Access control method and apparatus, computer device, and storage medium

Abstract

The application relates to the technical field of big data, and provides an access control method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: receiving an external function access request sent by a client, the external function access request carrying function coding of an external function to be accessed and identity information of a request object; when it is determined based on the function coding that the request object needs authorization and the request object meets preset function access conditions, pushing authorization protocol data corresponding to the function coding to the client; receiving authorization confirmation data fed back by the client; calling an authorization interface corresponding to the function coding; when the authorization is successful, acquiring an access mode corresponding to the function coding and a function access address; and generating and pushing a target function access address to the client according to the access mode, the function access address and the identity information. The method only exposes the function coding to the outside, and the function access address is acquired through the function coding, so that the data security can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of big data, and in particular to an access control method and device, a computer device, a storage medium and a computer program product. BACKGROUND

[0002] A converged service is a service that aggregates resources and capabilities of multiple fields by using technology and platforms of a merchant, integrates various information, contents and applications, and combines various services and functions provided by different subjects to provide customers, so as to meet the ubiquitous and integrated needs of customers and create additional value for customers.

[0003] A service integration portal platform is a common converged service. In the service integration portal platform, some external functions or external services are usually accessed. If a user wants to access an accessed external service or external function, the user can click a service or function acquisition button to send an access request to a server. The server can push a link address of the corresponding service or function according to the access request, so that the client can complete a corresponding page jump.

[0004] However, as an integration party of many functions, the service integration portal platform has a risk of exposing external functions and is easy to be acquired. If the service integration portal platform is attacked, data leakage is likely to occur. Therefore, the current data access scheme has the problem of low data security. SUMMARY

[0005] Therefore, it is necessary to provide an access control method, device, computer device, computer readable storage medium and computer program product capable of improving data security.

[0006] In a first aspect, the present application provides an access control method. The method comprises:

[0007] receiving an external function access request sent by a client, the external function access request carrying a function code of an external function to be accessed and identity information of a request object;

[0008] when it is determined based on the function code that the request object needs authorization and the request object meets a preset function access condition, pushing an authorization protocol data corresponding to the function code to the client;

[0009] receiving authorization confirmation data fed back by the client, and calling an authorization interface corresponding to the function code;

[0010] when the authorization is successful, obtaining an access mode and a function access address corresponding to the function code, and generating and pushing a target function access address to the client according to the access mode, the function access address and the identity information.

[0011] In one of the embodiments, the determining whether the request object meets the preset function access condition comprises:

[0012] Obtaining a check interface code corresponding to the function code;

[0013] When a check interface corresponding to the check interface code is found in the preset interface mapping table, calling the check interface with the identity information as the interface input parameter to determine whether the request object meets the preset function access condition.

[0014] In one of the embodiments, the generating a target function access address according to the access mode, the function access address and the identity information comprises:

[0015] Encrypting the identity information to obtain encrypted identity information;

[0016] Splicing the function access address, the access mode and the encrypted identity information to generate the target function access address.

[0017] In one of the embodiments, the determining whether the request object needs authorization based on the function code comprises:

[0018] Obtaining authorization identification data corresponding to the function code;

[0019] Determining whether the request object needs authorization according to the authorization identification data.

[0020] In one of the embodiments, the method further comprises:

[0021] Obtaining function management parameters, and effective region configuration parameters and invalid region configuration parameters corresponding to the function code;

[0022] Generating function libraries of each region according to the function management parameters, and the effective region configuration parameters and the invalid region configuration parameters corresponding to the function code;

[0023] Creating function integrated page data corresponding to each region based on the function libraries of each region and preset page format data.

[0024] In one of the embodiments, the method further comprises:

[0025] Receiving a page loading request sent by a client, the page loading request carrying a selected region and identity information of a request object;

[0026] Determining function integrated page data to be pushed according to the selected region and the identity information;

[0027] Pushing the function integrated page data to the client.

[0028] In one embodiment, the data for the integrated function page to be pushed, determined based on the selected region and identity information, includes:

[0029] If the corresponding customized page data is found based on the identity information and the selected region, then the customized page data will be identified as the function integration page data;

[0030] If no corresponding customized page data is found based on the identity information and selected region, the function integration page data to be pushed is determined based on the regional function integration page data associated with the selected region.

[0031] In one embodiment, the function integration page data to be pushed is determined based on the regional function integration page data associated with the selected region, including:

[0032] If no corresponding function integration page data is found based on the selected region, then query the function integration page data of the parent region of the selected region, and determine the function integration page data of the parent region of the selected region as the function integration page data.

[0033] In one embodiment, the method further includes:

[0034] Acquire feedback data and / or event tracking data sent by the client. The event tracking data is collected by the client after obtaining authorization from the requesting object.

[0035] Update the display priority of function menus in the function integration page based on the data collected from tracking points and / or feedback data.

[0036] Secondly, this application also provides an access control device. The device includes:

[0037] The request receiving module is used to receive external function access requests sent by the client. The external function access request carries the function code of the external function to be accessed and the identity information of the requesting object.

[0038] The authorization protocol data push module is used to push authorization protocol data corresponding to the function code to the client when it is determined that the requesting object needs authorization based on the function code and the requesting object meets the preset function access conditions.

[0039] The authorization module is used to receive authorization confirmation data from the client and call the authorization interface corresponding to the function code;

[0040] The function access address push module is used to obtain the access method and function access address corresponding to the function code when authorization is successful. Based on the access method, function access address and identity information, it generates and pushes the target function access address to the client.

[0041] In a third aspect, the present application provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the steps of the access control method when executing the computer program.

[0042] In a fourth aspect, the present application provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program implements the steps of the access control method when executed by a processor.

[0043] In a fifth aspect, the present application provides a computer program product. The computer program product comprises a computer program, and the computer program implements the steps of the access control method when executed by a processor.

[0044] The access control method, device, computer device, storage medium and computer program product are different from the traditional external access control mode. When receiving an external function access request, the corresponding function access address is not directly pushed, but when it is determined that the request object needs to be authorized and the request object meets the preset function access condition based on the function code of the external function, the authorization protocol data corresponding to the function code is pushed to the client to complete the authorization. When the authorization is successful, the target function access address is generated and pushed to the client according to the access mode, the function access address and the identity information, so that the client completes the access of the external function. The above scheme, on the one hand, only exposes a function code to the outside, avoiding the exposure of the function access address, greatly reducing the risk of external function exposure and platform information leakage. On the other hand, for the jump of external services, the function access address is obtained by the function code. When receiving the external function access request of the client, the request object needs to complete the authorization and verify that the request object meets the function access condition, and then the target function access address is generated and pushed to the client according to the access mode, the function access address and the identity information corresponding to the function code. In this way, the risk of data leakage can be greatly reduced, and the data security can be improved. Further, the function access condition can be flexibly configured to flexibly cope with complex and diverse business demands. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 An application environment diagram of the access control method in an embodiment;

[0046] Figure 2 A flowchart of the access control method in an embodiment;

[0047] Figure 3 A flowchart of the access control method in another embodiment;

[0048] Figure 4A flowchart of creating a function integration page step in an embodiment;

[0049] Figure 5 A detailed flowchart of an access control method in an embodiment;

[0050] Figure 6 A detailed flowchart of an access control method in another embodiment;

[0051] Figure 7 A structural block diagram of an access control device in an embodiment;

[0052] Figure 8 A structural block diagram of an access control device in another embodiment;

[0053] Figure 9 An internal structural diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0054] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not intended to limit the present application.

[0055] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0056] The access control method provided by the embodiments of the present application can be applied to, for example, Figure 1The application environment is shown. Among them, the client 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. Specifically, the request object (such as a customer) can operate on the function integration page displayed on the client, obtain the function code corresponding to the external function by clicking on a certain external function menu, generate an external function access request carrying the function code and the identity information of the request object to the server 104, the server 104 receives the external function access request, when determining that the request object needs to be authorized based on the function code, and the request object meets the preset function access condition, push the authorization protocol data corresponding to the function code to the client 102, receive the authorization confirmation data fed back by the client 102, call the authorization interface corresponding to the function code, when the authorization is successful, obtain the access mode and function access address corresponding to the function code, and generate and push the target function access address to the client 102 according to the access mode, function access address and identity information. Among them, the client 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things device can be a smart speaker, a smart TV, a smart air conditioner, a smart vehicle device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0057] In one of the embodiments, as shown in Figure 2 , an access control method is provided, which is applied to the server 104 in Figure 1 for example, including the following steps:

[0058] Step S202, receiving an external function access request sent by a client, the external function access request carrying a function code of an external function to be accessed and identity information of a request object.

[0059] The external function is relative to the internal function, which can be understood as a function that needs to be realized by means of a third-party platform outside the internal platform, or can be understood as a service or function provided by a third-party platform. The function code refers to the unique code of the function, which can be generated by the developer according to the function name, function role or other function dimensions, using a certain coding method. Specifically, the function code can be obtained by numbers, letters or combinations of numbers and letters, which is not limited. Each function has and only has one function code. The request object refers to an object that needs to access the external function. In this embodiment, the request object can be a user (account). The identity information of the request object refers to the identity information of the user, which specifically includes identity identification data and corresponding identity proof data.

[0060] In this embodiment, the page displayed by the client is taken as an example of a function integration page, which has multiple function menus. Specifically, the function integration page can have integrated internal function menus or external function menus. In actual application, a request object (such as a client) can perform operations on the function integration page. If the request object wants to access a certain external function, the request object clicks a certain external function menu. At this time, the client 102 acquires the function code corresponding to the external function, and then generates an external function access request carrying the function code and the identity information of the request object to the server 104. The server 104 receives the external function access request.

[0061] Step S204, when it is determined based on the function code that the request object needs authorization and the request object meets the preset function access condition, the authorization protocol data corresponding to the function code is pushed to the client.

[0062] The function access condition refers to a restriction condition for checking whether the request object can access the function. Specifically, the function access condition includes whether to log in, whether to be real-name, whether to be on a blacklist, whether to be on a whitelist, and specific business verification, and the like. The authorization protocol data includes an authorization protocol list and an access address of the protocol content, and the like.

[0063] In this embodiment, the developer can pre-configure the function management parameters related to the function code for each function. The function management parameters include authorization protocol data, a function access address (original function access address), a function access condition, authorization identification data representing whether separate authorization is needed, and a verification interface code, and the like. After the function code of the external function to be accessed is acquired, the function management parameters related to the function code can be acquired to determine whether the external function needs separate authorization by the request object, and to determine whether the request object meets the preset function access condition corresponding to the function code. If it is determined that the request object needs authorization and the request object meets the preset function access condition, the authorization protocol data corresponding to the function code is pushed to the client for the request object to confirm whether to confirm authorization.

[0064] Step S206, receiving the authorization confirmation data fed back by the client, and calling the authorization interface corresponding to the function code.

[0065] The authorization confirmation data is data representing confirmation of authorization. In this embodiment, the authorization confirmation data can be an authorization confirmation message. In the previous embodiment, after the server pushes the authorization protocol data to the client, the client receives the authorization protocol data and displays the corresponding authorization protocol list and the access address of the protocol content. After reading the protocol list and the protocol content, the client can check the authorization protocol list to represent that the authorization protocol has been agreed to sign. At this time, the client generates an authorization confirmation message and sends the authorization confirmation message to the server. The server receives the authorization confirmation data fed back by the client, which can be the authorization interface code corresponding to the function code. Then, the server looks up the corresponding authorization interface in the interface mapping table, takes the identity information of the request object as the interface input parameter, and calls the authorization interface to authorize.

[0066] In step S208, when the authorization is successful, the access mode corresponding to the function code and the function access address are obtained. According to the access mode, the function access address and the identity information, the target function access address is generated and pushed to the client.

[0067] The function access address is an address used to access a function. The target function access address is a function access address obtained by performing specific processing on the function access address. In this embodiment, the target function access address can be a function access address carrying the identity information of the request object, and its specific form can be a URL (Uniform Resource Locator, uniform resource locator). The access mode is a parameter representing the data access mode. In this embodiment, the access mode includes H5 (HTML5) access, applet access, third-party application access and SDK (Software Development Kit, software development kit) access.

[0068] In the previous embodiment, when the authorization interface is called and the authorization is completed, the corresponding access mode and function access address can be obtained according to the function code. Then, according to the access mode, the function access address and the identity information, the target function access address is generated and pushed to the client. After the client receives the target function access address, the function can be jumped according to the address jump matching rule corresponding to the access mode, so that the client can successfully access the external function. For example, if the access mode is H5 access, the corresponding web page can be jumped according to the target function access address.

[0069] In the access control method, unlike the traditional external access control mode, when receiving an external function access request, the corresponding function access address is not directly pushed, but when it is determined based on the function code of the external function that the request object needs authorization and the request object meets the preset function access condition, the authorization protocol data corresponding to the function code is pushed to the client to complete authorization. When the authorization is successful, the target function access address is generated and pushed to the client according to the access mode, the function access address and the identity information, so that the client completes the access of the external function. The above scheme, on the one hand, only exposes a function code to the outside, avoiding the exposure of the function access address, greatly reducing the risk of external function exposure and platform information leakage. On the other hand, for the jump of external services, the function access address is obtained by the function code, and when receiving the external function access request of the client, the request object needs to complete authorization and verify that the request object meets the function access condition, and then the target function access address is generated and pushed to the client according to the access mode, the function access address and the identity information corresponding to the function code. In this way, the risk of data leakage can be greatly reduced, and the data security can be improved. Further, the function access condition is flexibly configured to flexibly respond to complex and diverse business needs.

[0070] As shown in Figure 3 In one embodiment, before step S204, step S203 is further included: obtaining authorization identification data corresponding to the function code, and determining whether the request object needs authorization according to the authorization identification data.

[0071] The authorization identification data is data representing whether the request object needs individual authorization. In this embodiment, the developer can pre-configure the corresponding authorization identification data for each function code according to the business needs, for example, if the request object needs individual authorization to access the function corresponding to a certain function code, the authorization identification data corresponding to the function code is set to 1, and if the request object does not need individual authorization, the authorization identification data corresponding to the function code is set to 0. In actual application, when receiving a function access request, the authorization identification data corresponding to the function code is obtained, and whether the request object needs authorization is determined according to the authorization identification data. If authorization is needed, it is further determined whether the function access condition is met; if it is determined that the request object does not need individual authorization, the default authorization pop-up window data is pushed to the client, and the client receives the default authorization pop-up window data and pushes the default authorization pop-up window prompt. In this embodiment, the authorization identification data can be used to quickly and simply determine whether the request object needs individual authorization.

[0072] As shown in Figure 3As shown, in one of the embodiments, before step S204, it further comprises: step S223, obtaining the check interface code corresponding to the function code, when finding the check interface corresponding to the check interface code in the preset interface mapping table, calling the check interface with the identity information as the interface input parameter, to determine whether the request object satisfies the preset function access condition.

[0073] The check interface code can be the code corresponding to the check interface obtained by the developer based on the function or name of the check interface using a certain coding method. In actual application, the corresponding interface code can be generated for each interface in advance, and the interface mapping table can be constructed based on the interface and the corresponding interface code. At the same time, when configuring the function management parameters of each function menu, the function code and the interface code are bound.

[0074] In this embodiment, after receiving the external function access request and obtaining the function code, the check interface code corresponding to the function code is obtained, and then the corresponding check interface is found in the preset interface mapping table according to the check interface code. When the check interface corresponding to the check interface code is found in the preset interface mapping table, the identity information is used as the interface input parameter to call the check interface to determine whether the request object satisfies the preset function access condition. Specifically, the corresponding business rules and check rules are preset in the check interface, which can be used to determine whether the request object satisfies the corresponding function access condition according to the identity information of the request object and the corresponding business rules and check rules. If it is determined that the request object satisfies the preset function access condition, the next step is performed, that is, the authorized protocol data is pushed to the client. If the check interface corresponding to the check interface code is not found, or it is determined that the request object does not satisfy the preset function access condition, a prompt message indicating that the access condition is not satisfied is pushed to the client. In this embodiment, by maintaining the check interface code and the specific check interface, the access check condition can be flexibly configured. Moreover, regardless of the result after the check, a unified return structure is used, so that in the function access restriction check process with large size, the identity check can be uniformly processed, and the differentiation of the check is completed by the check interface.

[0075] As shown in the Figure 3 In one of the embodiments, the target function access address is generated according to the access mode, the function access address and the identity information, which comprises: step S228, when the authorization is successful, obtaining the access mode and the function access address corresponding to the function code, encrypting the identity information to obtain the encrypted identity information, splicing the function access address, the access mode and the encrypted identity information to generate the target function access address, and generating and pushing the target function access address to the client.

[0076] In this embodiment, the generation of the target function access address can be achieved by: encrypting the identity information to obtain encrypted identity information, concatenating the function access address, access method, and encrypted identity information to generate the target function access address. Specifically, it can involve obtaining the data exchange method corresponding to the function code, encrypting the identity information according to a preset encryption algorithm to obtain encrypted identity information. In practice, the encrypted identity information, access method, and function access address can be concatenated into a URL to obtain the target function access address, and then the target function access address can be pushed to the client. In this embodiment, by encrypting the identity information to generate a target function access address carrying the encrypted identity information, encrypted data transmission can be achieved, ensuring the security of platform services.

[0077] like Figure 4 As shown, in one embodiment, the method further includes:

[0078] Step S102: Obtain the function management parameters, as well as the effective region configuration parameters and ineffective region configuration parameters corresponding to the function code.

[0079] Step S104: Generate the function library for each region based on the function management parameters, as well as the effective region configuration parameters and ineffective region configuration parameters corresponding to the function codes.

[0080] Step S106: Based on the function library and preset page layout data for each region, create the corresponding function integration page data for each region.

[0081] In this embodiment, the function management parameters are the function-related parameters that need to be configured. Specifically, the function management parameters include function name, function access address, login identifier data, real-name identifier data, function access conditions, authorization identifier data, authorization protocol data, verification interface code, function enable / disable status, disabling prompt message, and event tracking code, etc. The effective region configuration parameters include the effective region's region code, function code, creation time, and association number, etc. The inactive region configuration parameters include the inactive region's (blocked region's) region code, function code, and association number, etc.

[0082] In a specific implementation, the aggregation service platform is taken as an example of a platform integrating a background configuration management system, an APP (application) main body, and data analysis, which is mainly used to provide a platform APP for providing local high-quality and characteristic services in regions, provinces, counties, and villages. After obtaining the function management parameters and the effective region configuration parameters and the ineffective region configuration parameters corresponding to the function code, the configuration of each function corresponding to the function management parameters can be completed to generate a unique function code corresponding to the function. Then, the effective region and the ineffective region of the configuration function are configured by default in the nationwide range. Specifically, the effective region configuration parameters corresponding to the function code are used to create a function and effective region association table to record the effective range of each function. The ineffective region configuration parameters corresponding to the function code are used to create a function and ineffective region association table to record the ineffective range of each function. The function and effective region association table contains fields such as the region code of the effective region, the function code, the creation time, and the association number. The function and ineffective region association table is configured to avoid conflicts between the characteristic functions of the current level and the functions of the superior region according to the effective coverage rule in the effective region. The function and ineffective region association table contains fields such as the region code of the ineffective region, the function code, the creation time, and the association number. In this embodiment, the ineffective rule is prior to the effective rule.

[0083] After the function and effective region association table and the function and ineffective region association table are constructed, the function library of any region can be obtained through the operation of the function effective region and the subordinate coverage region and the function ineffective region and the subordinate region. For example, the function library of a region = the function of the current level effective alone + the function of the superior level effective + the function of the current level hidden superior region effective. In this embodiment, the superior and subordinate relationship of the region can be divided according to the relationship of the administrative division. After the function library corresponding to each region is constructed, the function condition menu can be selected from the corresponding function library of each region according to the preset page format data, and the function code is associated, the function name is input, and the function icon is uploaded to assemble the function integration page data corresponding to each region. Specifically, the menu configuration of the page can support multiple forms, such as cards, carousels, menu items, and the like. For single data upload pictures, input titles, and association of functions in the function library of the region, a configuration page data is generated. In this embodiment, by creating the function library corresponding to each region, the maintenance and management of the function and the regional priority adaptation can be facilitated.

[0084] As shown in Figure 5 , in one of the embodiments, the method further includes:

[0085] In step S120, a page loading request sent by a client is received, and the page loading request carries identity information of a selected region and a request object.

[0086] Step S122: Determine the integrated page data of the functions to be pushed based on the selected region and identity information.

[0087] Step S124: The push function integrates page data to the client.

[0088] A function integration page is a page that integrates multiple function menus; it can also be understood as an application display page, i.e., an APP display page. In this embodiment, the function integration page refers to the function integration page corresponding to the region. The requesting object has access to all functions in the function library. The APP can configure the functions to be displayed first according to the platform's promotion rules, serving as the default display page for the aggregation of external functions of the APP.

[0089] In practice, after logging into the system on a client side, a user might want to view a feature display page showcasing specific functions for a particular region. This could be achieved by the user selecting and confirming the region on the client side. At this point, the client generates a page loading request carrying the selected region and the user's identity information, and sends this request to the server. The server receives the page loading request, determines the corresponding feature integration page data to be pushed based on the selected region and the user's identity information, and then pushes this feature integration page data to the client. The client receives the feature integration page data and loads and displays the corresponding feature integration page for the user to view. In this embodiment, determining the feature integration page data to be pushed based on the selected region and identity information allows for targeted push of feature integration pages.

[0090] like Figure 6 As shown, in one embodiment, step S122 includes:

[0091] Step S142: If the corresponding customized page data is found based on the identity information and the selected region, the customized page data is determined as the function integration page data.

[0092] Step S162: If no corresponding customized page data is found based on the identity information and the selected region, then determine the function integration page data to be pushed based on the regional function integration page data associated with the selected region.

[0093] Customized page data refers to personalized page data tailored to the client's needs. In practical applications, the requesting party can manage the functions in the function library according to their own preferences, customize personalized function integration pages, obtain customized page data, and simultaneously establish and record the association between identity information, selected region, and customized page data.

[0094] According to the above embodiment, the function integration page data is determined according to the selected region and identity information, specifically, first, according to the information of the identity of the request object and the selected region, whether there is corresponding customized page data in the database is queried, if there is, the queried customized page data is determined as the function integration page data, if not, the configured region function integration page data is pushed, specifically, the region function integration page data (including the region function integration page data of the superior region) associated with the region code of the selected region can be queried according to the selected region, and based on the queried region function integration page data, the function integration page data to be pushed is determined. In this embodiment, the customized function integration page data is supported, the function integration page to be pushed is determined through the identity information and the selected region, the customized page data can be preferentially pushed, and the personalized recommendation of the page data is realized.

[0095] In another embodiment, determining the function integration page data to be pushed according to the region function integration page data associated with the selected region includes: if no corresponding function integration page data is found according to the selected region, querying the function integration page data of the superior region of the selected region, and determining the function integration page data of the superior region of the selected region as the function integration page data.

[0096] In practical applications, the push of integrated function page data only pushes the integrated function page data that has been configured in the database and corresponds to the region. Considering that not all regions selected by the request object have corresponding integrated function pages created in the database, the determination of the integrated function page data to be pushed based on the retrieved regional integrated function page data can be as follows: First, based on the selected region, query the database to see if there is integrated function page data (region-specific integrated function page) for that region. If it exists, then the integrated function page data corresponding to that region is determined as the integrated function page data to be pushed; if there is no integrated function page data corresponding to that region, then query the selected region sequentially to its superior regions, that is, query whether there is corresponding integrated function page data in its superior regions. If it exists, then the integrated function page data of the superior region of the selected region is determined as the integrated function page data; otherwise, continue to query whether there is corresponding integrated function page data in the superior region, until the nationally unified integrated function page data is determined as the integrated function page data to be pushed. For example, if the requested user selects a region as Province A, City B, District C, and no corresponding integrated function page data is found for District C, the system queries whether corresponding integrated function page data exists for City B. If it exists, the integrated function page data for City B is selected as the integrated function page data to be pushed. If it does not exist, the system queries whether corresponding integrated function page data exists for Province A. If it exists, the integrated function page data for Province A is selected as the integrated function page data to be pushed. If it does not exist, the nationally unified integrated function page data is selected as the integrated function page data to be pushed. In this embodiment, when no integrated function page data for the selected region is found, the system queries upwards to higher-level regions sequentially based on the selected region. This ensures that the pushed integrated function pages are more closely aligned with the needs of the requesting user, improving the accuracy of the push notifications.

[0097] like Figure 5 As shown, in one embodiment, the method further includes: step S210, obtaining feedback data and / or event tracking data sent by the client, wherein the event tracking data is collected by the client after obtaining authorization from the requesting object, and updating the display priority of the function menu in the function integration page according to the event tracking data and feedback data.

[0098] The opinion feedback data includes the improvement suggestions and evaluation data of the request object collected by the client. It can be understood that the opinion feedback data carries the identity information and / or selected region of the request object. In actual application, the opinion feedback function is provided on the function integration page, and an entrance for the client to submit feedback opinions is provided. When the client submits the opinion feedback data, the client synchronously sends the opinion feedback data to the server, and the server receives the opinion feedback data and records it in the database. In actual application, the function access stages can be tracked to collect the corresponding tracking data. The tracking data collection stages include the click menu stage, the authorization stage, the access control stage, and the access jump stage. Specifically, the tracking rule of the click menu stage can be tracking code + "click", that is, when the client detects a click operation, the click behavior is recorded to obtain the click behavior tracking data. The tracking rule of the authorization stage can be tracking code + "protocol ID (Identity, identity)" + "protocol version", which is used to record each authorization operation and the authorization protocol version to obtain the authorization tracking data, so as to ensure that the request object has an authorization behavior. For the default authorization, the default authorization rule code is added. The tracking rule of the access control stage can be tracking code + "reject", for the request object whose access control is rejected, after the message of not meeting the access conditions is pushed, the request object is confirmed, and the request object is recorded to know that it does not meet the access conditions of the function, to obtain the access control tracking data. The tracking rule of the access jump stage can be tracking code + "jump", for the request object that can normally access, the jump action is recorded before jumping to the external function, to obtain the access success indication. It can be understood that the above is only an example of the tracking rule setting, and other rules can also be set in other embodiments.

[0099] In this embodiment, the display priority of the function menu in the function integration page can be adjusted according to the opinion feedback data. For example, a piece of opinion feedback data hopes to push some function menus or push some special functions related to a certain region in priority, according to the identity information and / or selected region of the request object carried by the opinion feedback data, the corresponding function integration page data is located, and then the display priority of the function menu in the function integration page is adjusted.

[0100] In another embodiment, the display priority of function menus in the update function integration page can be adjusted based on the event tracking data. For example, based on the event tracking data collected from the requester's operations at each stage, the most desired functions, the most frequently used functions, the functions with the highest success rate, and the retention status of functions requiring authorization can be analyzed. Based on this analysis data, the display priority of function menus in the update function integration page can be adjusted in a timely manner to optimize the current main push function.

[0101] In another embodiment, the display priority of function menus in the updated function integration page can be adjusted based on event tracking data and feedback data. Specifically, by comprehensively considering function usage data obtained from event tracking data analysis and feedback data, and after analyzing data such as the functions most requested by users, the most frequently used functions, and the functions with the highest success rate, adjustments are made in conjunction with the feedback data to adjust the display priority of function menus in the updated function integration page.

[0102] In this embodiment, updating the display priority of the function menu in the function integration page based on feedback data and / or event tracking data can make data push more closely match the actual needs of customers and improve the customer experience.

[0103] To provide a clearer explanation of the access control method provided in this application, a specific embodiment and accompanying drawings are described below. Figure 6 The specific embodiment is described below:

[0104] Step S120: Receive a page loading request sent by the client. The page loading request carries the selected region and the identity information of the requested object.

[0105] Step S142: If the corresponding customized page data is found based on the identity information and the selected region, the customized page data is determined as the function integration page data.

[0106] Step S162: If no corresponding customized page data is found based on the identity information and the selected region, then determine the function integration page data to be pushed based on the regional function integration page data associated with the selected region.

[0107] Step S124: The push function integrates page data to the client.

[0108] Step S202: Receive an external function access request sent by the client. The external function access request carries the function code of the external function to be accessed and the identity information of the requesting object.

[0109] Step S203: Obtain the authorization identifier data corresponding to the function code. Based on the authorization identifier data, determine whether the requesting object needs authorization. If it does, proceed to step S223.

[0110] Step S223: Obtain the verification interface code corresponding to the function code. When the verification interface corresponding to the verification interface code is found in the preset interface mapping table, the identity information is used as the interface input parameter to call the verification interface to determine whether the requested object meets the preset function access conditions.

[0111] Step S204: When it is determined that the requesting object needs authorization based on the function code and the requesting object meets the preset function access conditions, the authorization protocol data corresponding to the function code is pushed to the client.

[0112] Step S206: Receive authorization confirmation data from the client and call the authorization interface corresponding to the function code.

[0113] Step S228: When authorization is successful, obtain the access method and function access address corresponding to the function code, encrypt the identity information to obtain the encrypted identity information, concatenate the function access address, access method and encrypted identity information to generate the target function access address, and generate and push the target function access address to the client.

[0114] Step S210: Obtain feedback data and / or event tracking data sent by the client, and update the display priority of the function menu in the function integration page based on the event tracking data and feedback data.

[0115] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0116] Based on the same inventive concept, this application also provides an access control device for implementing the access control method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more access control device embodiments provided below can be found in the limitations of the access control method described above, and will not be repeated here.

[0117] In one embodiment, such as Figure 7As shown, an access control apparatus is provided, comprising: a request receiving module 710, an authorization protocol data pushing module 720, an authorization module 730 and a function access address pushing module 740, wherein:

[0118] The request receiving module 710 is configured to receive an external function access request sent by a client, the external function access request carrying a function code of a to-be-accessed external function and identity information of a request object.

[0119] The authorization protocol data pushing module 720 is configured to, when it is determined based on the function code that the request object needs authorization and the request object meets preset function access conditions, push authorization protocol data corresponding to the function code to the client.

[0120] The authorization module 730 is configured to receive authorization confirmation data fed back by the client and call an authorization interface corresponding to the function code.

[0121] The function access address pushing module 740 is configured to, when the authorization is successful, acquire an access mode and a function access address corresponding to the function code, generate and push a target function access address to the client according to the access mode, the function access address and the identity information.

[0122] In the above access control apparatus, unlike the traditional external access control mode, when an external function access request is received, the corresponding function access address is not directly pushed, but when it is determined based on the function code of the external function that the request object needs authorization and the request object meets preset function access conditions, authorization protocol data corresponding to the function code is pushed to the client to complete authorization, and when the authorization is successful, a target function access address is generated and pushed to the client according to the access mode, the function access address and the identity information, so that the client completes the access of the external function. The above scheme, on the one hand, exposes only one function code to the outside, avoiding the exposure of the function access address and greatly reducing the risk of external function exposure and platform information leakage. On the other hand, for external service jumping, the function access address is acquired by the function code, when the external function access request of the client is received, the request object needs to complete authorization and verify that the request object meets the function access conditions, and then a target function access address is generated and pushed to the client according to the access mode, the function access address and the identity information corresponding to the function code, so that the data can be greatly avoided from being acquired in batches, the risk of data leakage is reduced, and the data security is improved. Further, flexible configuration of the function access conditions is supported to flexibly cope with complex and diverse business demands.

[0123] As shown in FIG. 7, an access control apparatus is provided, comprising: a request receiving module 710, an authorization protocol data pushing module 720, an authorization module 730 and a function access address pushing module 740, wherein: Figure 8As shown in the figure, in one of the embodiments, the apparatus further includes an authorization judgment module 712 configured to acquire authorization identification data corresponding to the function code, and determine whether the request object needs authorization according to the authorization identification data.

[0124] As shown in the figure, in one of the embodiments, the apparatus further includes an access control module 714 configured to acquire a verification interface code corresponding to the function code, and when a verification interface corresponding to the verification interface code is found in a preset interface mapping table, call the verification interface with the identity information as the interface input parameter to determine whether the request object meets the preset function access condition. Figure 8

[0125] In one of the embodiments, the function access address pushing module 740 is further configured to encrypt the identity information to obtain encrypted identity information, splice the function access address, the access mode, and the encrypted identity information to generate a target function access address.

[0126] As shown in the figure, in one of the embodiments, the apparatus further includes a function library creating module 702 configured to acquire function management parameters, and effective region configuration parameters and invalid region configuration parameters corresponding to the function code, generate function libraries of regions according to the function management parameters, and the effective region configuration parameters and the invalid region configuration parameters corresponding to the function code, and create function integrated page data corresponding to each region based on the function libraries of the regions and preset page format data. Figure 8

[0127] As shown in the figure, in one of the embodiments, the apparatus further includes a page data pushing module 704 configured to receive a page loading request sent by a client, the page loading request carrying a selected region and identity information of a request object, determine function integrated page data to be pushed according to the selected region and the identity information, and push the function integrated page data to the client. Figure 8 In one of the embodiments, the page data pushing module 704 is further configured to, if corresponding customized page data is found according to the identity information and the selected region, determine the customized page data as the function integrated page data, and if corresponding customized page data is not found according to the identity information and the selected region, determine the function integrated page data to be pushed according to region function integrated page data associated with the selected region.

[0128] In one of the embodiments, the page data pushing module 704 is further configured to, if corresponding function integrated page data is not found according to the selected region, query function integrated page data of a superior region of the selected region, and determine the function integrated page data of the superior region of the selected region as the function integrated page data.

[0129] As shown in the figure, in one of the embodiments, the apparatus further includes a function library creating module 702 configured to acquire function management parameters, and effective region configuration parameters and invalid region configuration parameters corresponding to the function code, generate function libraries of regions according to the function management parameters, and the effective region configuration parameters and the invalid region configuration parameters corresponding to the function code, and create function integrated page data corresponding to each region based on the function libraries of the regions and preset page format data.

[0130] Figure 8 ​​​As shown, in one embodiment, the device further includes a function menu priority update module 750, which is used to obtain feedback data and / or event tracking data sent by the client. The event tracking data is collected by the client after obtaining authorization from the requesting object. Based on the event tracking data and / or feedback data, the display priority of the function menu in the function integration page is updated.

[0131] Each module in the aforementioned access control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of the computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0132] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores function libraries, function integration page data, embedded data, and feedback data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements an access control method.

[0133] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0134] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the access control method described above.

[0135] In one embodiment, the processor also implements the steps of the access control method described above when executing a computer program.

[0136] In one of the embodiments, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the access control method.

[0137] In one of the embodiments, a computer program product is provided, and the computer program product comprises a computer program, and the computer program is executed by a processor to implement the steps of the access control method.

[0138] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the computer program can include the processes of the above-mentioned embodiments. Any reference to a memory, a database or other medium in the embodiments provided in the present application can include at least one of a non-volatile memory and a volatile memory. The non-volatile memory can include a read-only memory (ROM), a magnetic tape, a floppy disk, a flash memory, an optical storage, a high-density embedded non-volatile memory, a resistive memory (ReRAM), a magnetoresistive random access memory (MRAM), a ferroelectric random access memory (FRAM), a phase change memory (PCM), a graphene memory, etc. The volatile memory can include a random access memory (RAM) or an external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as a static random access memory (SRAM) or a dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., and is not limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., and is not limited thereto.

[0139] The technical features of the above embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present application.

[0140] The above-described embodiments are merely illustrative of several embodiments of the present application, which are described in more detail and in a specific manner, but should not be construed as limiting the scope of the patent of the present application. It should be noted that, for those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. An access control method characterized by, The method comprises: receiving an external function access request sent by a client, the external function access request carrying a function code of an external function to be accessed and identity information of a request object, obtaining function management parameters related to the function code, the function management parameters including authorization protocol data, a function access address, function access conditions, authorization identification data, and a verification interface code; determining whether the request object needs authorization according to the authorization identification data, and if it is determined that the request object does not need authorization, pushing a default authorization pop-up window prompt to the client; if it is determined that the request object needs authorization, when a verification interface corresponding to the verification interface code is found in a preset interface mapping table, calling the verification interface with the identity information as an interface parameter to determine whether the request object meets preset function access conditions; when the request object meets the preset function access conditions, pushing the authorization protocol data corresponding to the function code to the client; receiving authorization confirmation data fed back by the client, and calling an authorization interface corresponding to the function code; when authorization is successful, obtaining an access mode and a function access address corresponding to the function code, performing encryption processing on the identity information to obtain encrypted identity information, and generating and pushing a target function access address to the client according to the access mode, the function access address, and the encrypted identity information.

2. The method of claim 1, wherein, Generating a target function access address according to the access mode, the function access address, and the encrypted identity information comprises: splicing the function access address, the access mode, and the encrypted identity information to generate a target function access address.

3. The method according to claim 1 or 2, characterized in that, The method further comprises: obtaining effective region configuration parameters and invalid region configuration parameters corresponding to the function code; generating function libraries of regions according to the function management parameters and the effective region configuration parameters and the invalid region configuration parameters corresponding to the function code; creating function integration page data corresponding to regions based on the function libraries of the regions and preset page format data.

4. The method according to claim 1 or 2, characterized in that, The method further comprises: receiving a page loading request sent by the client, the page loading request carrying a selected region and identity information of a request object; determining function integration page data to be pushed according to the selected region and the identity information; pushing the function integration page data to the client.

5. The method of claim 4, wherein, Determining function integration page data to be pushed according to the selected region and the identity information comprises: if corresponding customized page data is found according to the identity information and the selected region, the customized page data is determined as the function integration page data; if corresponding customized page data is not found according to the identity information and the selected region, function integration page data to be pushed is determined according to region function integration page data associated with the selected region.

6. The method of claim 5, wherein, Determining the function integration page data according to region function integration page data associated with the selected region comprises: If no corresponding function integration page data is found based on the selected region, then the function integration page data of the superior region of the selected region is queried, and the function integration page data of the superior region of the selected region is determined as the function integration page data.

7. The method of claim 1, wherein, The method further includes: Acquire the feedback data and / or event tracking data sent by the client, wherein the event tracking data is collected by the client after obtaining authorization from the requesting object; Based on the data points and / or the feedback data, update the display priority of the function menus in the function integration page.

8. An access control device, characterized in that The device includes: The request receiving module is used to receive external function access requests sent by the client. The external function access request carries the function code of the external function to be accessed and the identity information of the requesting object. The device is also used to acquire function management parameters related to the function code, the function management parameters including authorization protocol data, function access address, function access conditions, authorization identifier data, and verification interface code; The authorization module is used to determine whether the requesting object needs authorization based on the authorization identifier data. If it is determined that the requesting object does not need authorization, a default authorization pop-up prompt is pushed to the client. The access control module is used to, if it is determined that the request object requires authorization, call the verification interface with the identity information as the interface input parameter when a verification interface corresponding to the verification interface code is found in the preset interface mapping table, so as to determine whether the request object meets the preset functional access conditions. The authorization protocol data push module is used to push authorization protocol data corresponding to the function code to the client when the request object meets the preset function access conditions; The authorization module is used to receive authorization confirmation data from the client and call the authorization interface corresponding to the function code; The function access address push module is used to obtain the access method and function access address corresponding to the function code when authorization is successful, encrypt the identity information to obtain encrypted identity information, and generate and push the target function access address to the client based on the access method, the function access address and the encrypted identity information.

9. The apparatus of claim 8, wherein, The function access address push module is also used to concatenate the function access address, access method, and encrypted identity information to generate the target function access address.

10. The apparatus of claim 8 or 9, wherein, The device also includes a function library creation module, which is used to obtain the effective region configuration parameters and ineffective region configuration parameters corresponding to the function code, generate function libraries for each region based on the function management parameters and the effective region configuration parameters and ineffective region configuration parameters corresponding to the function code, and create function integration page data corresponding to each region based on the function libraries for each region and preset page layout data.

11. The apparatus of any one of claims 8 or 9, wherein, The device further comprises a page data pushing module, configured to receive a page loading request sent by the client, the page loading request carrying identity information of a selected region and a request object, determine function integrated page data to be pushed according to the selected region and the identity information, and push the function integrated page data to the client.

12. The apparatus of claim 11, wherein, The page data pushing module is further configured to, if corresponding customized page data is found according to the identity information and the selected region, determine the customized page data as the function integrated page data, and if corresponding customized page data is not found according to the identity information and the selected region, determine function integrated page data to be pushed according to region function integrated page data associated with the selected region.

13. The apparatus of claim 12, wherein, The page data pushing module is further configured to, if corresponding function integrated page data is not found according to the selected region, query function integrated page data of a superior region of the selected region, and determine the function integrated page data of the superior region of the selected region as the function integrated page data.

14. The apparatus of claim 8, wherein, The device further comprises a function menu priority updating module, configured to acquire opinion feedback data and / or burying point data sent by the client, the burying point data being acquired by the client after authorization of the request object, and update display priority of a function menu in a function integrated page according to the burying point data and / or the opinion feedback data.

15. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 7.

16. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 7.

17. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 7.

Images