on the interface request in the main system; and a service provision module, configured to provide service services for the interface request based on the service data returned by the main system and the service data acquired by the subsystem in response to the interface request after the joint authentication processing is passed.

[0009] In one embodiment, the data processing device executed by the proxy server further includes:

[0010] A keyword extraction module, configured to extract keywords of the plurality of service systems respectively;

[0011] The address link acquisition module is configured to use the extracted keyword as the beginning of the uniform resource locator of the corresponding service system to obtain an address link containing the beginning of the uniform resource locator.

[0012] In one embodiment, the data processing device executed by the proxy server further includes:

[0013] An authentication preprocessing module, configured to perform authentication preprocessing on the interface request according to a target verification ticket carried in a header of the interface request;

[0014] An error reminder module, configured to return an error reminder if the authentication preprocessing fails;

[0015] The processing pass module is configured to execute the step of determining the target service system corresponding to the address link if the authentication preprocessing passes.

[0016] In one embodiment, in the data processing device executed by the proxy server, the authentication pre-processing module includes:

[0017] A pre-authentication information loading unit configured to load pre-cached pre-authentication information, wherein the pre-authentication information includes verification ticket information that has passed the pre-authentication process;

[0018] The query unit is configured to query whether there is information corresponding to the target verification ticket in the pre-authentication information.

[0019] In one embodiment, in the data processing device executed by the proxy server, the multiple service systems include a main system and a subsystem constructed based on the main system, the main system includes an authentication module, and the target service system is a subsystem; the authentication module includes:

[0020] The joint authentication unit is configured to send the interface request to the subsystem, so that the subsystem sends the interface request to the authentication module, and the authentication module performs joint authentication processing on the interface request.

[0021] In one embodiment, in the data processing device executed by the proxy server, the multiple service systems include a main system and a subsystem constructed based on the main system, the main system includes an authentication module, and the target service system is the main system; sending the interface request to the target service system includes:

[0022] The main system authentication unit is configured to send the interface request to the main system, so that the main system performs authentication processing on the interface request based on the authentication module.

[0023] In one embodiment, in the data processing device executed by the subsystem, the main system includes an authentication module; the joint authentication module includes:

[0024] The proxy gold medal verification unit is configured to send the interface request to the main system so that the authentication module verifies the proxy token contained in the interface request based on pre-stored token information; wherein the pre-stored token information includes proxy token information that has passed the authentication process.

[0025] In one embodiment, in the data processing device executed by the subsystem, the service providing module includes:

[0026] A data receiving unit, configured to receive the business data and authentication pass information returned by the subject system after the authentication is passed;

[0027] A data extraction unit configured to extract business data corresponding to the interface request based on the authentication information;

[0028] The business service providing unit is configured to provide business services for the interface request according to the business data returned by the subject system and the business data extracted based on the authentication information.

[0029] In one embodiment, the data processing device executed by the subsystem further includes:

[0030] A clustering tree structure acquisition module is configured to perform clustering processing on the business data returned by the main system to construct a clustering tree structure; wherein the data attribute similarity of each leaf node in the clustering tree structure is less than a preset threshold;

[0031] The data cleaning module is configured to perform data cleaning processing on the data in each leaf node respectively, so as to provide business services for the interface request based on the business data contained in the cleaned clustering tree structure.

[0032] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising one or more processors; and a storage device for storing one or more computer programs, wherein when the one or more computer programs are executed by the one or more processors, the electronic device implements the data processing method as described above.

[0033] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a computer, the computer executes the data processing method as described above.

[0034] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the data processing method provided in the above various optional embodiments.

[0035] According to one aspect of an embodiment of the present application, a computer program product is provided, including a computer program, which implements the steps in the data processing method described above when executed by a processor.

[0036] In the technical solution provided in the embodiments of the present application, the target service system that provides services for the interface request is accurately determined among multiple service systems whose data are isolated from each other based on the address link carried by the interface request. This allows the data-isolated service system to authenticate the interface request and provide business services for the interface request. The proxy server in this solution can route the interface request to different service systems based on the address link of the interface request, thereby achieving authentication multiplexing between data-isolated service systems.

[0037] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0039] Figure 1 It is a schematic diagram of an implementation environment involved in this application;

[0040] Figure 2 A schematic diagram of the structure of a data system involved in the application;

[0041] Figure 3 is a data processing flow chart of a data system for an interface request shown in an exemplary embodiment of the present application;

[0042] Figure 4 is a flow chart of a data processing method shown in an exemplary embodiment of the present application;

[0043] Figure 5 is a schematic diagram of data interaction between a front end and a data system shown in an exemplary embodiment of the present application;

[0044] Figure 6 is a flow chart of a data processing method shown in another exemplary embodiment of the present application;

[0045] Figure 7 is a flow chart of a data processing method shown in another exemplary embodiment of the present application;

[0046] Figure 8 It is a schematic diagram of the security domain and proxy server structure shown in an exemplary embodiment of the present application;

[0047] Fig. 9 is a flowchart of authentication preprocessing shown in an exemplary embodiment of the present application;

[0048] Fig.10 yes Figure 7 A flowchart of step S710 in the illustrated embodiment in an exemplary embodiment;

[0049] Fig.11 is a flowchart of authentication preprocessing shown in another exemplary embodiment of the present application;

[0050] Fig.12 yes Figure 4 A flowchart of step S450 in the illustrated embodiment in an exemplary embodiment;

[0051] Fig.13 is a schematic diagram of a control method for extracting business data shown in an exemplary embodiment of the present application;

[0052] Fig.14 yes Figure 4 A flowchart of step S450 in the illustrated embodiment in another exemplary embodiment;

[0053] Fig.15 is a flow chart of a data processing method shown in another exemplary embodiment of the present application;

[0054] Fig.16 yes Fig.15 A flowchart of step S1530 in the illustrated embodiment in an exemplary embodiment;

[0055] Fig.17 It is a schematic diagram of the authentication process of an authentication module for an interface request shown in an exemplary embodiment of the present application;

[0056] Fig.18 Fig.15 A flowchart of step S1550 in the illustrated embodiment in an exemplary embodiment;

[0057] Fig.19 is a flow chart of a data processing method shown in another exemplary embodiment of the present application;

[0058] Fig. 20 is a flow chart of a data cleaning method for dirty data shown in an exemplary embodiment of the present application;

[0059] Fig.21 is a schematic diagram of a clustering tree structure shown in an exemplary embodiment of the present application;

[0060] Fig. 22 It is a schematic diagram of the front-end module and back-end module structure of an implementation environment shown in an exemplary embodiment of the present application;

[0061] Fig.23 is a diagram of a rights management interface shown in an exemplary embodiment of the present application;

[0062] Fig.24 It is a schematic diagram of the data processing flow between the front-end module and the back-end module structure of an implementation environment of the present application;

[0063] Fig.25 is a business request flow chart shown in an exemplary embodiment of the present application;

[0064] Fig.26 is a business request flow chart shown in another exemplary embodiment of the present application;

[0065] Fig. 27 is a structural schematic diagram of a data processing device shown in an exemplary embodiment of the present application;

[0066] Fig.28 is a structural schematic diagram of a data processing device shown in another exemplary embodiment of the present application;

[0067] Fig.29 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0068] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0069] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0070] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0071] It should also be noted that the "multiple" mentioned in this application refers to two or more than two. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship.

[0072] First see Figure 1 , Figure 1 1 is a schematic diagram of an implementation environment involved in the present application. The implementation environment includes an interface request issuer 101, a terminal 102 and a server 103. The interface request issuer 101 can issue an interface request on the terminal 102, and the terminal 102 and the server 103 communicate through a wired or wireless network.

[0073] It should be understood that Figure 1 The number of interface request issuers 101 and terminals 102 in the figure is only for illustration. According to actual needs, there may be any number of interface request issuers 101 and terminals 102. One interface request issuer 101 may issue interface requests on multiple terminals 102. One terminal 102 may receive interface requests issued by multiple interface request issuers 101. After receiving the interface request, the terminal 102 may process data through the server of the terminal 102 itself to return the corresponding service in response to the interface request; or send the interface request to the server 103 for data processing to return the corresponding service in response to the interface request.

[0074] In some embodiments of the present application, the data processing method can be executed by the server 103. Accordingly, the data processing device is configured in the server 103. The interface request issuer 101 can issue an interface request on the terminal 102, such as by touching or clicking on the application interface of the terminal 102 to issue an interface request at the front end of the terminal 102. After receiving the interface request, the front end of the terminal 102 sends the interface request to the server 103 so that the server 103 processes the interface request. Finally, the server 103 returns the data processing result to the front end of the terminal 102 to provide business services in response to the interface request. Of course, after receiving the interface request, the terminal 102 can also perform data processing through the back-end server of the terminal 102, and finally provide business services in response to the interface request.

[0075] Among them, the terminal 102 includes but is not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc., such as smart phones, tablets, laptops, computers, and any other electronic devices that can realize image visualization, which are not limited here. The server end 103 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, wherein multiple servers can form a blockchain, and the server is a node on the blockchain. The server end 103 can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network, content distribution network) and big data and artificial intelligence platforms, which are not limited here.

[0076] It should be noted that this embodiment is only an exemplary implementation environment proposed to facilitate understanding of the concept of the present application, and cannot be considered as providing any limitation on the scope of use of the present application.

[0077] It can be understood that in the specific implementation of the present application, related data such as user information, user verification ticket information, user authentication information, etc. are involved. When the above embodiments of the present application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0078] Figure 2 A data system is shown according to an exemplary embodiment. The system can be configured in Figure 1 The terminal 102 or the server 103 is used to process data of the interface request, such as authenticating the interface request and returning business data after successful authentication.

[0079] like Figure 2As shown, the data system may include: a processing server 201 , a management station 221 , a proxy server 211 , a main system 213 and a subsystem 223 .

[0080] It should be understood that Figure 2 The data of the main system 213 and the subsystem 223 are only exemplary. In other embodiments, the data system includes multiple service systems, the data between the service systems are isolated from each other, and each service system can return business data for interface requests; wherein, the main system 213 among the multiple service systems is a service system that can provide a complete response process for interface requests, and the subsystem 223 is a service system formed by adding functions on the basis of the corresponding main system. The subsystem 223 can return business data for the corresponding interface request, but it cannot implement the entire process of responding to the interface request, such as the subsystem 223 cannot authenticate the interface request and cannot obtain business data during the authentication process.

[0081] In some embodiments of the present application, the data processing flow of the data system for the interface request can refer to Figure 3 After receiving the interface request, the data system will analyze the interface request through the processing server 201. If the interface request is a static page proxy (a static page is a static web page that actually exists and does not need to be compiled by the server. It is directly loaded into the client browser for display. The static page proxy is an interface request issued for a static web page), the interface request will be sent to the management station 221 for processing. If the interface request is a dynamic page proxy, that is, an HTTP (Hyper Text Transfer Protocol) request proxy (a dynamic page changes with time, environment or the result of database operations. The dynamic page proxy is an interface request issued for a dynamic page), the interface request will be sent to the proxy server 211.

[0082] The management station 221 stores static files of the main system 213 and the subsystem 223. Since the static page proxy does not need to perform authentication and other processing, the management station 221 can directly extract the business data corresponding to the interface request from the stored static files after receiving the interface request. Then, the data system will return the business data to the terminal 102, and the business service results can be visualized on the display module of the terminal 102.

[0083] When the interface request is an HTTP request proxy (HTTP request: a request message from the client to the server), the interface request carries an address link, and different address links are configured for different service systems in the proxy server 211. The proxy server 211 receives the interface request carrying the address link, and determines the target service system corresponding to the address link in multiple service systems; then the interface request is sent to the target service system so that the target service system authenticates the interface request, and returns the business data that provides business services for the interface request after the authentication process is passed.

[0084] When the target server is the main system 213, since the main system 213 is a complete service system, which includes an authentication module, the authentication module of the main system 213 can authenticate the interface request. After the authentication is successful, the business data corresponding to the interface request can be extracted from the main DB (database) of the main system, and then the business data is returned to the terminal 102, and the business service results can be visualized in the display module of the terminal 102.

[0085] When the target server is subsystem 223, since the subsystem is a service system formed by adding functions on the basis of the corresponding main system, it does not have an authentication module. Therefore, subsystem 223 needs to send the interface request to the main system 213 through the open API (interface) of the main system 213 through the joint authentication module set therein, so as to jointly authenticate the interface request through the authentication module in the main system 213. Similarly, after the authentication module in the main system 213 successfully authenticates, the main system 213 will return the authentication result and the business data related to the interface request to the joint authentication module of subsystem 223. Subsystem 223 will extract the business data related to the interface request from its own database (sub-DB) and business system (business system customized by the subsystem) based on the authentication result. Then the data system returns the business data extracted by subsystem 223 and the business data returned by the main system 213 to terminal 102, and the business service results can be visualized on the display module of terminal 102.

[0086] Of course, the obtained business data may contain a large amount of dirty data, and the business data may be cleaned and then returned to the terminal 102 , and the business service results may be visualized on the display module of the terminal 102 .

[0087] It should be noted that the data system provided in this embodiment is only an exemplary implementation environment proposed to facilitate understanding of the concept of the present application, and cannot be considered as providing any limitation on the scope of use of the present application.

[0088] Figure 4is a flowchart of a data processing method according to an exemplary embodiment. The data processing method can be applied to Figure 2 The data system shown is specifically executed by the proxy server 211 in the data system. It should be understood that the method can also be used in other exemplary implementation environments and be specifically executed by devices in other implementation environments. This embodiment does not limit the implementation environment to which the method is applicable.

[0089] In an exemplary embodiment, the method may include steps S410 to S450, which are described in detail as follows:

[0090] Step S410: receiving an interface request carrying an address link; wherein different address links correspond to different service systems.

[0091] After receiving the interface request, the data system needs to authenticate the interface request first, and then extract the relevant business data after it is securely passed. The business data required by the interface request may be located in different service systems. In this embodiment, a proxy server is set up, and different address links are configured for different business systems in the proxy server. In this way, the service system where the business data corresponding to the interface request is located can be determined through the address link.

[0092] In one embodiment, reference may be made to Figure 5 The user initiates an interface request (HTTP request: a request message from the client to the server, that is, a request message from the terminal to the data system) at the front end through the terminal. The interface request completes multiple interactions between the terminal and the data system, and the interface request falls to the proxy server.

[0093] It should be noted that if Figure 2 As shown, if the interface request is a static page proxy, the interface request is directly sent to the management station. Therefore, the interface requests described in this embodiment and the following embodiments are all HTTP requests unless otherwise specified.

[0094] In this embodiment, the proxy server can be a server such as SCRM (Social Customer Relationship Management). Of course, in order to ensure the security of data processing, the proxy server can also first perform machine legitimacy authentication on the interface request. If the authentication is passed, the next step will be executed. Otherwise, a notification can be sent to the front end to indicate that the user has no authority.

[0095] The interface request includes a URL (uniform resource locator), a header / request header, and a request body. The address link in this embodiment can be the beginning of the URL, and the keywords of each service system can be used to identify the corresponding address link. For example, in the A service system, A is the name of the service system, then A is extracted as the keyword of the A service system, and A is used as the beginning of the uniform resource locator, that is, the address link of / A is obtained. If the URL in the interface request begins with / A, it can be proved that the business data required by the interface request is in the A service system.

[0096] Of course, what is proposed above is to use the name of the service system as a keyword to correspond to the address link of the service system. Of course, it can also be other keywords of the service system, such as the functions completed by the service system, its producer or custom text, which can all be used as keywords of the service system to obtain the address link of the corresponding service system. Of course, in a data system, since the address links of each service system are determined based on the keywords of each service system, the address links between each service system are different.

[0097] Step S430: Determine the target service system corresponding to the address link.

[0098] In this embodiment, the proxy server classifies the interface request and determines the corresponding target service system according to the address link in the interface request.

[0099] Step S450: Send the interface request to the target service system so that the target service system performs authentication processing on the interface request and returns the business data providing business services for the interface request after the authentication processing is passed.

[0100] After determining the target service system, the proxy server sends the interface request to the target service system through the interface of the target service system, so that the target service system performs the next step of processing based on the interface request.

[0101] In this embodiment, after receiving the interface request, the target service system first performs authentication processing on the interface request, and determines whether the interface request has the authority to obtain the corresponding business data through authentication processing. The authentication processing can be completed through a token (a token is a string of characters generated by the verification server and serves as a token for the client request) verification mechanism. After the authentication is passed, the business data corresponding to the interface request is extracted from the database to provide business services for the interface request.

[0102] In this embodiment, different interface requests can be routed to different service systems through the proxy server according to the address link in the interface request, so as to complete data isolation and authentication reuse between multiple service systems. This solution can not only realize data isolation between multiple service systems, but also completely isolate the development source code services of each service system, make them independent of each other, and improve the security of the system; at the same time, the interface request is routed based on the address link in the interface request, and a complete set of authentication logic is used from the interface level, so that the data system becomes a united whole, which is convenient for the joint and collaborative development of various service systems, and also enables the main system and subsystems that are not open source to jointly provide services. On the premise of improving the security of interface requests, data isolation can be developed separately for different service systems, which can improve the efficiency of service system development.

[0103] Figure 6 FIG. 1 is a flow chart of a data processing method according to another exemplary embodiment. Figure 6 As shown, in an exemplary embodiment, the method is implemented in Figure 4 Before step S410 in the above method, steps S610 to S630 may be included, which are described in detail as follows:

[0104] Step S610: extract keywords of multiple service systems respectively.

[0105] In this embodiment, different keywords can be extracted for different service systems. The keyword can be the name of the corresponding service system, the implemented function, the executed device, etc., or it can be a custom text. No specific restrictions are made here, but the keywords obtained by different service systems are different, and one service system extracts multiple keywords.

[0106] Step S630: Using the extracted keyword as the beginning of the uniform resource locator of the corresponding service system to obtain an address link containing the beginning of the uniform resource locator.

[0107] The interface request will include a URL. In this embodiment, the extracted keyword is used as the beginning of the uniform resource locator of the corresponding service system, and the beginning of the URL is used as an address link to correspond to different service systems. In this way, after receiving the interface request, the proxy server can extract the address link starting with the URL in the interface request to match the target service system.

[0108] In this embodiment, a method for implementing an address link is provided. Based on the keywords of different service systems, address links of different service systems are set accordingly, and the keywords are used as the beginning of the URL in the interface request. In this way, the proxy server can determine the service system that can provide services based on the interface request. The proxy server can branch the interface request to achieve authentication multiplexing between multiple service systems with data isolation, so that the authentication of the interface request can be completed on the basis of complete isolation of the development source code services of each service system.

[0109] Figure 7 FIG. 1 is a flow chart of a data processing method according to another exemplary embodiment. Figure 7 As shown, in an exemplary embodiment, the method is implemented in Figure 4 After step S410 in the method, steps S710 to S730 may be included, which are described in detail as follows:

[0110] Step S710: Perform authentication preprocessing on the interface request according to the target verification ticket carried in the header of the interface request.

[0111] In this embodiment, in order to improve the security of the interface request response, a security domain is also set in the proxy server, or a security domain is set at the interface layer where the proxy server is located, such as Figure 8 As shown, through the data interaction between the proxy server and the security domain, the proxy request is authenticated and pre-processed, that is, the security domain first authenticates the legitimacy of the proxy request and filters the interface request sent from the external network. Figure 8 To exemplify the structure of the security domain in the proxy server, in other embodiments, the security domain may be set in the proxy server, and the security domain may perform authentication preprocessing through the gateway in the proxy server. No specific limitation is made here.

[0112] The headers in the interface requests all carry a verification ticket. In this embodiment, the interface request can be pre-processed for authentication based on the target verification ticket carried in the header of the interface request.

[0113] For example, in a specific embodiment, the security domain is to screen the access to the external network or the internal network. Of course, if the internal network or the external network is used for authentication preprocessing, the target verification ticket is the request IP (website) of the interface request. The specific authentication preprocessing process can be referred to Fig. 9 , the user can send an interface request from the front end of the terminal through the intranet or extranet link. The interface reaches the proxy server through the processing server. The proxy server will analyze the header in the interface request, extract the user-agent in the header, and determine what port the interface request is accessed from, such as PC (personal computer) terminal, mobile terminal, etc. At the same time, the intranet segment can be set in the security domain of the proxy server, such as Fig. 9 The network segments 3.xxx / 8, 10.xxx / 8, etc. are listed in the example. Of course, Fig. 9 The network segments listed in the example are only illustrative, and in other embodiments, other network segments can be customized according to actual needs.

[0114] When it is determined that the interface request is for PC access, it is verified whether the IP sent by the interface request is in the set intranet segment. If so, it proves that the interface request authentication preprocessing has passed. Otherwise, it has failed, proving that the interface request has no authority.

[0115] Of course, the above-mentioned method of setting up an intranet segment in the security domain for preprocessing is only exemplary. The security domain can also set users and tokens as target verification tickets, such as judging whether the user who issued the interface request has the authority or token verification based on the interface request to pre-authenticate the interface request, which is not limited here. The above-mentioned intranet segment is also exemplary. In other embodiments, other IPs can be set as intranet segments, which are not specifically limited here.

[0116] Step S730: If the authentication preprocessing fails, an error prompt is returned.

[0117] If the authentication preprocessing fails, it proves that the interface request is not authorized. At this time, an error reminder can be returned to the front end to indicate to the customer that the interface request is not authorized and the interface request cannot be made.

[0118] Of course, if the authentication preprocessing passes, jump to Figure 4 Step S430 in .

[0119] If the authentication preprocessing is passed, it proves that the interface request is authorized, and the data system can return business data based on the interface request. At this time, the proxy server will branch according to the address link in the interface request to determine the target service system.

[0120] In this embodiment, the interface requests are pre-processed for authentication to improve the security of the system. By screening out unauthorized interface requests, the processing workload of the data system can be reduced. Only the interface requests that have successfully undergone authentication pre-processing are processed for the next step of data processing, greatly improving the efficiency of interface request data processing.

[0121] Fig.10 yes Figure 7 The flowchart of step S710 in the embodiment shown is in an exemplary embodiment. Fig.10 As shown, in an exemplary embodiment, the process of performing authentication preprocessing on the interface request according to the verification ticket carried in the header of the interface request in step S710 may include steps S1010 to S1030, which are described in detail as follows:

[0122] Step S1010: loading pre-cached pre-authentication information, where the pre-authentication information includes verification ticket information that has passed the pre-authentication process.

[0123] In this embodiment, the process of performing authentication preprocessing between modules in the security domain of the proxy server can be referred to Fig.11 , the control device can pre-configure pre-authentication for the security domain. The security domain can run in the environment of EMAS (Enterprise Mobile Application Studio, a mobile R&D platform for enterprises) K8S (Kubernetes, a portable container orchestration management tool born from container services). The security domain is equipped with API gateway management service, API gateway core forwarding and pre-authentication DB. The API gateway management service is used to communicate with the control device and can synchronize the pre-authentication configuration. The pre-authentication DB caches pre-authentication information, which includes verification ticket information that has passed the pre-authentication process. The verification ticket information can be as follows Fig. 9 The intranet segment and user name shown are tokens, etc. The API gateway performs pre-authentication processing for interface requests during core forwarding.

[0124] In a specific embodiment, when the proxy server receives an interface request, the security domain will start the pre-authentication process, and the control device will issue an authentication instruction through the API gateway management service to control the API gateway core forwarding to perform pre-authentication processing. At this time, the API gateway core forwarding will load the pre-cached pre-authentication information from the pre-authentication DB, and will also extract the target verification ticket from the header of the interface request.

[0125] Of course, since the target verification ticket may be different in different embodiments, the verification ticket information in the pre-authentication DB will naturally be different. For example, in one embodiment, the URL IP of the interface request is used as the target verification ticket. At this time, the pre-authentication DB stores the network segment of the intranet, and the loaded pre-authentication information is also the network segment of the intranet; if the token carried by the interface request is used as the target verification ticket, then the pre-authentication DB stores the token data with the permission set, and the loaded pre-authentication information is also the token data.

[0126] Step S1030: Query whether there is information corresponding to the target verification ticket in the pre-authentication information.

[0127] In this embodiment, after the API gateway core forwarding loads the pre-cached pre-authentication information from the pre-authentication DB, it will query whether there is information corresponding to the target verification ticket in the pre-authentication information. If it is not found, the authentication preprocessing has failed, and an error reminder will be returned to the front end, and the front end will indicate to the user that there is no authority. If it is found, the authentication preprocessing has passed. At this time, the API gateway core forwarding marks the authentication preprocessing pass information in the header of the interface request, and then sends the interface request to the module in the proxy server that performs interface request routing to determine the target service system.

[0128] Of course, after the interface request authentication preprocessing is passed, the authentication preprocessing process information can also be stored in the pre-authentication DB to facilitate subsequent tracing.

[0129] In this embodiment, an authentication preprocessing process is proposed, which pre-caches the verification ticket information that has passed the authentication preprocessing in the security domain. After that, a hit query can be performed on the target verification ticket of the interface request. In this way, it is ensured that the initiated interface request can pass the machine legitimacy authentication, and the interface requests that fail are screened out to improve security, while ensuring the processing efficiency of the interface request.

[0130] Fig.12 yes Figure 4 The flowchart of step S450 in the embodiment shown is in an exemplary embodiment. Fig.12 As shown, in an exemplary embodiment, Figure 4 The multiple service systems proposed in the embodiment include a main system and a subsystem built based on the main system, the main system includes an authentication module, and the target service system is a subsystem, and the process of sending the interface request to the target service system in step S450 may include step S1210, which is described in detail as follows:

[0131] Step S1210: Send the interface request to the subsystem, so that the subsystem sends the interface request to the authentication module, and the authentication module performs joint authentication processing on the interface request.

[0132] In this embodiment, the service system in the data system includes a main system and a subsystem. The main system is a complete service system that can independently process interface requests, and the subsystem is a service system with new functions developed based on the main system, that is, the subsystem is a service system obtained by adding business functions that cannot be realized in the corresponding main system.

[0133] For example, when a service system cannot meet some of the user's business needs, some new business modules can be developed based on the service system. At this time, the service system can be called the main system, and the newly developed business modules are called subsystems.

[0134] In some cases, the integrated authentication between multiple systems is generally achieved through communication at the source code or HTTP interface level between service systems. However, the main system and subsystem are usually not developed by the same team and cannot share the source code between the main system and the subsystem, or to ensure data security between the main systems, the newly added subsystem cannot interfere with the data processing of the main system. At this time, the data between the subsystem and the main system are isolated; at this time, the authentication between the main system and the subsystem cannot be achieved through the source code. At this time, the main system is a complete service system that stores an authentication module, which can be used to complete the authentication of interface requests. When the interface request is routed to the subsystem, since the subsystem is a new service system for the main system, it generally does not have its own authentication module. If an authentication module is set up in the subsystem at this time, the amount of authentication data is large and the cost is huge, which ultimately deviates from the original intention of the subsystem being a new functional service system that needs to be lightweight and convenient, affecting the performance of the subsystem.

[0135] In this embodiment, when the target system is determined to be a subsystem, an open API is set on the main system, so that the subsystem sends the interface request to the main system through the open API, and the interface request can be jointly authenticated through the authentication module in the main system. In this way, the authentication of the interface request can be completed without adding a new authentication module to the subsystem.

[0136] In this embodiment, since the subsystem is a service system obtained by relying on the newly added functions of the main system, the authentication processing of the subsystem can be implemented through the main system. After receiving the interface request, the subsystem can send the interface request to the main system to access the authentication module of the main system for joint authentication processing. The authentication module of the main system can perform authentication through token verification.

[0137] In this embodiment, after the main system performs the authentication process, if it fails, the authentication result of the failed authentication is returned to the subsystem. After receiving the authentication result, the subsystem can return an error reminder to the terminal front end, indicating that the interface request has no authority; if it passes, the main system will extract the business data required for the interface request based on the interface request, and then return the authentication result of the passed authentication and the extracted business data to the subsystem, such as Fig.13 The figure is a schematic diagram of the control method of extracting business data by the main system in one embodiment, wherein the master data management can manage and control the data in the database based on the interface request, such as applying for, approving, creating, etc. the data in the database, and finally obtaining the business data required by the interface request.

[0138] After receiving the authentication result, the subsystem will extract the business data required by the interface request from its own database based on the interface request, and then provide service services for the interface request based on the business data extracted by itself and the business data sent by the main system. Of course, the subsystem can also extract business data through Fig.13 is completed in this way.

[0139] Since the subsystem is a new functional system of the main system, when processing interface requests, the subsystem may need to obtain some business data required for the interface requests from the main system. Therefore, after the authentication is passed, the main system extracts the relevant business data from the database of the main system and then sends it to the subsystem.

[0140] In a specific embodiment, after the subsystem obtains the business data returned by the main system, the returned business data may contain a large amount of dirty data during the integration process of the main system. At this time, the returned business data can be cleaned to obtain the required business data, and then provide business services for the interface request; of course, the business data extracted by the subsystem can also be cleaned before providing business services for the interface request.

[0141] In this embodiment, after receiving the interface request, the subsystem sends the interface request to the corresponding main system for joint authentication processing, so that the interface request can be fully authenticated without adding a new authentication module to the subsystem, which greatly reduces the authentication cost. In addition, the subsystem and the main system share a set of authentication logic, which can improve the efficiency of the authentication processing.

[0142] Fig.14 yes Figure 4 The flowchart of step S450 in the embodiment shown is in an exemplary embodiment. Fig.14 As shown, in an exemplary embodiment, Figure 4 The multiple service systems proposed in the embodiment include a main system and a subsystem built based on the main system, the main system includes an authentication module, and the target service system is the main system. The process of sending the interface request to the target service system in step S450 may include step S1410, which is described in detail as follows:

[0143] Step S1410: Send the interface request to the main system, so that the main system performs authentication processing on the interface request based on the authentication module.

[0144] In this embodiment, if the proxy server sends the interface request to the main system, and the main system is a business system that can independently and completely process the interface request, which includes an authentication module, the main system can authenticate the interface request through the authentication module.

[0145] If the authentication fails, an error reminder can be returned to the terminal front end, indicating that the interface request is not authorized; if the authentication passes, the required business data can be extracted based on the interface request to provide business services for the interface request based on the business data. Similarly, the authentication module can perform authentication through token verification.

[0146] Of course, the main system can also be Fig.13 The extraction method shown extracts business data.

[0147] In this embodiment, when the target service system is a main module, the authentication processing of the interface request is directly completed through the authentication module to improve the security of the interface request.

[0148] Fig.15 is a flowchart of a data processing method according to another exemplary embodiment. The data processing method can be applied to Figure 2 The data system shown is specifically executed by the subsystem 223 in the real data system. It should be understood that the method can also be used in other exemplary implementation environments and be specifically executed by devices in other implementation environments. This embodiment does not limit the implementation environment to which the method is applicable.

[0149] In an exemplary embodiment, the method may include steps S1510 to S1550, which are described in detail as follows:

[0150] Step S1510: Receive an interface request.

[0151] In this embodiment, the user can initiate an interface request through the front end. Similarly, if the interface request is a static page proxy, the interface request will be sent to the management console for processing. Therefore, the interface requests mentioned below are all HTTP requests. The interface request arrives at the proxy server and is routed after authentication preprocessing. Of course, in this embodiment, the proxy server analyzes the interface request based on the address link carried in the interface request and determines that the target service system is a subsystem.

[0152] Step S1530: Send the interface request to the main system to perform joint authentication processing on the interface request in the main system.

[0153] After receiving the interface request, the subsystem, because it does not have an authentication module itself, sends the interface request to the main system, so as to perform joint authentication processing on the interface request by accessing the authentication module of the main system.

[0154] Step S1550: After the joint authentication process is passed, based on the business data returned by the main system and the business data obtained by the subsystem in response to the interface request, provide business services for the interface request.

[0155] In this embodiment, after the main system performs the authentication process, if it fails, it will return the authentication result of the failed authentication to the subsystem. After receiving the authentication result, the subsystem can return an error reminder to the terminal front end, indicating that the interface request is not authorized; if it passes, the main system will pass the authentication based on the interface request. Fig.13 The proposed control method extracts the business data required by the interface request, and then returns the authentication result passed by the authentication and the extracted business data to the subsystem.

[0156] After receiving the authentication result, the subsystem will also pass the authentication based on the interface request. Fig.13 The proposed control method extracts the business data required for the interface request from its own database, and then provides service business for the interface request based on the business data extracted by itself and the business data sent by the main system.

[0157] Of course, the business data obtained by the main system and the business data obtained by the subsystem can provide service business for the interface request after data cleaning.

[0158] In this embodiment, after the interface request of the subsystem is raised, a joint authentication process can be performed in the corresponding main system, so that the subsystem does not need to add a new authentication module, which greatly reduces the authentication cost and improves the efficiency of the authentication process.

[0159] Fig.16 yes Fig.15 The flowchart of step S1530 in the embodiment shown is in an exemplary embodiment. Fig.16 As shown, in an exemplary embodiment, the subject system includes an authentication module, and step S1530 sends the interface request to the subject system, so that the process of performing joint authentication processing on the interface request in the subject system may include step S1610, which is described in detail as follows:

[0160] Step S1610: Send the interface request to the main system so that the authentication module verifies the proxy token included in the interface request based on the pre-stored token information.

[0161] The pre-stored token information includes the proxy token information that has passed the authentication process. In this embodiment, the authentication process of the authentication module for the interface request can refer to Fig.17 .

[0162] like Fig.17As shown, after receiving the interface request, the authentication module will determine the production environment (i.e., the formal online environment) of the interface request. The production environment can be determined based on the domain name in the interface request. The authentication module will pre-determine some standard production environments, such as IP domain names. After receiving the interface request, the domain name of the interface request can be extracted. If the domain name does not conform to the standard production environment, the token (proxy token) can be read from the header of the interface request to verify whether the pre-stored token information contains the proxy token. If the verification is successful, the authentication is successful, otherwise the authentication fails.

[0163] If the domain name meets the standard production environment, the parameters such as uid (user account), nonce (random number), timestamp (timestamp), sign (signature) in the interface request can be read, and then the timestamp can be verified. If the timestamp verification fails, the interface request is considered to be an illegal request, the authentication fails, and the authentication result of the authentication failure is returned to the subsystem; if the timestamp verification is successful, Redis (Remote Dictionary Server) reads the proxy token according to the uid, and then generates a signature through md5, such as md5 (uid+nonce+timestamp+token). After the signature is generated, the signature is verified. After the signature verification is successful, the pre-stored token information is verified to see if the proxy token exists. If the verification is successful, the authentication is successful. The main system will extract the business data and return the business data and the authentication result of the successful authentication to the subsystem. Otherwise, the authentication fails and the authentication result of the failed authentication is returned to the subsystem.

[0164] This embodiment provides an authentication method for interface requests, which can improve the authentication efficiency of interface requests and increase the security of data processing.

[0165] Fig.18 yes Fig.15 The flowchart of step S1550 in the embodiment shown is in an exemplary embodiment. Fig.18 As shown, in an exemplary embodiment, the process of providing business services for the interface request based on the business data returned by the main system and the business data obtained by the subsystem in response to the interface request in step S1550 may include steps S1810 to S1850, which are described in detail as follows:

[0166] Step S1810: receiving the business data and authentication pass information returned by the subject system after authentication is passed.

[0167] In this embodiment, after the authentication module of the main system passes the authentication, the main system will extract the business data and return the extracted business data and authentication pass information to the subsystem.

[0168] Step S1830: extracting the business data corresponding to the interface request based on the authentication information.

[0169] Since the subsystem cannot perform authentication, the subsystem can only extract the business data corresponding to the interface request after receiving the authentication pass information.

[0170] Step S1850: Provide business services for the interface request based on the business data returned by the main system and the business data extracted through authentication information.

[0171] In this embodiment, after the subsystem obtains the business data returned by the main system, the returned business data may contain a large amount of dirty data. The returned business data can be cleaned before providing business services for the interface request; similarly, the business data extracted by the subsystem can also be cleaned before providing business services for the interface request.

[0172] In this embodiment, authentication and extraction of relevant business data are performed through the main system, so that the subsystem can achieve authentication without setting up an authentication module. At the same time, the business data returned by the main system can be received, and the business data related to the interface request can be obtained on the basis of data isolation. There is no need to store a large amount of business data in the subsystem, which greatly reduces the cost and storage volume of the subsystem and improves the performance of the subsystem.

[0173] Fig.19 is a flow chart of a data processing method according to another exemplary embodiment. Fig.19 As shown, in an exemplary embodiment, the method relies on a tree structure in artificial intelligence and machine learning, and these embodiments will be described in detail below.

[0174] Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.

[0175] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics and other technologies. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0176] Machine Learning (ML) is a multi-disciplinary subject that involves probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and teaching learning.

[0177] Specifically, Fig.19 The method shown is executed in Fig.18 Before step S1850 in the method, the method may include steps S1910 to S1930, which are described in detail as follows:

[0178] Step S1910: cluster the business data returned by the main system and construct a clustering tree structure.

[0179] This embodiment proposes a method for cleaning business data. Fig. 20 A flow chart of a data cleaning method for dirty data is shown. Different cleaning algorithms and cleaning rules can be set for dirty data. The dirty data is processed by manual cleaning or automatic cleaning to obtain data that meets the requirements. The cleaning algorithms and cleaning rules can be set according to the required data.

[0180] In a specific embodiment, data cleaning can be performed using a clustering tree structure, such as Fig.21 As shown, the business data returned by the main system can be clustered to construct Fig.21 In the clustering tree structure shown, each leaf node in the clustering tree structure is an array, and the similarity of data attributes in the array is less than a preset threshold.

[0181] Step S1930: Perform data cleaning on the data in each leaf node respectively, so as to provide business services for the interface request based on the business data contained in the cleaned clustering tree structure.

[0182] In the clustering tree structure, the data in each leaf node has a high degree of similarity, and the data can be considered to be repeated or similar. In this way, the data in each leaf node can be cleaned to obtain cleaned business data.

[0183] Of course, what is proposed above is a method of cleaning data through a clustering tree structure. In other embodiments, data cleaning can also be performed by tree search, construction of a maximum heap tree, detection of error values, etc., which is not specifically limited here.

[0184] Similarly, this embodiment proposes to perform data cleaning on the business data returned by the main system, but in actual applications, data cleaning can also be performed on the business data extracted by the subsystem, or data cleaning can be performed on the business data after the business data returned by the main system and the business data extracted by the subsystem are integrated.

[0185] In this embodiment, a data cleaning method is proposed, which can clean business data, improve the quality of business data, and better provide business services for interface requests.

[0186] based on Figures 4 to 21 The data processing method proposed in this embodiment provides a specific implementation method, such as Fig. 22 The front-end module and back-end module structure diagram of a specific implementation environment proposed, the implementation environment diagram includes the front-end module and back-end module of the main system, the back-end module includes: gateway module, business service module, business data storage module, Fig. 22 The main system and the subsystem front-end module also include the subsystem front-end module and the back-end module. The back-end module of the subsystem includes: the business service module and the business data storage module provided by the subsystem. Figure 1 The front end of the terminal in the real-time environment, which includes multiple business entrances. Users can send different interface requests by selecting different business entrances. The gateway in the main system supports the business services provided by the main system. The business service modules of the main system and the subsystem are the business services that the corresponding service systems can provide. For example, there may be business service sections such as user domain and public service domain in the main system. Different business service sections provide different business services. Since the subsystem is a service system newly added to the main system, its service sections may be fewer, and the business it provides needs to open the gateway OpenAPI / Oauth2 (open authorization) to access the main business services when accessing the business services of the main system; the business data storage modules of the main system and the subsystem respectively store the business data required for the business services provided by the corresponding business systems. For example, the business data storage module of the main system may have databases such as file storage and session record storage.

[0187] based on Figures 4 to 21The data processing method proposed in this embodiment provides a specific implementation method, such as Fig.23 A proposed permission management interface diagram, such as Fig.23 As shown, this page can be displayed to the super administrator / administrator through the front end. The super administrator can group users in this interface to assign different functional permissions to different users. The functional permissions are reflected in the subsequent authentication process, such as Fig.23 In the functional permissions, if user A has business 1, when user A initiates a business request corresponding to business 1, the data system will pass the authentication of the business request when processing the data. However, for business 2, if user A does not have business 1, when user A initiates a business request corresponding to business 2, the data system will not pass the authentication of the business request when processing the data. Fig.23 The interface shown completes the permission configuration for adding, deleting, and modifying users.

[0188] based on Figures 4 to 21 The data processing method proposed in this embodiment provides a specific implementation method, such as Fig.24 The schematic diagram of the data processing flow of the front-end and back-end modules in an implementation environment shown in the figure, wherein the front-end, interface layer, main system and subsystem in the logic layer, external access layer, batch running module and core system & dependent services, the external access layer aggregates and pulls business data through the internal interface and distributes customer lists and tags, the core system & dependent services can control Fig.24 The thread management, security, memory management, etc. in the modules shown may include content middle platform, core system, data service and other sections; and the batch running module can pull business data to form business reports.

[0189] exist Fig.24 In the system, users can issue interface requests through the front end of the main system or subsystem, based on the external network or the internal network (such as the management console, third-party applications). The interface request reaches the proxy server of the interface layer to split the interface request. The interface request can reach the main system to authenticate the interface request and obtain business data in the main system. The interface request can also reach the subsystem. The core module in the subsystem will send the interface request to the open API of the main system through the customized development module. Of course, the open API of the main system can import user lists, tags and other information from the internal interface aggregation in the external access layer. The interface request is jointly authenticated by the main system, and then after the authentication is successful, the main system returns the business data related to the interface to the subsystem through the customized development module. The subsystem also extracts business data and integrates the business data returned by the main system. Then the subsystem can obtain business data from the core system & dependent services in the data system through the internal interface aggregation in the external access layer.

[0190] Of course, in this embodiment, a customized development request may also be sent to the customized development module through the interface layer to instruct the customized development module to perform customized development on the business / logic, etc. in the subsystem / main system based on the request.

[0191] based on Figures 4 to 21 The data processing method proposed in this embodiment provides a specific implementation method, such as Fig.25 The service request flow chart of an embodiment shown in the figure is a general oauth2.0 process for how users log in. In this embodiment, the user sends an interface request through the terminal front end to enter a certain page / program, and the interface page / program requested by the user requires user authorization. Specifically, the user can send an interface request to the data system through the front end, and the data system can log in through Figures 4 to 21 The data processing method shown performs authentication of interface requests and extraction of business data. After this step is successful, the business data will return a login authorization page to the front end. The user confirms the authorization through the interface page / program API on the login authorization page. If the authorization is successful, the login authorization page returns a login authorization code to the data system. At this time, the user can access the interface page / program API through the login authorization code to operate various businesses and data in the interface page / program.

[0192] based on Figures 4 to 21 The data processing method proposed in this embodiment provides a specific implementation method, such as Fig.26 Another embodiment of the service request flow chart shown, Fig.26 for Fig.25 A general OAuth2.0 process schematic diagram of how users log in. In this embodiment, the user enters the data system by clicking the OAuth2.0 link, and the data system logs in through Figures 4 to 21The data processing method shown performs authentication of the interface request. After this step is successful, the interface page / program can obtain a redirect link. At this time, the interface page / program verifies the legitimacy of Corpid (corporate identification) and Redirect_uri (authorized domain name in Oauth2.0) in the redirect link. After verification, it will return a description to the data system: "Redirect_uri? code=code&state=state" (if the user prohibits authorization, the code parameter will not be included after redirection, only the state parameter will be included, and code and state are both status codes). Then the data system will send the return description to the service background. The service background consumes CODE, extracts access_token (access token) through CODE, and sends access_token to the interface page / program API for verification. If the verification is successful, it will return parameters such as useid to the service background. At this time, the service background will extract business data related to the business and send the business data to the data system. The web page requested by the interface request is rendered through the business data to provide business services for the interface request.

[0193] Fig. 27 FIG. 1 is a schematic diagram showing the structure of a data processing device according to an exemplary embodiment. Fig. 27 As shown, in an exemplary embodiment, the data processing device is applied to a data system, the data system includes a proxy server and multiple service systems, the data between different service systems are isolated from each other, the device is configured in the proxy server, and the device includes:

[0194] The interface request receiving module 2710 is configured to receive an interface request carrying an address link; wherein different address links correspond to different service systems;

[0195] The target service system determination module 2730 is configured to determine the target service system corresponding to the address link;

[0196] The authentication module 2750 is configured to send the interface request to the target service system so that the target service system performs authentication processing on the interface request and returns the business data providing business services for the interface request after the authentication processing is passed.

[0197] In this embodiment, through the above-mentioned data processing device, multiple service systems can use a set of authentication logic on the basis of isolating system data, thereby improving the security of the system.

[0198] In one embodiment, the data processing device executed by the proxy server further includes:

[0199] A keyword extraction module, configured to extract keywords of multiple service systems respectively;

[0200] The address link acquisition module is configured to use the extracted keyword as the beginning of the uniform resource locator of the corresponding service system to obtain an address link containing the beginning of the uniform resource locator.

[0201] In one embodiment, the data processing device executed by the proxy server further includes:

[0202] An authentication preprocessing module configured to perform authentication preprocessing on the interface request according to a target verification ticket carried in a header of the interface request;

[0203] The error reminder module is configured to return an error reminder if the authentication preprocessing fails;

[0204] The processing module is configured to execute the step of determining the target service system corresponding to the address link if the authentication preprocessing is passed.

[0205] In one embodiment, in the data processing device executed by the proxy server, the authentication pre-processing module includes:

[0206] A pre-authentication information loading unit configured to load pre-cached pre-authentication information, the pre-authentication information including verification ticket information that has passed the pre-authentication process;

[0207] The query unit is configured to query whether there is information corresponding to the target verification ticket in the pre-authentication information.

[0208] In one embodiment, in a data processing device executed by a proxy server, the plurality of service systems include a main system and a subsystem constructed based on the main system, the main system includes an authentication module, and the target service system is a subsystem; the authentication module includes:

[0209] The joint authentication unit is configured to send the interface request to the subsystem, so that the subsystem sends the interface request to the authentication module, and the authentication module performs joint authentication processing on the interface request.

[0210] In one embodiment, in a data processing device executed by a proxy server, the plurality of service systems include a main system and a subsystem constructed based on the main system, the main system includes an authentication module, and the target service system is the main system; sending an interface request to the target service system includes:

[0211] The main system authentication unit is configured to send the interface request to the main system, so that the main system performs authentication processing on the interface request based on the authentication module.

[0212] Fig.28 FIG. 1 is a schematic diagram showing the structure of a data processing device according to another exemplary embodiment. Fig.28As shown, in an exemplary embodiment, the data system includes a proxy server and multiple service systems, the multiple service systems include a main system and subsystems built based on the main system, and the data between different service systems are isolated from each other. The device is configured in the subsystem, and the device includes:

[0213] The interface request acquisition module 2810 is configured to receive an interface request; wherein the interface request is forwarded by the proxy server to the subsystem based on the address link carried in the interface request;

[0214] The joint authentication module 2830 is configured to send the interface request to the subject system so as to perform joint authentication processing on the interface request in the subject system;

[0215] The business providing module 2850 is configured to provide business services for the interface request based on the business data returned by the main system and the business data obtained by the subsystem in response to the interface request after the joint authentication process is passed.

[0216] In this embodiment, the above-mentioned data processing device can solve the problem that service systems without authentication modules cannot be authenticated in multiple data isolated systems. Multiple service systems can reuse a set of authentication logic based on the isolated system data, thereby improving the security of the system.

[0217] In one embodiment, in a data processing device executed by a subsystem, the main system includes an authentication module; the joint authentication module includes:

[0218] The proxy gold medal verification unit is configured to send the interface request to the main system so that the authentication module verifies the proxy token contained in the interface request based on the pre-stored token information; wherein the pre-stored token information includes the proxy token information that has passed the authentication process.

[0219] In one embodiment, in a data processing device executed by a subsystem, the service providing module includes:

[0220] A data receiving unit configured to receive business data and authentication pass information returned by the subject system after authentication is passed;

[0221] A data extraction unit configured to extract business data corresponding to the interface request through information based on authentication;

[0222] The business service providing unit is configured to provide business services for the interface request based on the business data returned by the subject system and the business data extracted through the authentication information.

[0223] In one embodiment, the data processing device executed by the subsystem further includes:

[0224] The clustering tree structure acquisition module is configured to perform clustering processing on the business data returned by the main system and construct a clustering tree structure; wherein the data attribute similarity of each leaf node in the clustering tree structure is less than a preset threshold;

[0225] The data cleaning module is configured to perform data cleaning processing on the data in each leaf node respectively, so as to provide business services for the interface request based on the business data contained in the cleaned clustering tree structure.

[0226] It should be noted that the data processing device provided in the above embodiment and the data processing method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs operations has been described in detail in the method embodiment and will not be repeated here.

[0227] An embodiment of the present application also provides an electronic device, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by one or more processors, the electronic device implements the data processing method provided in the above-mentioned embodiments.

[0228] Fig.29 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0229] It should be noted that Fig.29 The computer system 2900 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0230] like Fig.29 As shown, computer system 2900 includes a central processing unit (CPU) 2901, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 2902 or the program loaded from the storage part 2908 to the random access memory (RAM) 2903, such as executing the method in the above embodiment. In RAM 2903, various programs and data required for system operation are also stored. CPU 2901, ROM 2902 and RAM 2903 are connected to each other through bus 2904. Input / output (I / O) interface 2905 is also connected to bus 2904.

[0231] The following components are connected to the I / O interface 2905: an input section 2906 including a keyboard, a mouse, etc.; an output section 2907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 2908 including a hard disk, etc.; and a communication section 2909 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 2909 performs communication processing via a network such as the Internet. A drive 2910 is also connected to the I / O interface 2905 as needed. A removable medium 2911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 2910 as needed so that a computer program read therefrom is installed into the storage section 2908 as needed.

[0232] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 2909, and / or installed from the removable medium 2911. When the computer program is executed by the central processing unit (CPU) 2901, various functions defined in the system of the present application are executed.

[0233] It should be noted that the computer-readable medium shown in the embodiment of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium can include a data signal propagated in a baseband or as a part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0234] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0235] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0236] Another aspect of the present application further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the data processing method as described above is implemented. The computer-readable storage medium may be included in the electronic device described in the above embodiment, or may exist independently without being assembled into the electronic device.

[0237] Another aspect of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the data processing method provided in each of the above embodiments.

[0238] The above content is only a preferred exemplary embodiment of the present application and is not intended to limit the implementation scheme of the present application. A person skilled in the art can easily make corresponding changes or modifications based on the main concept and spirit of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection required by the claims.

Claims

1. A data processing method, characterized in that: Applied to a data system, the data system includes a proxy server and multiple service systems, data between different service systems are isolated from each other, the multiple service systems include a main system and a subsystem built based on the main system, the main system is a service system that can provide a complete response process for an interface request, the subsystem is a service system formed by adding functions on the basis of the main system, the main system includes an authentication module, the method is executed by the proxy server, and the method includes: Receiving an interface request carrying an address link; wherein different address links correspond to different service systems; Determining a target service system corresponding to the address link; Sending the interface request to the target service system so that the target service system performs authentication processing on the interface request and returns business data providing business services for the interface request after the authentication processing is passed; Wherein, when the target service system is the subsystem, the subsystem sends the interface request to the authentication module, and performs joint authentication processing on the interface request in the authentication module, so as to provide business services for the interface request based on the business data returned by the main system and the business data obtained by the subsystem in response to the interface request after the joint authentication processing is passed; When the target service system is the subject system, the subject system performs authentication processing on the interface request based on the authentication module.

2. The method according to claim 1, characterized in that Before receiving the interface request carrying the address link, the method further includes: extracting keywords of the plurality of service systems respectively; The extracted keyword is used as the beginning of the uniform resource locator of the corresponding service system to obtain an address link containing the beginning of the uniform resource locator.

3. The method according to claim 1, characterized in that After receiving the interface request carrying the address link, the method further includes: Performing authentication preprocessing on the interface request according to the target verification ticket carried in the header of the interface request; If the authentication preprocessing fails, an error reminder is returned; If the authentication preprocessing passes, the step of determining the target service system corresponding to the address link is performed.

4. The method according to claim 3, characterized in that The performing authentication preprocessing on the interface request according to the verification ticket carried in the header of the interface request includes: Loading pre-cached pre-authentication information, the pre-authentication information including verification ticket information that has passed the pre-authentication process; The pre-authentication information is queried to determine whether there is information corresponding to the target verification ticket.

5. A data processing method, characterized in that: Applied to a data system, the data system includes a proxy server and multiple service systems, the multiple service systems include a main system and a subsystem built based on the main system, the main system is a service system that can provide a complete response process for an interface request, the subsystem is a service system formed by adding new functions on the basis of the main system, and the data between different service systems are isolated from each other, the main system includes an authentication module, the method is executed by the subsystem, and the method includes: Receiving an interface request; wherein the interface request is forwarded by the proxy server to the subsystem based on the address link carried in the interface request; Sending the interface request to the subject system so as to perform joint authentication processing on the interface request in the authentication module; After the joint authentication process is passed, based on the business data returned by the main system and the business data obtained by the subsystem in response to the interface request, business services are provided for the interface request.

6. The method according to claim 5, characterized in that The sending of the interface request to the subject system so as to perform joint authentication processing on the interface request in the authentication module includes: The interface request is sent to the main system so that the authentication module verifies the proxy token contained in the interface request based on pre-stored token information; wherein the pre-stored token information includes proxy token information that has passed the authentication process.

7. The method according to claim 5, characterized in that The providing business service for the interface request based on the business data returned by the main system and the business data acquired by the subsystem in response to the interface request includes: Receiving the service data and authentication pass information returned by the subject system after the authentication is passed; Extracting business data corresponding to the interface request based on the authentication information; Provide business services for the interface request based on the business data returned by the subject system and the business data extracted through the authentication information.

8. The method according to claim 7, characterized in that Before providing business services for the interface request according to the business data returned by the subject system and the business data extracted through the authentication information, the method further includes: Clustering the business data returned by the main system to construct a clustering tree structure; wherein the data attribute similarity of each leaf node in the clustering tree structure is less than a preset threshold; Data cleaning is performed on the data in each leaf node respectively, so as to provide business services for the interface request based on the business data contained in the cleaned clustering tree structure.

9. A data processing device, characterized in that: Applied to a data system, the data system includes a proxy server and multiple service systems, the data between different service systems are isolated from each other, the multiple service systems include a main system and a subsystem built based on the main system, the main system is a service system that can provide a complete response process for an interface request, the subsystem is a service system formed by adding functions on the basis of the main system, the main system includes an authentication module, the device is configured in the proxy server, and the device includes: An interface request receiving module, configured to receive an interface request carrying an address link; wherein different address links correspond to different service systems; A target service system determination module, configured to determine a target service system corresponding to the address link; An authentication module is configured to send the interface request to the target service system so that the target service system performs authentication processing on the interface request and returns business data providing business services for the interface request after the authentication processing is passed; Wherein, when the target service system is the subsystem, the subsystem sends the interface request to the authentication module, and performs joint authentication processing on the interface request in the authentication module, so as to provide business services for the interface request based on the business data returned by the main system and the business data obtained by the subsystem in response to the interface request after the joint authentication processing is passed; When the target service system is the subject system, the subject system performs authentication processing on the interface request based on the authentication module.

10. A data processing device, characterized in that: Applied to a data system, the data system includes a proxy server and multiple service systems, the multiple service systems include a main system and a subsystem built based on the main system, the main system is a service system that can provide a complete response process for an interface request, the subsystem is a service system formed by adding functions on the basis of the main system, and the data between different service systems are isolated from each other, the main system includes an authentication module, the device is configured in the subsystem, and the device includes: An interface request acquisition module, configured to receive an interface request; wherein the interface request is forwarded by the proxy server to the subsystem based on the address link carried in the interface request; a joint authentication module configured to send the interface request to the subject system so as to perform joint authentication processing on the interface request in the authentication module; The service providing module is configured to provide service services for the interface request based on the service data returned by the main system and the service data obtained by the subsystem in response to the interface request after the joint authentication process is passed.

11. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more computer programs, which, when executed by the one or more processors, enables the electronic device to implement the method according to any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that: Computer readable instructions are stored thereon, and when the computer readable instructions are executed by a processor of a computer, the computer is caused to execute the method according to any one of claims 1 to 8.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images