A data resource cross-domain authorization method for mobile applications

Abstract

The application discloses a kind of data resource cross-domain authorization methods for mobile application, based on the idea of data resource calling microservice, mobile application does not directly access data resource, but API is called, the mode of API calling data resource, hierarchical data resource cross-domain authorization method is proposed.For data resource management party, API authorization to accessible data resource;For mobile application management party, mobile application system authorization to call these API;For the management party of user, user authorization to call application function.This method matches authorization and management responsibility, shares the complexity of management of each party, ensures the authorization of data resource cross-domain supporting mobile application and user, and has complete, more fine-grained access control mechanism.

Description

Technical Field

[0001] A method for cross-domain authorization of data resources for mobile applications. Background Technology

[0002] With the development of mobile information technology, mobile applications have grown rapidly. However, due to the dispersion of data resources across different departments and domains, mobile applications and users can only access limited data and service resources within their respective domains and departments. The integration and sharing of data resources across departments and domains has always been a challenge.

[0003] Existing cross-domain data resource authorization technologies for mobile applications mainly revolve around cross-domain user authentication and authorization policies. The authorized subject is the target domain mobile application or user, and the authorized object is the source domain data resource. The data resource is directly authorized to the mobile application or user. The main processes and steps are as follows:

[0004] Step 1: The target domain mobile application or user initiates a data resource access request to the source domain;

[0005] Step 2: The source domain verifies the identity information of the mobile application or user;

[0006] Step 3: The source domain authorizes the mobile application or user;

[0007] Step 4: The target domain mobile application or user initiates access to the source domain data resources;

[0008] Step 5: The source domain grants access to data resources based on the authorization of the corresponding application or user.

[0009] Since the source and target domains are typically managed by different entities, and mobile applications or users in the target domain are not under the management of the source domain, directly granting access permissions in this situation would not only complicate management and maintenance but also increase the security risks associated with data usage. Furthermore, establishing a user identity consensus authentication mechanism between the two domains would be necessary, which is not feasible for application systems sensitive to user identities in the target domain. Summary of the Invention

[0010] To address the shortcomings of existing technologies, this invention aims to provide a cross-domain authorization method for data resources in mobile applications.

[0011] To achieve the above objectives, the present invention adopts the following technical solution:

[0012] A method for cross-domain authorization of data resources for mobile applications, the specific process of which is as follows:

[0013] I. Establish a unified authorization mechanism with three levels, including authorization for service interface APIs, authorization for mobile application systems, and authorization for mobile application users;

[0014] Authorization of service interfaces (APIs) is the authorization between APIs and data resources. The subject of authorization is the API, and the object of authorization is the data resource. One API can obtain authorization from multiple data resources in multiple domains, and one data resource can be authorized to multiple APIs in multiple domains.

[0015] Authorization for mobile application systems is the authorization between a mobile application system and a service interface API. The subject of authorization is the mobile application system, and the object of authorization is the API. The subject and object of authorization are in the same network domain. A mobile application system can obtain authorization from multiple APIs, and an API can be authorized to multiple mobile application systems.

[0016] User-oriented authorization is the authorization between mobile application users and mobile application systems. The subject of authorization is the mobile application user, including people or devices, and the object of authorization is the application functions of the mobile application system.

[0017] II. After authorization is completed, the process for cross-domain access to data resources is as follows:

[0018] 2.1 A mobile application user initiates an application function call request to the mobile application system;

[0019] 2.2 The mobile application system determines whether the user has authorization to access the application's functions. If authorized, it corresponds to one or more APIs.

[0020] 2.3 The mobile application system initiates an API call request to the API management system;

[0021] 2.4 The API management system determines whether the mobile application system has access authorization for the corresponding API. If authorized, it corresponds to data resources in one or more domains.

[0022] 2.5 The API sends a call request to the management system of the data resources in the corresponding domain;

[0023] 2.6 The data resource management system determines whether the API has access authorization for the data resource. If it is authorized, the corresponding data resource service is executed.

[0024] 2.7 The authorized data resource service will return the execution result to the API;

[0025] 2.8 The authorized API will return the execution result to the mobile application system;

[0026] 2.9 Authorized application functions will return the execution results to the mobile application user.

[0027] Furthermore, in the authorization of service interface APIs, the authorized API is either an interface within the same network domain or an interface across network domains.

[0028] Furthermore, in user-oriented authorization, different users may be authorized to different application functions within the same mobile application system.

[0029] The beneficial effects of this invention are as follows: This method establishes a three-tiered unified authorization mechanism, completing the authorization process from digital resources to users in a progressive, hierarchical manner: cross-domain authorization to APIs, intra-domain authorization to mobile application systems, and finally, user authorization. This invention sequentially authorizes data resources across domains to APIs, then from the API interface to the mobile application system, and finally from the mobile application system to the user. When multiple mobile application systems and users use the same data resources, they only need to call the same authorized API within their own domain, without needing to request authorization from each domain individually.

[0030] This invention is based on the microservice approach to data resource access. Instead of mobile applications directly accessing data resources, they call APIs, which in turn access data resources. This proposes a hierarchical cross-domain authorization method for data resources. For data resource managers, authorization is granted to APIs that can access data resources; for mobile application managers, authorization is granted to mobile application systems that can call these APIs; and for user managers, authorization is granted to users who can call application functions. This method matches authorization with management responsibilities, distributes the management complexity among parties, ensures cross-domain support for mobile application and user authorization, and provides a complete and more granular access control mechanism. Attached Figure Description

[0031] Figure 1 This is a flowchart illustrating the overall process of the method in Embodiment 1 of the present invention.

[0032] Figure 2 This is the overall flowchart of Embodiment 2 of the present invention;

[0033] Figure 3 This is the overall flowchart of Embodiment 3 of the present invention. Detailed Implementation

[0034] The present invention will be further described below with reference to the accompanying drawings. It should be noted that this embodiment is based on the present technical solution and provides detailed implementation methods and specific operation processes, but the protection scope of the present invention is not limited to this embodiment.

[0035] Example 1

[0036] This embodiment provides a method for cross-domain authorization of data resources for mobile applications, such as... Figure 1 As shown, the specific process is as follows:

[0037] I. Establish a unified authorization mechanism with three levels, including authorization for service interface APIs, authorization for mobile application systems, and authorization for mobile application users.

[0038] Authorization for service interface APIs (i.e.) Figure 1 The authorization shown in section 1) is an authorization between an API and a data resource. The subject of the authorization is the API, and the object of the authorization is the data resource. The API can be an interface within the same domain or an interface across domains. An API may need to obtain authorization from multiple data resources in multiple domains, and a data resource may be authorized to multiple APIs in multiple domains. Through this level of authorization, the service capabilities of the data resource are provided to APIs in different domains.

[0039] Authorization for mobile application systems (i.e.) Figure 1 The authorization shown in 2) is the authorization between the mobile application system and the service interface API. The subject of the authorization is the mobile application system, and the object of the authorization is the API. The authorizing subject and the authorized object are usually in the same network domain. A mobile application system may need to obtain authorization from multiple APIs, and an API may need to be authorized to multiple mobile application systems. Through this level of authorization, the service capabilities of the API, that is, the data resource, are transformed into the functions of the mobile application system.

[0040] User-oriented authorization (i.e.) Figure 1 The authorization shown in 3) is the authorization between the mobile application user and the mobile application system. The subject of the authorization is the mobile application user, including people or devices, and the object of the authorization is the application functions of the mobile application system. Different users may be authorized with different application functions within the same mobile application system. Through this level of authorization, the application functions of the mobile application system, that is, the service capabilities of data resources, are provided to different people or devices in a fine-grained and differentiated manner.

[0041] II. After authorization is completed, the process for cross-domain access to data resources is as follows:

[0042] 2.1 A mobile application user initiates an application function call request to the mobile application system;

[0043] 2.2 The mobile application system determines whether the user has authorization to access the application's functions. If authorized, it corresponds to one or more APIs.

[0044] 2.3 The mobile application system initiates an API call request to the API management system;

[0045] 2.4 The API management system determines whether the mobile application system has access authorization for the corresponding API. If authorized, it corresponds to data resources in one or more domains.

[0046] 2.5 The API sends a call request to the management system of the data resources in the corresponding domain;

[0047] 2.6 The data resource management system determines whether the API has access authorization for the data resource. If it is authorized, the corresponding data resource service is executed.

[0048] 2.7 The authorized data resource service will return the execution result to the API;

[0049] 2.8 The authorized API will return the execution result to the mobile application system;

[0050] 2.9 Authorized application functions will return the execution results to the mobile application user.

[0051] Example 2

[0052] This embodiment provides an application example of the method described in Embodiment 1.

[0053] This embodiment uses the authorization of data resources to a standard query app as an example. There are publicly available standard data resources in the internet domain, and unavailable standard and guidance document data resources in the work domain. Each domain has its own data resource management system. The standard query app is deployed in the mobile application domain, and its API is uniformly managed through a data service bus. For example... Figure 2 As shown, in this embodiment, the three levels of authorization are:

[0054] Authorization of Service Interface APIs: The data resource management systems of the Internet domain and the work domain authorize the data resources of public standards, unpublished standards, and guidance documents to the three APIs of the mobile application domain, respectively. The authorized entities are the three APIs for public standard retrieval, unpublished standard retrieval, and guidance document retrieval, and the authorized objects are the data resources of public standards, unpublished standards, and guidance documents.

[0055] Application-oriented authorization: The mobile application domain's data service bus authorizes standard query apps to call three APIs. The authorization subject is the standard query app, and the authorization objects are the three APIs: public standard retrieval, non-public standard retrieval, and guidance document retrieval.

[0056] User-oriented authorization: The standard query app authorizes users to access its functions. The authorizing entity is the individual user, and the authorized object is the standard query function. Regular users are only authorized to access the publicly available standard search function, while advanced users are authorized to access three functions: publicly available standard search, unpublished standard search, and guidance document search.

[0057] Taking unpublished standard retrieval as an example, the process for cross-domain authorized access to mobile application data resources is as follows:

[0058] ① Regular or advanced users initiate a standard search request to the standard query app;

[0059] ② The standard query app determines user authorization. For ordinary users without authorization, the request is rejected and returned to the ordinary user, ending the process. For authorized advanced users, the app is matched with an unpublished standard search API and the subsequent process is executed.

[0060] ③ The standard query app initiates a request to the data service bus to call an unpublished standard retrieval API;

[0061] ④ The data service bus judgment standard query APP has authorization for unpublished standard retrieval APIs, corresponding to work network domain data resources;

[0062] ⑤ The unpublished standard retrieval API initiates a request for unpublished standard call service to the work domain data resource management system;

[0063] ⑥ The data resource management system determines that the API is authorized and executes the service call;

[0064] ⑦ Unsubstantiated standard search results are returned to the API;

[0065] ⑧The API will return the search results to the mobile application system;

[0066] ⑨ The mobile application system returns the search results to the advanced user who initiated the request.

[0067] In this embodiment, data resources from the Internet domain and the work domain are shared across domains to a standard query APP in the mobile application domain. This APP can perform differentiated, fine-grained access control on the functions and data resources called by users.

[0068] Example 3

[0069] This embodiment uses the authorization of data resources to a mobile assistant app as an example. There are cloud-based data resources in the cloud computing domain and front-end data resources in the edge computing domain; each domain has its own data resource management system. The mobile assistant app is deployed in the edge computing domain, and its APIs are uniformly managed through a data service bus. For example... Figure 3 As shown, in this embodiment, the three levels of authorization are:

[0070] Authorization of Service Interface APIs: The data resource management system of the cloud computing domain authorizes cloud data resources to the cloud data API of the edge computing domain across domains, and the data resource management system of the edge computing domain authorizes front-end data resources to the front-end data API of its own domain. The authorizing entities are the cloud data API and the front-end data API, and the authorized objects are the cloud and front-end data resources of the two domains, respectively.

[0071] Application-oriented licensing: The data service bus of the edge computing network licenses two APIs to the mobile assistant app for use. The licensing entity is the mobile assistant app, and the licensing objects are the cloud data API and the front-end data API.

[0072] User-facing authorization: The mobile assistant app authorizes users to use its functions. The authorizing entity is the user, and the authorized objects are basic query and in-depth analysis functions. Users selectively invoke in-depth analysis functions based on the results of the basic query.

[0073] Taking the sequential execution of basic query and deep analysis functions as an example, the mobile application data resource authorization access process is as follows:

[0074] ① The user initiates a basic query request to the mobile assistant app;

[0075] ② The mobile assistant app determines that the user has authorization and corresponds to the front-end data API;

[0076] ③ The mobile assistant app initiates a front-end data API call request to the data service bus;

[0077] ④ The data service bus determines that the mobile assistant APP has authorization for the front-end data API, which corresponds to the front-end data resources in this network domain;

[0078] ⑤ The front-end data API initiates a service call request to the local domain data resource management system;

[0079] ⑥ The domain data resource management system determines that the API is authorized and executes the service call;

[0080] ⑦ The results of the pre-processing data execution are returned to the pre-processing data API;

[0081] ⑧ The front-end data API returns the result to the mobile application system;

[0082] 9. The mobile application system returns the result to the user;

[0083] ⑩ If a user believes that further analysis is needed after viewing the results, they may send a deep analysis request to the mobile assistant app.

[0084] The mobile assistant app determines that the user has authorized access and then links it to the cloud data API.

[0085] The mobile assistant app initiates a cloud data API call request to the data service bus; The data service bus determines that the mobile assistant APP has cloud data API authorization, corresponding to cloud data resources in the cloud computing domain;

[0086] The cloud data API initiates a service call request to the cloud computing domain data resource management system across domains.

[0087] The cloud computing domain data resource management system determines that the API is authorized and executes the service call.

[0088] The execution result of the cloud data is returned to the cloud data API;

[0089] The cloud data API returns the result to the mobile application system;

[0090] The mobile application system returns the result to the user who initiated the request.

[0091] In this embodiment, edge-cloud sharing and mutual assistance of mobile assistant APP data resources are realized between the cloud computing domain and the edge computing domain.

[0092] For those skilled in the art, various corresponding changes and modifications can be made based on the above technical solutions and concepts, and all such changes and modifications should be included within the protection scope of the claims of this invention.

Claims

1. A method for cross-domain authorization of data resources for mobile applications, characterized in that, The specific process is as follows: I. Establish a unified authorization mechanism with three levels, including authorization for service interface APIs, authorization for mobile application systems, and authorization for mobile application users; Authorization for service interfaces (APIs) is the authorization between the API and data resources. The subject of authorization is the API, and the object of authorization is the data resources. One API can obtain authorization for multiple data resources from multiple domains, and one data resource can be authorized to multiple APIs from multiple domains; Authorization for mobile application systems is the authorization between a mobile application system and a service interface API. The subject of authorization is the mobile application system, and the object of authorization is the API. The subject and object of authorization are in the same network domain. A mobile application system can obtain authorization from multiple APIs, and an API can be authorized to multiple mobile application systems. User-oriented authorization is the authorization between mobile application users and mobile application systems. The subject of authorization is the mobile application user, including people or devices, and the object of authorization is the application functions of the mobile application system. II. After authorization is completed, the process for cross-domain access to data resources is as follows: 2.1 A mobile application user initiates an application function call request to the mobile application system; 2.2 The mobile application system determines whether the user has authorization to access the application's functions. If authorized, it corresponds to one or more APIs. 2.3 The mobile application system initiates an API call request to the API management system; 2.4 The API management system determines whether the mobile application system has access authorization for the corresponding API. If authorized, it corresponds to data resources in one or more domains. 2.5 The mobile application system initiates a call request to the data resource management system of the corresponding network domain through the API; 2.6 The data resource management system determines whether the API has access authorization for the data resource. If it is authorized, the corresponding data resource service is executed. 2.7 The authorized data resource service will return the execution results to the mobile application system through the authorized API; 2.8 Authorized application functions will return the execution results to the mobile application user.

2. The method according to claim 1, characterized in that, In the authorization of service interface APIs, the authorized API can be an interface within the same network domain or an interface across network domains.

3. The method according to claim 1, characterized in that, In user-facing authorization, different users may be authorized to different application functions within the same mobile application system.

Images