A cross-unit data service permission control collaboration system

Abstract

The application relates to a cross-unit data service permission control cooperation system, which comprises a data hierarchical classification module, the data hierarchical classification module being used for dividing data sets and data fields into levels and categories; an authorization and authentication module, the authorization and authentication module comprising a data layer and a service layer, the authorization and authentication module being used for authorizing and authenticating two layers of data of the unit and service of the unit or an external unit; a service gateway, the service gateway collecting all services registered including the unit and the external unit, and in the authorization link of the service, an authentication submodule of the authorization and authentication module is called to determine whether the current service invoker has the permission to the called service and which permission; and a front-end application, the front-end application realizing the interactive operation of a user and a background system by calling the service on the service gateway. The application realizes the cooperation of cross-unit data service permission control under the scene that the construction steps of unit systems are inconsistent.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of big data, and in particular to a cross-unit data service permission control cooperation system. BACKGROUND

[0002] Permission control of data service is a rigid requirement in various industries, and has good engineering practice. However, most of the current focus is on the control within the unit, that is, the permission control under the same system, and there are few control schemes involving cross units, and even fewer specific engineering practices.

[0003] In the known permission control schemes involving cross units, a bilateral role needs to be defined, that is, a bilateral role recognized and identified by each unit participating in cooperation, and then the cross-unit permission control is realized through authorization of the bilateral role. This requires that the system construction steps of each unit participating in cooperation be consistent, and the definition, authorization and authentication of the bilateral role need to be supported at the same time. However, in the actual project implementation process, the construction steps of each unit are difficult to keep consistent, which directly leads to the difficulty of implementing the scheme based on the bilateral role. SUMMARY

[0004] In view of the problems in the above background art, the application provides a cross-unit data service permission control cooperation system.

[0005] The cross-unit data service permission control cooperation system provided by the application comprises:

[0006] A data hierarchical classification module, which is used for dividing data sets and data fields into levels and categories.

[0007] An authorization and authentication module, which comprises a data layer and a service layer, and is used for authorizing and authenticating data of the unit and services of the unit or external units.

[0008] A service gateway, which collects all services of the unit and external units, and determines whether the current service caller has permission to call the service and the permission through the authentication submodule of the authorization and authentication module in the authentication link of the service.

[0009] A front-end application, which realizes the interactive operation of the user and the background system by calling the service on the service gateway.

[0010] By adopting the technical scheme, the application can provide a simple and reliable cooperation for systems of units in different construction stages, thereby implementing permission control of data services and achieving strict hierarchical classification control of data. The different construction stages refer to that a part of the systems of units have complete authorization and authentication modules, and another part of the systems of units do not have the authorization and authentication modules. When the systems of units need to interconnect and interoperate, the problem caused by the difference can be solved.

[0011] Preferably, the data layer grants the hierarchical classification of data defined by the data hierarchical classification module to the role or the user, so that the authentication submodule of the hierarchical classification module determines whether the current logged-in user, the role, and the granted hierarchical classification of data in the front-end application have access permission of a field of a data set according to the front-end application in the running time.

[0012] Preferably, the service layer grants the service of the unit or the external unit to the role or the user, so that the authentication submodule determines whether the current logged-in user, the role, and the granted service permission in the front-end application have access permission of a service according to the front-end application in the running time.

[0013] Preferably, the service is composed of a service identifier, a service parameter, a service name, and a service address.

[0014] Preferably, the service identifier and the service parameter jointly determine a service instance.

[0015] Preferably, the external unit includes an external unit with authorization and authentication and data hierarchical classification definition and an external unit without authorization and authentication and data hierarchical classification definition.

[0016] Preferably, the external unit without authorization and authentication and data hierarchical classification definition completes authorization and authentication through the authorization and authentication module of the unit, thereby supporting cooperation of cross-unit data service permission control as a whole.

[0017] Preferably, the cooperation system of the cross-unit data service permission control adopts a twice authorization and authentication mode for service authorization and authentication, which includes first authorization and authentication of a service provider and second authorization and authentication of a service invoker.

[0018] In summary, the application at least includes the following beneficial technical effects:

[0019] 1. The application realizes cooperation of cross-unit data service permission control in a scene where construction steps of systems of units are inconsistent. Meanwhile, in order to not increase management cost of authorization links in permission control, the permissions of the unit and the external unit are managed in a same module, and no additional management cost is increased.

[0020] 2. The service provided by the application supports twice authorization, including the first authorization controlled by the service provider and the second authorization controlled by the service invoker. The twice authorization meets the needs of the service provider and the service invoker.

[0021] 3. The application can provide a simple and reliable cooperation for systems in different construction stages, so as to implement the permission control of data service and achieve strict data classification control. The different construction stages refer to that a part of the systems of units have complete authorization modules, and the other part of the systems of units do not have complete authorization modules. When the systems of units need to interconnect, the application can solve the problems caused by the difference. BRIEF DESCRIPTION OF DRAWINGS

[0022] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate the embodiments and, together with the description, serve to explain the principles of the application. Other embodiments and many of the intended advantages of the present application will be readily appreciated as the same becomes better understood by reference to the following detailed description when considered in connection with the accompanying drawings. The elements of the drawings are not necessarily to scale relative to each other. Like reference numerals designate corresponding similar parts.

[0023] Figure 1 is a module schematic diagram of a cross-unit data service permission control cooperation system of the application.

[0024] Figure 2 is a schematic diagram of a specific embodiment of the cross-unit data service permission control cooperation system that can be applied to the application. DETAILED DESCRIPTION

[0025] The application will be further described below in conjunction with the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, but not to limit the application. In addition, it should be noted that only the parts related to the application are shown in the drawings for the convenience of description.

[0026] It should be noted that the embodiments in the application and the features in the embodiments can be combined with each other without conflict. The application will be described in detail below with reference to the drawings and in conjunction with the embodiments.

[0027] Figure 1 shows a module schematic diagram of a cross-unit data service permission control cooperation system of the application, referring to Figure 1 The system specifically includes a data classification module 101, an authorization module 102, a service gateway 103, and a front-end application 104.

[0028] The data hierarchical classification module 101 is used for classifying data sets and data fields by levels and categories.

[0029] The authorization and authentication module 102 includes a data layer and a service layer, and is used for authorizing and authenticating data of the unit and services of the unit or external units.

[0030] The data layer grants the data hierarchical classification defined by the data hierarchical classification module 101 to roles or users, so that the authentication submodule of the hierarchical classification module determines whether the current user in the front-end application 104, i.e., the front-end application 104, has the access right of a certain field of a certain data set according to the role and the granted data hierarchical classification when running. The service layer grants the services of the unit or external units to roles or users, so that the authentication submodule thereof determines whether the current user in the front-end application 104, i.e., the front-end application 104, has the access right of a certain service according to the role and the granted service right when running.

[0031] The service is composed of a service identifier, a service parameter, a service name and a service address. The service identifier and the service parameter jointly determine a service instance.

[0032] The external units include external units with authorization and authentication and data hierarchical classification definition and external units without authorization and authentication and data hierarchical classification definition. The external units without authorization and authentication and data hierarchical classification definition complete authorization and authentication through the authorization and authentication module 102 of the unit, thereby supporting the cooperation of cross-unit data service right control as a whole.

[0033] The service gateway 103 collects all services registered including the unit and the external units, and determines whether the current service caller has the right to call the service and has which right by calling the authentication submodule of the authorization and authentication module 102 in the authentication link of the service.

[0034] The front-end application 104 realizes the interactive operation of the user and the background system by calling the service on the service gateway 103.

[0035] The cross-unit data service right control cooperation system adopts a twice authorization and authentication mode for service authorization and authentication, which includes the first authorization and authentication controlled by the service provider and the second authorization and authentication controlled by the service caller.

[0036] In a specific embodiment, a cross-unit data service right control cooperation system of the present application will be specifically described as follows:

[0037] The operation mechanism is described in detail from four aspects of data hierarchical classification definition module, authorization and authentication module, service gateway and front-end application.

[0038] The data hierarchical classification module is responsible for defining the hierarchical classification of data, i.e. performing detailed level and category division on data sets and data fields, so that subsequent links can perform permission control according to the defined levels and categories. The levels and categories to which each data set and each field belong are refined, thereby constituting the hierarchical classification definition of data.

[0039] Dataset Field Classification Classification Dataset A A01 Primary Class X A02 Secondary Class X A03 Tertiary Class Y Dataset B B01 Quaternary Class Z B02 Quinary Class Z

[0040] The authorization and authentication module performs authorization and authentication at the data and service levels. The data is for the data of the unit, and the service is for the service of the unit or external unit. The key point of the present scheme, i.e. the cooperation of cross-unit data service permission control, is completed through authorization and authentication at the service level.

[0041] At the data level, in the authorization submodule of the authorization and authentication module, the data hierarchical classification defined by the data hierarchical classification module is granted to a role or a user, so that the authentication submodule thereof can determine whether the current logged-in user, role and granted data hierarchical classification in the front-end application have access permission of a certain field of a certain data set.

[0042] Authorized Object Granted Data Classification Granted Data Classification Role A Primary Class X, Class Y Role B Secondary Class X, Class Z User A Tertiary Class Y, Class Z User B Quaternary Class X, Class Y, Class Z

[0043] At the service level, in the authorization submodule of the authorization and authentication module, the service of the unit or external unit is granted to a role

[0044] or a user, so that the authentication submodule thereof can determine whether the current logged-in user, role and granted service permission in the front-end application have access permission of a certain service. The authorized and authenticated service is composed of service identification, service parameter, service name, service address and other elements. The service identification and the service parameter together determine a service instance, rather than only the service identification. That is, the same service can be identified as one or more services according to the service parameter, thereby performing more fine-grained authorization and authentication.

[0045] Authorized Object Granted Service Identity Granted Service Parameter Role A Service A None Role B Service B Target = X User A Service B Target = Y User B Service B Target = Z

[0046] The service gateway is an internal and external service gateway, which collects all services including the services of the unit and external units. In addition to providing regular service registration, management, monitoring, authentication and other functions, the service gateway also calls the authentication submodule of the authorization and authentication module in the service authentication link to determine whether the current service caller has permission to call the service and what permissions the current service caller has.

[0047] The front-end application, i.e., the front-end application, realizes the interactive operation of the user and the background system by calling the service on the service gateway. The service registered in the service gateway can be the unit itself or an external unit. Considering the different construction conditions of the external system, the external unit can have authorization authentication and data hierarchical classification definition, or it can not have it. The service of the external unit without authorization authentication and data hierarchical classification definition can complete authorization authentication in the authorized authentication module of the unit, thereby supporting the cooperation of cross-unit data permission control as a whole. As shown in Figure 1 , the service of the unit C without authorization authentication and data hierarchical classification definition can also complete permission control in unit A when called by unit A.

[0048] In the present scheme, the service provided to the outside supports twice authorization authentication, including the first authorization authentication of the service provider and the second authorization authentication controlled by the service calling party. It meets the self-controllable demand of the service provider and the secondary control demand of the service calling party. As shown in Figure 2 , the service provided by unit B to the outside has completed the second authorization authentication.

[0049] Technical effects and application prospects of the present application:

[0050] During the construction process of the digitization and informatization projects of government departments at all levels and enterprises and institutions, cross-unit data interconnection and intercommunication are inevitable, and permission control of various data must be implemented to provide convenience for data interconnection and intercommunication under the premise of protecting data security.

[0051] The present scheme can provide a simple and reliable cooperation for the systems of various units in different construction stages, thereby implementing permission control of data service and achieving strict hierarchical classification control of data. Different construction stages refer to the fact that the systems of a part of units have complete authorization authentication modules, and the systems of another part of units do not have them. When the systems of these units need to be interconnected and communicated, the present scheme can solve the problems caused by the differences.

[0052] The specific embodiments of the present application are described above, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0053] In the description of the application, it needs to be understood that the terms "upper", "lower", "inner", "outer" and the like indicate the orientation or positional relationship shown in the drawings based on the orientation or positional relationship shown in the drawings, and are only for the purpose of facilitating the description of the application and simplifying the description, and do not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the application. The word 'comprising' does not exclude the existence of elements or steps not listed in the claims. The word 'a' or 'an' in front of an element does not exclude the existence of multiple such elements. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that the combination of these measures cannot be used to improve. Any reference signs in the claims should not be interpreted as limiting the scope.

Claims

1. A collaborative system for cross-unit data service permission control, characterized in that: The system comprises: a data hierarchical classification module for classifying data sets and data fields by level and category; an authorization authentication module comprising a data layer and a service layer, for authorizing and authenticating data of the unit and services of the unit or external units; the service layer grants the services of the unit or external units to roles or users, so that the authentication submodule judges whether the user has the access right of a certain service according to the front-end application, i.e. the current logged-in user, role, and granted service right in the front-end application; a service gateway that collects all services registered including the unit and external units, and determines whether the current service caller has the right to call the service and what rights he has by calling the authentication submodule of the authorization authentication module in the service authentication link; a front-end application that realizes the interactive operation of the user and the background system by calling the services on the service gateway; The cross-unit data service right control collaborative system adopts a two-time authorization authentication mode for service authorization authentication, which comprises the first-time authorization authentication controllable by the service provider and the second-time authorization authentication controlled by the service caller.

2. The collaborative system of cross-unit data service permission control according to claim 1, characterized in that: The data layer grants the data hierarchical classification defined by the data hierarchical classification module to roles or users, so that the authentication submodule of the hierarchical classification module judges whether the user has the access right of a certain field of a certain data set according to the front-end application, i.e. the current logged-in user, role, and granted data hierarchical classification in the front-end application.

3. The cross-unit data service permission control system according to claim 2, wherein: The service is composed of a service identifier, a service parameter, a service name, and a service address.

4. The cross-unit data service permission control system according to claim 3, wherein: The service identifier and the service parameter jointly determine a service instance.

5. The cross-unit data service permission control system according to claim 4, wherein: The external units include external units with authorization authentication and data hierarchical classification definition and external units without authorization authentication and data hierarchical classification definition.

6. The collaborative system of cross-unit data service permission control according to claim 5, characterized in that: The external units without authorization authentication and data hierarchical classification definition complete authorization authentication in the authorization authentication module of the unit, thereby supporting the cross-unit data right control collaboration as a whole.

Images