Access control method and data platform

Abstract

This application discloses an access control method and a data platform. A reverse proxy server receives a function request sent by a client. If the function request meets preset rules, the server sends the request to an interceptor. The interceptor determines whether the user is logged in. If the user is logged in, the interceptor determines whether the user has permission to operate on the URL carried in the function request. If the user has permission, the interceptor identifies the provider of the function corresponding to the URL. If the provider is third-party software, the interceptor obtains the target URL corresponding to the URL and sends the target URL to the server of the third-party software. The reverse proxy server then sends a response to the client. The technical solution disclosed in this application implements access control for third-party software accessing the data platform, thereby improving the access security of third-party software.

Description

Technical Field

[0001] This application belongs to the field of Internet technology, and in particular relates to an access control method and a data platform. Background Technology

[0002] To reduce the development difficulty and workload of data platforms, they often rely on third-party software, such as Apache Spark (a general-purpose computing engine) and Apache Flink (a stream processing engine). These third-party software programs are not designed with access security in mind.

[0003] For those skilled in the art, improving the access security of third-party software connected to data platforms is an urgent problem to be solved. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide an access control method and a data platform to improve the access security of third-party software accessing the data platform.

[0005] To achieve the above objectives, this application provides the following technical solution:

[0006] This application provides an access control method. The data platform includes a reverse proxy server, an interceptor, and a business server. The data platform is connected to at least one third-party software. The method includes:

[0007] The reverse proxy server receives the function request sent by the client;

[0008] If the function request meets the preset rules, the reverse proxy server sends the function request to the interceptor.

[0009] The interceptor determines whether the user is already logged in;

[0010] If the interceptor determines that the user is logged in, it will determine whether the user has the permission to operate on the URL carried in the function request.

[0011] If the interceptor determines that the user has the necessary permissions, it will identify the provider of the function corresponding to the URL.

[0012] If the provider of the function corresponding to the URL is a third-party software, the interceptor obtains the target URL corresponding to the URL and sends the target URL to the server of the third-party software, so that the server of the third-party software can send response information to the reverse proxy server based on the target URL.

[0013] The reverse proxy server sends a response message to the client, which is generated based on the received response message.

[0014] Optionally, based on the access control methods described above, further settings can be made:

[0015] If the provider of the function corresponding to the URL is the business server, the interceptor sends the URL carried in the function request to the business server;

[0016] The business server sends a response message to the reverse proxy server based on the received URL.

[0017] Optionally, based on the access control methods described above, further settings can be made:

[0018] If the interceptor determines that the user is not logged in, it sends a not logged-in indication to the reverse proxy server.

[0019] In response to the not logged-in indication, the reverse proxy server sends a login prompt message to the client.

[0020] Optionally, based on the access control methods described above, further settings can be made:

[0021] The reverse proxy server receives the login request sent by the client and sends the login request to the interceptor, wherein the login request carries a username and password;

[0022] The interceptor sends the login request to the business server;

[0023] The business server performs authentication based on the username and password, and if the authentication is successful, generates a token and sends the token to the interceptor.

[0024] The interceptor sends the token to the reverse proxy server and stores the token;

[0025] The reverse proxy server sends the token to the client.

[0026] Optionally, based on the access control methods described above, further settings can be made:

[0027] If the interceptor determines that the user does not have the necessary permissions, it sends a no-permission instruction to the reverse proxy server.

[0028] The reverse proxy server responds to the no-permission instruction by sending a no-permission message to the client.

[0029] Optionally, the preset rule is that the URL carried in the function request contains the domain name of the business server.

[0030] This application also provides a data platform, including a reverse proxy server, an interceptor, and a business server, wherein the data platform is connected to at least one third-party software;

[0031] The reverse proxy server is used to: obtain a function request sent by the client, and send the function request to the interceptor if the function request meets a preset rule;

[0032] The interceptor is used to: determine whether the user is logged in; if the user is logged in, determine whether the user has operation permissions for the URL carried in the function request; if the user has operation permissions, determine the provider of the function corresponding to the URL; if the provider of the function corresponding to the URL is third-party software, obtain the target URL corresponding to the URL, and send the target URL to the server of the third-party software so that the server of the third-party software can send response information to the reverse proxy server based on the target URL.

[0033] The reverse proxy server is also used to: send response information to the client, the response information being generated based on the received response information.

[0034] Optionally, the interceptor is further configured to: send the URL carried in the function request to the business server if the provider of the function corresponding to the URL is the business server;

[0035] The business server is used to send response information to the reverse proxy server based on the received URL.

[0036] Optionally, the interceptor is further configured to: send a not logged-in indication to the reverse proxy server if it is determined that the user is not logged in;

[0037] The reverse proxy server is also used to: respond to the not logged-in indication by sending a login prompt message to the client.

[0038] Optionally, the interceptor is further configured to: send a no-operation-permission indication to the reverse proxy server if it is determined that the user does not have operation permissions;

[0039] The reverse proxy server is also used to: respond to the no-operation-permission indication by sending a no-operation-permission prompt message to the client.

[0040] Therefore, the beneficial effects of this application are as follows:

[0041] The data platform disclosed in this application includes a reverse proxy server, an interceptor, and a business server, with the business server connected to at least one third-party software. The reverse proxy server receives function requests sent by clients. If the function request meets preset rules, it sends the request to the interceptor, reducing unauthorized access to the data platform. The interceptor determines whether the user is logged in. If logged in, it determines whether the user has permission to operate on the URL carried in the function request. If the user has permission, it identifies the provider of the function corresponding to the URL. If the provider is third-party software, it obtains the target URL corresponding to that URL and sends it to the server of the third-party software. The server of the third-party software then sends a response to the reverse proxy server based on the target URL. The reverse proxy server sends a response to the client. As can be seen, the access control method and data platform disclosed in this application utilize a reverse proxy server to intercept unauthorized access and an interceptor for user authentication and access control, thereby achieving access control for third-party software connected to the data platform and improving the security of third-party software access. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a schematic diagram of the structure of a data platform disclosed in this application;

[0044] Figure 2 This is a schematic diagram illustrating the application scenario of the data platform disclosed in this application;

[0045] Figure 3 This is a flowchart of an access control method disclosed in this application;

[0046] Figure 4 This is a signaling diagram for another access control method disclosed in this application. Detailed Implementation

[0047] Data platforms provide computing and storage capabilities for big data, enabling massive amounts of static data to "activate" and release their value. However, without platform security, the release of data value will be hindered. If we compare a data platform to a building, its value release capability and security capability are respectively the ground structure and foundation. The depth of the foundation determines the height of the building's ground structure; a big data platform with an unstable foundation is destined to be nothing more than a "castle in the air."

[0048] To reduce the development difficulty and workload of data platforms, third-party software is often integrated into them. However, developers often fail to consider access security issues when designing third-party software. For example, they may not consider security issues such as user authentication, key management, and security auditing.

[0049] Therefore, this application provides an access control method and a data platform to improve the access security of third-party software accessing the data platform.

[0050] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0051] First, the structure of the data platform disclosed in this application will be introduced.

[0052] See Figure 1 and Figure 2 , Figure 1 This is a schematic diagram of the structure of a data platform disclosed in this application. Figure 2 This is a schematic diagram illustrating the application scenario of the data platform disclosed in this application.

[0053] The data platform 10 includes a reverse proxy server 100, an interceptor 200, and a business server 300. Additionally, the data platform connects to at least one third-party software, whose server 20 can communicate with the reverse proxy server 100 and the interceptor 200. The client 30 can communicate with the reverse proxy server 100; that is, the client 30 cannot directly access the business server 300 and the third-party software server 20, but rather accesses them through the reverse proxy server 100.

[0054] It should be noted that, Figure 1 and Figure 2 The data platform shown contains one business server, but a data platform can also contain multiple business servers; it can be understood as a data platform containing a cluster of business servers.

[0055] The reverse proxy server 100 is used to: obtain the function request sent by the client 30, and send the function request to the interceptor 200 if the function request meets the preset rules.

[0056] Interceptor 200 is used to: determine whether the user is logged in; if the user is logged in, determine whether the user has the operation permission for the URL carried in the function request; if the user has the operation permission, determine the provider of the function corresponding to the URL; if the provider of the function corresponding to the URL is third-party software, obtain the target URL corresponding to the URL, and send the target URL to the server 20 of the third-party software, so that the server 20 of the third-party software can send response information to the reverse proxy server 100 based on the target URL.

[0057] The reverse proxy server 100 is also used to send response information to the client 30, the response information being generated based on the received response information.

[0058] Optionally, interceptor 200 is also used to: send the URL carried in the function request to business server 300 when the provider of the function corresponding to the URL is business server 300. Business server 300 is used to: send response information to reverse proxy server 100 based on the received URL.

[0059] Optionally, interceptor 200 is also configured to: send a not-logged-in indication to reverse proxy server 100 if it is determined that the user is not logged in. Reverse proxy server 100 is also configured to: respond to the not-logged-in indication by sending a login prompt message to client 30.

[0060] Optionally, interceptor 200 is further configured to: send a no-permission indication to reverse proxy server 100 if it is determined that the user does not have the necessary permissions. Reverse proxy server 100 is further configured to: respond to the no-permission indication by sending a no-permission message to client 30.

[0061] Optionally, the reverse proxy server 100 is further configured to: receive a login request sent by the client 30, and send the login request to the interceptor 200, wherein the login request carries a username and password. The interceptor 200 is further configured to: send the login request to the business server 300. The business server 300 is further configured to: perform authentication based on the username and password, and if authentication is successful, generate a token and send the token to the interceptor 200. The interceptor 200 is further configured to: send the token to the reverse proxy server 100 and store the token. The reverse proxy server 100 is further configured to: send the token to the client 30.

[0062] The access control methods disclosed in this application are described below.

[0063] See Figure 3 , Figure 3 This is a flowchart illustrating an access control method disclosed in this application. The access control method includes:

[0064] S101: The reverse proxy server receives the function request sent by the client.

[0065] In implementation, users click on controls in the client's interface, causing the client to send corresponding function requests to the reverse proxy server. These function requests must at least carry a URL (Uniform / Universal Resource Locator).

[0066] It should be noted that the data platform disclosed in this application connects to at least one third-party program, and services are provided to users by the business server and the server of the third-party program. In other words, the services available to users may be provided by the data platform's own business server or by the server of the third-party software. The domain names of the business server and the third-party software server are different.

[0067] It is understandable that the hostname in the URL of a file stored on a third-party software server is the domain name of that third-party software server. In this application, for each function (i.e., service) provided to the user by the third-party software server, a second URL is constructed based on its first URL (the actual URL), where the hostname in the second URL is the domain name of the business server. A correspondence is established between the first URL of each function and the constructed second URL, and this correspondence is saved. The hostname in the URL of the function request sent by the client to the reverse proxy server is always the domain name of the business server. That is, regardless of whether the function requested by the user is provided by the business server or the third-party software server, the hostname in the URL carried by the function request sent by the client to the reverse proxy server is always the domain name of the business server. It can be understood that if the function requested by the user is provided by the third-party software server, then the URL carried by the function request sent by the client to the reverse proxy server is a URL constructed for that function (the second URL), not the actual URL of that function (the first URL).

[0068] Here's an example: The domain name of the business server is www.bigdata.abc, and the domain name of the server for the third-party software Apache Flink is www.flink.abc. The URL for a certain function provided by the third-party software server is https: / / www.flink.abc / submitjob.do, and the second URL constructed for this function is https: / / www.bigdata.abc / flink / submitjob.do. The client interface contains a control corresponding to this function. When the user clicks this control, the URL in the function request sent by the client to the reverse proxy server is https: / / www.bigdata.abc / flink / submitjob.do.

[0069] Optionally, a URL mapping table is created for each third-party software server, which contains a first URL and a corresponding second URL for each function provided by the server of the third-party software.

[0070] S102: The reverse proxy server sends a function request to the interceptor if the function request meets the preset rules.

[0071] Optionally, the default rule is that the URL carried in the function request contains the domain name of the business server.

[0072] In other words, the reverse proxy server receives a function request sent by the client. If the URL carried by the function request contains the domain name of the business server, the function request is sent to the interceptor. If the URL carried by the function request does not contain the domain name of the business server, the function request is intercepted and not sent to the interceptor.

[0073] S103: The interceptor determines whether the user is already logged in.

[0074] Optionally, the interceptor determines whether the function request carries a valid token. That is, the interceptor checks if the function request carries a token. If the function request carries a token, it further checks whether the data platform stores that token. If the data platform stores the token, it determines that the function request carries a valid token, and the user is logged in. If the function request does not carry a token, or if the function request carries a token but the data platform does not store that token, it determines that the function request does not carry a valid token, and the user is not logged in. How the client obtains the token will be explained in detail below.

[0075] S104: If the interceptor determines that the user is logged in, it will determine whether the user has the necessary permissions to perform the operation on the URL carried in the function request.

[0076] The data platform stores the operation permissions of each user. Once the interceptor confirms that a user is logged in, it further determines whether the user has the necessary permissions to access the URL carried in the function request, thus enabling user-specific permission management.

[0077] S105: If the interceptor determines that the user has the necessary permissions, it identifies the provider of the function corresponding to the URL carried in the function request.

[0078] S106: If the provider of the function corresponding to the URL carried in the function request is a third-party software, the interceptor obtains the target URL corresponding to the URL carried in the function request and sends the target URL to the server of the third-party software so that the server of the third-party software can send response information to the reverse proxy server based on the target URL.

[0079] The services provided by the data platform to users may be provided by the data platform's business servers or by the servers of third-party software. Therefore, if the interceptor determines that the user has the necessary permissions, it determines which device provides the function corresponding to the URL carried in the function request, that is, it determines the provider of the function corresponding to that URL.

[0080] As explained above, if the function requested by the user is provided by a third-party software server, the URL carried in the function request sent by the client to the reverse proxy server is a constructed URL (second URL) for that function, not the actual URL of that function (first URL). Therefore, if it is determined that the provider of the function corresponding to the URL (second URL, constructed URL) carried in the function request is the server of the third-party software, the interceptor needs to determine the first URL corresponding to that URL, that is, determine the actual URL (first URL) of the file corresponding to that function, and send this first URL (i.e., the target URL) to the server of the third-party software. Based on the received target URL, the server of the third-party software sends response information to the reverse proxy server.

[0081] Optionally, the interceptor obtains a URL mapping table created by the server for the third-party software, finds the first URL corresponding to the URL carried in the feature request from the mapping table, and uses the found first URL as the target URL.

[0082] It should be noted that the second URL constructed from the actual URL of the function provided by the server of third-party software must include an identifier representing the server of that third-party software. This identifier allows the interceptor to determine, based on the identifier, which device specifically provides the function corresponding to the URL carried in the function request. For example, for a function provided by the server of the third-party software Apache Flink, the constructed second URL would include the identifier "flink." Of course, this is just one example.

[0083] Optionally, the interceptor stores information about the received function requests and the processing performed in response to those requests for later auditing and tracing.

[0084] S107: The reverse proxy server sends a response message to the client, which is generated based on the received response message.

[0085] The reverse proxy server receives response information sent by the server of third-party software, generates response information based on the response information, and sends the response information to the client.

[0086] The access control method disclosed in this application is used to control access to third-party software accessing a data platform, thereby improving its access security. The data platform includes a reverse proxy server, an interceptor, and a business server. The reverse proxy server receives function requests sent by clients. If the function request meets preset rules, it sends the request to the interceptor, reducing unauthorized access to the data platform. The interceptor determines whether the user is logged in. If logged in, it determines whether the user has permission to operate on the URL carried in the function request. If the user has permission, it identifies the provider of the function corresponding to the URL. If the provider is third-party software, it obtains the target URL corresponding to that URL and sends it to the server of the third-party software. The server of the third-party software then sends a response to the reverse proxy server based on the target URL. The reverse proxy server sends a response to the client. As can be seen, the access control method disclosed in this application utilizes a reverse proxy server to intercept unauthorized access and an interceptor for user authentication and access control, thus achieving access control for third-party software accessing the data platform and improving the access security of third-party software.

[0087] In another embodiment of this application, the following steps are further provided:

[0088] If the provider of the function corresponding to the URL is a business server, the interceptor sends the URL carried in the function request to the business server;

[0089] The business server sends a response to the reverse proxy server based on the received URL.

[0090] In the above embodiments of this application, if the interceptor determines that the user has logged in and has the operation permission for the URL carried by the function request, and if the provider of the function corresponding to the URL is a business server, then the interceptor sends the URL carried by the function request to the business server, and the business server sends response information to the reverse proxy server based on the URL. The reverse proxy server generates response information based on the received response information and sends the response information to the client.

[0091] In another embodiment of this application, the following steps are further provided:

[0092] If the interceptor determines that the user is not logged in, it sends a not logged-in indication to the reverse proxy server.

[0093] The reverse proxy server responds to the "not logged in" indication and sends a login prompt message to the client.

[0094] In the above embodiments of this application, the interceptor determines whether the user is logged in. If it is determined that the user is not logged in, it sends a not logged in indication to the reverse proxy server. The reverse proxy server responds to the received not logged in indication by sending a login prompt message to the client to prompt the user to perform a login operation.

[0095] In another embodiment of this application, the following steps are further provided:

[0096] The reverse proxy server receives the login request sent by the client and sends the login request to the interceptor. The login request carries the username and password.

[0097] The interceptor sends a login request to the business server;

[0098] The business server authenticates the user based on the username and password. If the authentication is successful, it generates a token and sends the token to the interceptor.

[0099] The interceptor sends a token to the reverse proxy server and stores the token;

[0100] The reverse proxy server sends a token to the client.

[0101] Optionally, the interceptor stores the token in Redis. Redis (Remote Dictionary Server) is a key-value storage system.

[0102] The client stores the received token as a cookie (a small text file). When sending subsequent feature requests, the client can add the token to the request header. Upon receiving a feature request, the interceptor checks if Redis contains the token carried in the request, thus determining whether the user is logged in.

[0103] It should be noted that the client may send a login request to the reverse proxy server actively after the user opens the client, or it may be done after receiving a login prompt message.

[0104] In the above embodiments of this application, the reverse proxy server receives a login request (carrying a username and password) sent by the client and sends the login request to the interceptor. The interceptor receives the login request sent by the reverse proxy server and sends the login request to the business server. The business server performs authentication based on the username and password carried in the login request. If the authentication is successful, a token is generated and sent to the interceptor. The interceptor receives the token sent by the business server and sends the token to the reverse proxy server. The reverse proxy server sends the token to the client, enabling the client to access the platform subsequently based on the token.

[0105] In another embodiment of this application, the following steps are further provided:

[0106] If the interceptor determines that the user does not have the necessary permissions, it sends a permission-not-permission instruction to the reverse proxy server.

[0107] The reverse proxy server responds with a permission denied instruction, sending a permission denied message to the client.

[0108] In the above embodiments of this application, if the interceptor determines that the user has logged in, it further determines whether the user has the operation permission for the URL carried in the function request. If the user does not have the operation permission, the interceptor sends an operation permission indication to the reverse proxy server. The reverse proxy server responds to the operation permission indication, generates an operation permission prompt message, and sends the operation permission prompt message to the client so that the user is aware of the problem of not having operation permission.

[0109] The following is combined with Figure 4 The access control method disclosed in this application is explained.

[0110] See Figure 4 , Figure 4 This is a signaling diagram for another access control method disclosed in this application. The access control method includes:

[0111] S201: The reverse proxy server receives the function request sent by the client.

[0112] S202: The reverse proxy server sends a function request to the interceptor if the function request meets the preset rules.

[0113] S203: The interceptor determines whether the user is already logged in.

[0114] If the user is not logged in, proceed to step S204; if the user is logged in, proceed to step S206.

[0115] S204: The interceptor sends a not logged-in indication to the reverse proxy server.

[0116] S205: The reverse proxy server responds with a not logged-in indication and sends a login prompt message to the client.

[0117] S206: The interceptor determines whether the user has the necessary permissions to perform actions on the URL carried in the function request.

[0118] If the user does not have the operation permission, then proceed to step S207; if the user has the operation permission, then proceed to step S209.

[0119] S207: The interceptor sends a no-permission instruction to the reverse proxy server.

[0120] S208: The reverse proxy server responds with a no-permission indication, sending a no-permission message to the client.

[0121] S209: The interceptor determines the provider of the functionality corresponding to the URL.

[0122] If the provider of the function corresponding to the URL is a third-party software, then proceed to step S210; if the provider of the function corresponding to the URL is a business server, then proceed to step S213.

[0123] S210: The interceptor obtains the target URL corresponding to the URL carried in the feature request.

[0124] S211: Send the target URL to the server of third-party software.

[0125] S212: The server of the third-party software sends a response message to the reverse proxy server based on the target URL.

[0126] S213: The interceptor sends the URL carried in the function request to the business server.

[0127] S214: The business server sends a response message to the reverse proxy server based on the received URL.

[0128] S215: The reverse proxy server sends a response message to the client.

[0129] The response information is generated by the reverse proxy server based on the response information received from the business server or the server of third-party software.

[0130] It should be noted that the technical features described in the various embodiments of this specification can be substituted for or combined with each other. Each embodiment focuses on describing the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to mutually. The steps in the methods of the various embodiments of this application can be adjusted, merged, and deleted according to actual needs. The modules and sub-modules in the devices and equipment of the various embodiments of this application can be merged, divided, and deleted according to actual needs.

[0131] It should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways, given the several embodiments provided in this application. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or sub-modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple sub-modules or modules may be combined or integrated into another module, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or modules may be electrical, mechanical, or other forms.

[0132] The modules or submodules described as separate components may or may not be physically separate. The components that constitute a module or submodule may or may not be physical modules or submodules; that is, they may be located in one place or distributed across multiple network modules or submodules. Some or all of the modules or submodules can be selected to achieve the purpose of this embodiment's solution, depending on actual needs.

[0133] Furthermore, the functional modules or sub-modules in the various embodiments of this application can be integrated into one processing module, or each module or sub-module can exist physically separately, or two or more modules or sub-modules can be integrated into one module. The integrated modules or sub-modules described above can be implemented in hardware or in the form of software functional modules or sub-modules.

[0134] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0135] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The technical features in each embodiment can be arranged and combined to form new embodiments. Regarding the data platform disclosed in the embodiments, since it corresponds to the access control method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0136] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An access control method, characterized in that, The data platform includes a reverse proxy server, an interceptor, and a business server. The data platform connects to at least one third-party software. The method includes: The reverse proxy server receives the function request sent by the client; If the function request meets the preset rules, the reverse proxy server sends the function request to the interceptor. The interceptor determines whether the user is already logged in; If the interceptor determines that the user is logged in, it will determine whether the user has the permission to operate on the URL carried in the function request. If the interceptor determines that the user has the necessary permissions, it will identify the provider of the function corresponding to the URL. When the provider of the function corresponding to the URL is third-party software, the interceptor obtains the target URL corresponding to the URL and sends the target URL to the server of the third-party software, so that the server of the third-party software sends response information to the reverse proxy server based on the target URL; wherein, the interceptor obtains a URL mapping table created for the server of the third-party software, looks up a first URL corresponding to the URL carried in the function request from the mapping table, and uses the found first URL as the target URL; the first URL is the actual URL corresponding to the function; The reverse proxy server sends a response message to the client, which is generated based on the received response message.

2. The method according to claim 1, characterized in that, Also includes: If the provider of the function corresponding to the URL is the business server, the interceptor sends the URL carried in the function request to the business server; The business server sends a response message to the reverse proxy server based on the received URL.

3. The method according to claim 1 or 2, characterized in that, Also includes: If the interceptor determines that the user is not logged in, it sends a not logged-in indication to the reverse proxy server. In response to the not logged-in indication, the reverse proxy server sends a login prompt message to the client.

4. The method according to claim 3, characterized in that, Also includes: The reverse proxy server receives the login request sent by the client and sends the login request to the interceptor, wherein the login request carries a username and password; The interceptor sends the login request to the business server; The business server performs authentication based on the username and password, and if the authentication is successful, generates a token and sends the token to the interceptor. The interceptor sends the token to the reverse proxy server and stores the token; The reverse proxy server sends the token to the client.

5. The method according to claim 4, characterized in that, Also includes: If the interceptor determines that the user does not have the necessary permissions, it sends a no-permission instruction to the reverse proxy server. The reverse proxy server responds to the no-permission instruction by sending a no-permission message to the client.

6. The method according to claim 1, characterized in that, The preset rule is that the URL carried in the function request contains the domain name of the business server.

7. A data platform, characterized in that, The data platform includes a reverse proxy server, an interceptor, and a business server, and is connected to at least one third-party software. The reverse proxy server is used to: obtain a function request sent by the client, and send the function request to the interceptor if the function request meets a preset rule; The interceptor is used to: determine whether a user is logged in; if the user is logged in, determine whether the user has operation permissions for the URL carried in the function request; if the user has operation permissions, determine the provider of the function corresponding to the URL; if the provider of the function corresponding to the URL is third-party software, obtain the target URL corresponding to the URL, and send the target URL to the server of the third-party software, so that the server of the third-party software sends response information to the reverse proxy server based on the target URL; wherein, the interceptor obtains a URL mapping table created for the server of the third-party software, looks up a first URL corresponding to the URL carried in the function request from the mapping table, and uses the found first URL as the target URL; the first URL is the actual URL corresponding to the function; The reverse proxy server is also used to: send response information to the client, the response information being generated based on the received response information.

8. The data platform according to claim 7, characterized in that, The interceptor is also used to: send the URL carried in the function request to the business server when the provider of the function corresponding to the URL is the business server; The business server is used to send response information to the reverse proxy server based on the received URL.

9. The data platform according to claim 8, characterized in that, The interceptor is also used to: send a not logged-in indication to the reverse proxy server if it is determined that the user is not logged in; The reverse proxy server is also used to: respond to the not logged-in indication by sending a login prompt message to the client.

10. The data platform according to claim 7, 8, or 9, characterized in that, The interceptor is also used to: send a no-operation-permission indication to the reverse proxy server when it is determined that the user does not have operation permission; The reverse proxy server is also used to: respond to the no-operation-permission indication by sending a no-operation-permission prompt message to the client.

Images