Method and system for fine-grained dynamic permission control for web services

Abstract

The application provides a fine-grained dynamic permission control method and system for WEB service, comprising: step 1, identifying all external service interfaces in WEB background service, and persisting existing WEB external interface information through a persistence technology; step 2, based on the persisted interface information, combining the functions of different personnel to perform fine-grained unified configuration, and persisting again, and supporting timely adjustment of permission control according to business demand changes; step 3, using the already persisted permission configuration, combining the interceptor technology in WEB service, and performing access permission control according to the identity of a user and the corresponding permission of the user. The application improves the convenience of permission control of the WEB background service system by unified persistence of external interfaces of background service and based on the permission rules of the persisted interfaces.

Description

Technical Field

[0001] This invention relates to the field of access control technology for web service backend systems, and more specifically, to a fine-grained dynamic access control method and system for web services. Background Technology

[0002] As the core of web services, the web service backend system not only provides web business services, but also focuses on the security control of web service access. Currently, mainstream access control is achieved by using interceptors in conjunction with annotation patterns, so that the granularity of access control is completely fixed at the beginning of coding. However, with the operation of the system and the complex changes in the structure and division of responsibilities of users, access control needs to be adjusted and changed to varying degrees.

[0003] Patent document CN114021186A (application number: CN202111282678.X) discloses a fine-grained access control method for web systems based on runtime hooks. This method enables different users with the same role to execute the same SQL statement, and grants different access permissions depending on the configuration tag attributes. It dynamically implements the principle of least privilege from both the data row and data column dimensions, thereby obtaining a dataset that conforms to the established security policy and preventing data leakage caused by unauthorized access.

[0004] However, access control based on the coding level requires recoding, redesigning, and recompiling the system's source code to adapt to such changes. Therefore, to simplify unnecessary work for personnel and improve system flexibility, a fine-grained dynamic access control method based on user web services is proposed. This method can quickly achieve fine-grained, on-demand adjustments to access control without modifying the web service source code. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the purpose of this invention is to provide a fine-grained dynamic access control method and system for web services.

[0006] The fine-grained dynamic access control method for web services provided by the present invention includes:

[0007] Step 1: Identify all external service interfaces in the WEB backend service and persist the existing WEB external interface information using persistence technology;

[0008] Step 2: Based on the persistent interface information, perform fine-grained unified configuration according to the functions of different personnel, persist it again, and support timely adjustment of access control according to changes in business needs;

[0009] Step 3: Utilize the persistent permission configuration and combine it with interceptor technology in web services to control access permissions based on the user's identity and corresponding permissions.

[0010] Preferably, step 1 includes:

[0011] Step 1.1: Create a listener in the WEB backend service project to listen for container startup;

[0012] Step 1.2: After the container starts, obtain the current context container through the Application Context, which is related to the application's context.

[0013] Step 1.3: Obtain the loading process Request Mapping and Handler Mapping from the context container, and obtain all program processing methods (Handler Methods) from it;

[0014] Step 1.4: Parse the Handler Method and obtain all external interface addresses. At the same time, check whether a specific method has a corresponding permission annotation based on the HandlerMethod. If the corresponding Handler Method has a corresponding permission annotation, persist it along with the external interface address.

[0015] Preferably, step 2 includes:

[0016] Step 2.1: Design access control permissions based on the identity requirements of the accessing users;

[0017] Step 2.2: Maintain the persistent data, including adding, modifying, and deleting data;

[0018] Step 2.3: While configuring permissions uniformly, complete the persistence operation, and then update the access control of the interceptor permission rules. The update mode includes hot update mode and cold update mode. In the case of hot update mode, it is necessary to use the message middleware to push to the corresponding backend service to obtain the new permission scheme; in the case of cold update mode, it is necessary to restart the service.

[0019] Preferably, the addition includes: adding new access control, including maintaining permission codes and corresponding interface access addresses;

[0020] The modifications include: modifying the access addresses of the accessible interfaces corresponding to the existing access permission codes, but not modifying the correspondence between the permission codes and interface access addresses obtained from the annotations;

[0021] The deletion includes: maintaining all persistent permission code correspondences, performing soft deletion on permission code correspondences persisted through annotations, and directly physically deleting custom-added permission code correspondences.

[0022] Preferably, step 3 includes:

[0023] Step 3.1: After the container starts and completes the persistence of unified interface permission recognition, reload the new permission control rules. The permission control rules will take effect immediately after the service starts and the loading is completed.

[0024] Step 3.2: Obtain and parse the authorization information carried by the user through the interceptor, and match the authorization information carried by the user. If the match is successful, allow the process; otherwise, refuse to provide services.

[0025] Step 3.3: If a new rule is received from the middleware during service operation, the current service's access control rules are updated immediately.

[0026] The fine-grained dynamic access control system for web services provided by the present invention includes:

[0027] Module M1: Identifies all external service interfaces in the WEB backend service and persists the existing WEB external interface information through persistence technology;

[0028] Module M2: Based on persistent interface information, it performs fine-grained unified configuration according to the functions of different personnel, persists it again, and supports timely adjustment of access control according to changes in business needs;

[0029] Module M3: Utilizes persistent permission configurations and combines them with interceptor technology in web services to control access permissions based on the user's identity and corresponding permissions.

[0030] Preferably, the module M1 includes:

[0031] Module M1.1: Creates a listener in the WEB backend service project, responsible for listening for container startup;

[0032] Module M1.2: After detecting that the container has started, it obtains the current context container through the Application Context, which is related to the application's context.

[0033] Module M1.3: Retrieves the loading process Request Mapping and Handler Mapping from the context container, and obtains all program processing methods Handler Methods from it;

[0034] Module M1.4: Parses the Handler Method and obtains all external interface addresses. At the same time, it checks whether a specific method has a corresponding permission annotation based on the HandlerMethod. If the corresponding Handler Method has a corresponding permission annotation, it persists the interface external address along with it.

[0035] Preferably, the module M2 includes:

[0036] Module M2.1: Designs access control permissions based on the identity requirements of the accessing user;

[0037] Module M2.2: Maintains data based on persistent data, including adding, modifying, and deleting data;

[0038] Module M2.3: While configuring permissions uniformly, it performs persistence operations and then updates the access control of the interceptor permission rules. The update modes include hot update mode and cold update mode. In the case of hot update mode, it is necessary to use the message middleware to push to the corresponding backend service to obtain the new permission scheme; in the case of cold update mode, the service needs to be restarted.

[0039] Preferably, the addition includes: adding new access control, including maintaining permission codes and corresponding interface access addresses;

[0040] The modifications include: modifying the access addresses of the accessible interfaces corresponding to the existing access permission codes, but not modifying the correspondence between the permission codes and interface access addresses obtained from the annotations;

[0041] The deletion includes: maintaining all persistent permission code correspondences, performing soft deletion on permission code correspondences persisted through annotations, and directly physically deleting custom-added permission code correspondences.

[0042] Preferably, the module M3 includes:

[0043] Module M3.1: After the container starts and completes the persistence of unified interface permission recognition, it reloads the new permission control rules. The permission control rules take effect immediately after the service starts and the loading is completed.

[0044] Module M3.2: Obtains and parses the authorization information carried by the user through the interceptor, and matches the authorization information carried by the user. If the match is successful, the process is allowed; otherwise, the service is denied.

[0045] Module M3.3: If a new rule is received from the middleware during service operation, the current service's access control rules will be updated immediately.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] (1) When developers develop a back-end business system, they can build an SDK according to the method of this invention and use it directly in the development. They only need to clarify the functional and performance requirements of the business system and do not need to pay too much attention to access control. After the service is launched, the persistent permission rules can be configured and adjusted in real time according to the access control requirements of different personnel to complete the launch of the entire business system.

[0048] (2) This invention improves the convenience of access control in web backend service systems. By uniformly persisting the external interfaces of the backend service and dynamically adjusting the access rules based on the persistent interfaces in real time according to the needs, the backend service can then control access authorization according to the new access rules. Attached Figure Description

[0049] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0050] Figure 1 Flowchart for persisting service permission rules;

[0051] Figure 2 This is a flowchart for access control. Detailed Implementation

[0052] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0053] Example 1:

[0054] Current popular web access control primarily relies on interceptors and annotation-based access control. This typically requires defining the level of permission granularity during system design and then directly developing the service according to this model. Once deployed, any adjustments necessitate a complete redesign, recoding, and redeployment by the developers. If the access control scheme changes subsequently, this process must be repeated. However, in real-world projects, access control is often highly variable.

[0055] Based on this, the present invention proposes a fine-grained dynamic access control method for web services, which can quickly achieve fine-grained on-demand adjustment of access control without modifying the web service source code, such as... Figure 1 It mainly includes the following steps:

[0056] 1) Unified Web Interface Identification Persistence

[0057] a) Create a listener in the WEB backend service project to listen for container startup;

[0058] b) After detecting that the container has started, obtain the current context container through the Application Context;

[0059] c) Obtain the Request Mapping Handler Mapping from the context container, and retrieve all Handler Methods from it;

[0060] d) Parse the Handler Method and obtain all external interface addresses, and at the same time, determine whether a specific method has a corresponding permission annotation based on the Handler Method;

[0061] e) If the corresponding Handler Method has a corresponding permission annotation, then the interface's external address will be persisted together.

[0062] 2) Unified configuration of WEB interface access permissions

[0063] a) Design the initial access control permissions based on the identity requirements of the accessing users;

[0064] b) Maintain the data based on persistent data, including adding, modifying, and deleting data;

[0065] Added: Added new access control, including maintaining permission codes and corresponding interface access addresses;

[0066] Modification: Modify the access addresses of existing access permission codes corresponding to accessible interfaces; do not modify the correspondence between permission codes and interface access addresses obtained from annotations.

[0067] Deletion: Maintain all persistent permission code mappings, perform soft deletion of persistent permission code mappings through annotations, and directly perform physical deletion of custom-added permission code mappings.

[0068] c) Once permissions are configured uniformly, persistence operations are completed simultaneously. Then, the access control of the interceptor permission rules is updated. The update mode can be divided into hot update mode and cold update mode. In the case of hot update mode, it is necessary to use message middleware to push to the corresponding backend service to obtain the new permission scheme. In the case of cold update mode, the service needs to be restarted.

[0069] 3) Control of web interface access permissions

[0070] Access control is the core of the control mechanism. After the above steps, only the server-side interceptor needs to perform access control, such as... Figure 2 The server-side processing flow is as follows:

[0071] a) After the container starts and completes the persistence of unified interface permission recognition, the new permission control rules are reloaded; the loading at startup is a cold load, and the permission control rules take effect immediately after the service starts and the loading is completed.

[0072] b) The interceptor obtains and parses the authorization information carried by the user, and matches the user's authorization information. If the match is successful, the process is allowed; otherwise, the service is refused.

[0073] c) If a new rule is received from the middleware during service operation, the current service's access control rules are updated immediately, which is hot reloading mode.

[0074] Preferably, an SDK based on this method can be built and used directly during the development of the business system, or the SDK can be directly referenced in the existing business system for simple configuration, so as to complete the dynamic fine-grained adjustment of system permission control and access control.

[0075] Example 2:

[0076] The present invention also provides a fine-grained dynamic access control system for web services. The fine-grained dynamic access control system for web services can be implemented by executing the process steps of the fine-grained dynamic access control method for web services. That is, those skilled in the art can understand the fine-grained dynamic access control method for web services as a preferred embodiment of the fine-grained dynamic access control system for web services.

[0077] The system specifically includes the following modules: Module M1: Identifies all external service interfaces in the WEB backend service and persists the existing WEB external interface information through persistence technology; Module M2: Based on the persisted interface information, performs fine-grained unified configuration according to the functions of different personnel, persists it again, and supports timely adjustment of access control according to changes in business needs; Module M3: Utilizes the already persisted permission configuration, combined with interceptor technology in WEB services, to perform access control based on the user's identity and corresponding permissions.

[0078] Module M1 includes: Module M1.1: Creates a listener in the WEB backend service project to listen for container startup; Module M1.2: After listening for container startup, obtains the current context container through the Application Context; Module M1.3: Obtains the loading process Request Mapping and HandlerMapping from the context container, and obtains all program processing methods Handler Methods from it; Module M1.4: Parses the HandlerMethod and obtains all external interface addresses, and at the same time, determines whether a specific method method has a corresponding permission annotation based on the Handler Method. If the corresponding Handler Method has a corresponding permission annotation, it is persisted along with the external interface address.

[0079] Module M2 includes: Module M2.1: Designs access control permissions based on the identity requirements of accessing users; Module M2.2: Maintains persistent data, including adding, modifying, and deleting; Module M2.3: Completes persistence operations while configuring permissions uniformly, and then updates the access control of interceptor permission rules. The update modes include hot update mode and cold update mode. In the hot update mode, it is necessary to use a message middleware to push the new permission scheme to the corresponding backend service; in the cold update mode, it is necessary to restart the service. Adding includes: adding new access control, including maintaining permission codes and corresponding interface access addresses; modifying includes: modifying the access addresses of existing access permission codes, and not modifying the correspondence between permission codes and interface access addresses obtained from annotations; deleting includes: maintaining all persistent permission code correspondences, softly deleting permission code correspondences persisted through annotations, and directly physically deleting custom-added permission code correspondences.

[0080] The module M3 includes: Module M3.1: After the container starts and completes the persistence of unified interface permission recognition, it reloads the new permission control rules. The new permission control rules take effect immediately after the service starts; Module M3.2: It obtains and parses the authorization information carried by the user through the interceptor, and matches the authorization information carried by the user. If the match is successful, it allows the user to pass; otherwise, it refuses to provide the service; Module M3.3: If a new rule is received from the middleware during the service operation, it immediately updates the current service's permission control rules.

[0081] Those skilled in the art will understand that, in addition to implementing the system, apparatus, and their modules provided by this invention in purely computer-readable program code, the same program can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system, apparatus, and their modules provided by this invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; alternatively, modules for implementing various functions can be considered both software programs implementing the method and structures within the hardware component.

[0082] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A fine-grained dynamic access control method for web services, characterized in that, include: Step 1: Identify all external service interfaces in the WEB backend service and persist the existing WEB external interface information using persistence technology; Step 2: Based on the persistent interface information, perform fine-grained unified configuration according to the functions of different personnel, persist it again, and support timely adjustment of access control according to changes in business needs; Step 3: Utilize the already persistent permission configuration, combined with interceptor technology in web services, to control access permissions based on the user's identity and corresponding permissions; Step 1 includes: Step 1.1: Create a listener in the WEB backend service project to listen for container startup; Step 1.2: After the container starts, obtain the current context container through the ApplicationContext, which is related to the application's context. Step 1.3: Obtain the loading process RequestMappingHandlerMapping from the context container, and obtain all program processing methods HandlerMethod from it; Step 1.4: Parse the HandlerMethod and obtain all external interface addresses. At the same time, check whether a specific method method has a corresponding permission annotation based on the HandlerMethod. If the corresponding HandlerMethod has a corresponding permission annotation, persist it along with the external interface address. Step 2 includes: Step 2.1: Design access control permissions based on the identity requirements of the accessing users; Step 2.2: Maintain the persistent data, including adding, modifying, and deleting data; Step 2.3: While configuring permissions uniformly, complete the persistence operation, and then update the access control of the interceptor permission rules. The update mode includes hot update mode and cold update mode. In the case of hot update mode, it is necessary to use the message middleware to push to the corresponding backend service to obtain the new permission scheme; in the case of cold update mode, it is necessary to restart the service.

2. The fine-grained dynamic access control method for web services according to claim 1, characterized in that, The additions include: adding new access controls, including maintaining permission codes and corresponding interface access addresses; The modifications include: modifying the access addresses of the accessible interfaces corresponding to the existing access permission codes, but not modifying the correspondence between the permission codes and interface access addresses obtained from the annotations; The deletion includes: maintaining all persistent permission code correspondences, performing soft deletion on permission code correspondences persisted through annotations, and directly physically deleting custom-added permission code correspondences.

3. The fine-grained dynamic access control method for web services according to claim 1, characterized in that, Step 3 includes: Step 3.1: After the container starts and completes the persistence of unified interface permission recognition, reload the new permission control rules. Once the loading is complete after the service starts, the permission control rules will be effective. Step 3.2: Obtain and parse the authorization information carried by the user through the interceptor, and match the authorization information carried by the user. If the match is successful, allow the process; otherwise, refuse to provide services. Step 3.3: If a new rule is received from the middleware during service operation, the current service's access control rules are updated immediately.

4. A fine-grained dynamic access control system for web services, characterized in that, include: Module M1: Identifies all external service interfaces in the WEB backend service and persists the existing WEB external interface information through persistence technology; Module M2: Based on persistent interface information, it performs fine-grained unified configuration according to the functions of different personnel, persists it again, and supports timely adjustment of access control according to changes in business needs; Module M3: Utilizes the already persistent permission configuration and combines it with interceptor technology in web services to control access permissions based on the user's identity and corresponding permissions; The module M1 includes: Module M1.1: Creates a listener in the WEB backend service project, responsible for listening for container startup; Module M1.2: After the container starts, it obtains the current context container through the ApplicationContext based on the application's context. Module M1.3: Retrieves the loading process RequestMappingHandlerMapping from the context container, and obtains all program processing methods HandlerMethod from it; Module M1.4: Parses HandlerMethod and obtains all external interface addresses. At the same time, it checks whether a specific method method has a corresponding permission annotation based on the HandlerMethod. If the corresponding HandlerMethod has a corresponding permission annotation, it persists the interface external address together with it. The module M2 includes: Module M2.1: Designs access control permissions based on the identity requirements of the accessing user; Module M2.2: Maintains data based on persistent data, including adding, modifying, and deleting data; Module M2.3: While configuring permissions uniformly, it performs persistence operations and then updates the access control of the interceptor permission rules. The update modes include hot update mode and cold update mode. In the case of hot update mode, it is necessary to use the message middleware to push to the corresponding backend service to obtain the new permission scheme; in the case of cold update mode, the service needs to be restarted.

5. The fine-grained dynamic access control system for web services according to claim 4, characterized in that, The additions include: adding new access controls, including maintaining permission codes and corresponding interface access addresses; The modifications include: modifying the access addresses of the accessible interfaces corresponding to the existing access permission codes, but not modifying the correspondence between the permission codes and interface access addresses obtained from the annotations; The deletion includes: maintaining all persistent permission code correspondences, performing soft deletion on permission code correspondences persisted through annotations, and directly physically deleting custom-added permission code correspondences.

6. The fine-grained dynamic access control system for web services according to claim 4, characterized in that, The module M3 includes: Module M3.1: After the container starts and completes the persistence of unified interface permission recognition, it reloads the new permission control rules. Once the loading is completed after the service starts, the permission control rules will take effect. Module M3.2: Obtains and parses the authorization information carried by the user through the interceptor, and matches the authorization information carried by the user. If the match is successful, the process is allowed; otherwise, the service is denied. Module M3.3: If a new rule is received from the middleware during service operation, the current service's access control rules will be updated immediately.

Images