Gateway-based interface authentication method and device

Abstract

The application provides a gateway-based interface authentication method and device. It relates to the technical field of computers. The method comprises receiving an access request sent by a user terminal; obtaining request interface resource information, the identification of a target bank institution and the identification of a target user by parsing the access request; determining, based on the pre-determined role resource configuration of the user, the reporting module to which the user has access rights and the bank institution of the reporting module, that the target user has the right to access the target bank institution through the target reporting module, and that the request interface resource information matches the role resource configuration corresponding to the target user, and sending the access request to the target reporting module. This can comprehensively authenticate and manage interfaces based on a gateway, thereby reducing the workload and improving the security of data.

Description

Technical Field

[0001] This application relates to the field of computers, and more specifically, to a gateway-based interface authentication method and apparatus. Background Technology

[0002] Broken Access Control (BAC) is a common vulnerability in web applications. Due to its wide presence and significant harm, it is ranked second among the top ten security vulnerabilities in web applications by OWASP.

[0003] This vulnerability refers to a flaw in the application's authorization checks, allowing attackers to bypass permission checks after gaining low-privilege user accounts, and access or manipulate other users or those with higher privileges. Privilege escalation vulnerabilities primarily arise because developers overly rely on client requests when performing CRUD operations (Create, Read, Update, Query), neglecting to verify permissions. In actual code audits, this type of vulnerability is often difficult to detect automatically using tools, thus posing a significant threat in real-world applications. It differs from unauthorized access; currently, there are two types of privilege escalation: horizontal privilege escalation and vertical privilege escalation.

[0004] Horizontal privilege escalation: refers to different users with the same permissions accessing each other's devices.

[0005] Vertical privilege escalation refers to a situation where a user with lower privileges can access the privileges of a user with higher privileges.

[0006] Horizontal privilege escalation testing method: mainly to see if user A's actions can affect user B.

[0007] Vertical privilege escalation testing approach: See if a user with lower privileges can use functions that a user with higher privileges can not. Summary of the Invention

[0008] The purpose of this application is to provide a gateway-based interface authentication method and apparatus to alleviate the technical problem of high possibility of unauthorized access in the prior art.

[0009] In a first aspect, the present invention provides a gateway-based interface authentication method, the method comprising:

[0010] Receive access requests sent by user terminals;

[0011] The access request is parsed to obtain the requested interface resource information, the identifier of the target banking institution, and the identifier of the target user;

[0012] Based on the pre-determined user role resource configuration, the reporting module with which the user has permissions, and the bank institution of the reporting module, when the target user has the permission to access the target bank institution through the target reporting module, and the request interface resource information matches the role resource configuration corresponding to the target user, the access request is sent to the target reporting module.

[0013] In an optional implementation, the same user is configured with one or more roles, and the same role is configured with one or more resources;

[0014] Each resource corresponds to one or more of the following resource information: resource ID, operation ID, operation name, operation URL, request type, and number of dynamic parameters.

[0015] In an optional implementation, the same user may configure one or more reporting modules;

[0016] Only one banking institution can be configured for the same reporting module under the same user.

[0017] In an optional implementation, the banking institution includes a head office, branches, and sub-branches; wherein there is a hierarchical relationship between the head office, branches, and sub-branches;

[0018] When a user has permission to operate the head office, they also have permission to access the corresponding branches and sub-branches of that head office.

[0019] When a user has permission to access a branch from the head office, they also have permission to access the sub-branches corresponding to that branch.

[0020] In an optional implementation, the access request includes a request URL, request parameters, a request body, and user information carried in the request header;

[0021] The access request is parsed to obtain the requested interface resource information, the identifier of the target banking institution, and the identifier of the target user, including:

[0022] Based on the user information carried in the request header, the identifier of the target user is determined, and based on the identifier of the target user, the role resource configuration of the target user, the reporting module that the target user has permission to access, and the banking institution of the reporting module are determined.

[0023] The target reporting module is determined based on the requested URL;

[0024] The identifier of the target banking institution is determined based on the request parameters or the request body;

[0025] Based on determining whether the target user has permission to access the target bank institution through the target reporting module, and whether the target reporting module exists in the reporting module's banking institution, and the target reporting module's target banking institution, it is determined whether the target user has permission to access the target banking institution through the target reporting module.

[0026] When the target user has permission to access the target banking institution through the target reporting module,

[0027] Based on the request URL, the request interface resource information is determined, and the request interface resource information is matched against the role resource configuration of the target user.

[0028] In an optional implementation, determining the identifier of the target bank institution based on the request parameters or the request body includes: determining whether the request parameters contain an identifier of the target bank institution;

[0029] If the identifier of the target bank institution is not present in the request parameters, then it is determined whether the identifier of the target bank institution exists in the request body.

[0030] In an optional implementation, it further includes:

[0031] If the identifier of the target bank is not obtained, determine the whitelist URL of the target user;

[0032] The legitimacy of the access request is determined based on the whitelisted URLs.

[0033] Secondly, the present invention provides a gateway-based interface authentication device, the device comprising:

[0034] The receiving module is used to receive access requests sent by user terminals;

[0035] The parsing module is used to parse the access request to obtain the requested interface resource information, the identifier of the target banking institution, and the identifier of the target user;

[0036] The sending module is used to determine the target reporting module based on the pre-determined user role resource configuration, the reporting module with which the user has permissions, and the banking institution of the reporting module. When the target user has the permission to access the target banking institution through the target reporting module, and the request interface resource information matches the role resource configuration corresponding to the target user, the access request is sent to the target reporting module.

[0037] In an optional implementation, the same user is configured with one or more roles, and the same role is configured with one or more resources;

[0038] Each resource corresponds to one or more of the following resource information: resource ID, operation ID, operation name, operation URL, request type, and number of dynamic parameters.

[0039] In an optional implementation, the same user may configure one or more reporting modules;

[0040] Only one banking institution can be configured for the same reporting module under the same user.

[0041] In an optional implementation, the banking institution includes a head office, branches, and sub-branches; wherein there is a hierarchical relationship between the head office, branches, and sub-branches;

[0042] When a user has permission to operate the head office, they also have permission to access the corresponding branches and sub-branches of that head office.

[0043] When a user has permission to access a branch from the head office, they also have permission to access the sub-branches corresponding to that branch.

[0044] In an optional implementation, the access request includes a request URL, request parameters, a request body, and user information carried in the request header;

[0045] The parsing module specifically includes:

[0046] The first determining module is used to determine the identifier of the target user based on the user information carried in the request header, and to determine the target user's role resource configuration, the reporting module with which the target user has the authority, and the banking institution of the reporting module based on the target user's identifier.

[0047] The second determining module determines the target reporting module based on the request URL;

[0048] The third determining module determines the identifier of the target banking institution based on the request parameters or the request body;

[0049] The judgment module is used to determine whether the target user has permission to access the target bank institution through the target reporting module based on whether the target reporting module exists among the reporting modules that the target user has permission to access and the bank institution to which the reporting module belongs, and the target bank institution of the target reporting module.

[0050] The matching module is used to determine the request interface resource information based on the request URL when the target user has the permission to access the target banking institution through the target reporting module, and to match the request interface resource information with the role resource configuration of the target user.

[0051] In an optional implementation, the third determining module is specifically used for:

[0052] Determine whether the request parameters contain an identifier for the target banking institution;

[0053] If the identifier of the target bank institution is not present in the request parameters, then it is determined whether the identifier of the target bank institution exists in the request body.

[0054] In an optional implementation, it further includes a whitelist module, used to determine the whitelist URL of the target user if the identifier of the target banking institution is not obtained; and to determine whether the access request is legitimate based on the whitelist URL.

[0055] Thirdly, the present invention provides an electronic device, the electronic device comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory are connected via communication...

[0056] The bus enables communication between the components;

[0057] Memory, used to store computer programs;

[0058] When a processor executes a program stored in memory, it implements the steps of the method described in any of the foregoing embodiments.

[0059] Fourthly, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium...

[0060] The storage medium stores a computer program, which, when executed by a processor, implements the steps of any of the methods described in the foregoing embodiments.

[0061] This application provides an interface authentication method and apparatus based on a gateway. By receiving...

[0062] The user terminal sends an access request; the access request is parsed to obtain the requested interface resource information, the identifier of the target bank institution, and the identifier of the target user; based on the pre-determined user role resources...

[0063] The configuration, user-authorized reporting modules, and bank institutions associated with the reporting modules are determined. When the target user has the authority to access the target bank institution through the target reporting module, and the request interface resource information matches the role resource configuration corresponding to the target user, the access request is sent.

[0064] The data is sent to the target reporting module. This enables comprehensive authentication and management of the interface based on the gateway, reducing workload while improving data security. Attached Figure Description

[0065] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0066] Figure 1 A schematic diagram illustrating the configuration of a gateway-based interface authentication method provided in an embodiment of this application;

[0067] Figure 2 A schematic diagram of a gateway-based interface authentication method provided in an embodiment of this application;

[0068] Figure 3 A schematic diagram of the architecture of a gateway-based interface authentication method provided in an embodiment of this application;

[0069] Figure 4 Another configuration diagram of a gateway-based interface authentication method provided in this application embodiment;

[0070] Figure 5 Another configuration diagram of a gateway-based interface authentication method provided in this application embodiment;

[0071] Figure 6 Another configuration diagram of a gateway-based interface authentication method provided in this application embodiment;

[0072] Figure 7 A schematic diagram of another gateway-based interface authentication method provided in this application embodiment;

[0073] Figure 8 A schematic diagram of a gateway-based interface authentication device provided in an embodiment of this application;

[0074] Figure 9 This is a schematic diagram of an electronic device structure provided in an embodiment of this application. Detailed Implementation

[0075] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0076] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0077] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0078] The following detailed description of some embodiments of the present invention is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0079] Combination such as Figure 1 The intelligent regulatory reporting system shown currently has an authentication system that can be divided into two main parts:

[0080] Part 1: Users-Role-Resources

[0081] A single user can be configured with multiple roles, and a single role can be configured with multiple resources. Resources can be a page, a menu, or a button.

[0082] For example, the handler role in Reporting Module A can operate the "Add Message" and "Modify Message" buttons, while the reviewer role can operate the "Approve Review" and "Reject Review" buttons. User Xiaoming is both the handler and the reviewer of Reporting Module A. Therefore, he can access the handler page of Reporting Module A and operate the "Add Message" and "Modify Message" buttons; he can also access the review page and operate the "Approve Review" and "Reject Review" buttons, but he cannot operate the corresponding "Delete Message" buttons because the corresponding role-resource permissions are not configured.

[0083] Part Two, User-Reporting Module-Banking Institutions:

[0084] A single user can configure multiple reporting modules, and for the current user, the same reporting module can only be configured with one bank institution.

[0085] For example, if user Xiaoming is responsible for handling the reporting work of branch a in reporting module A, reviewing the reporting work of branch b in reporting module B, and confirming the reporting of branch a in reporting module C, then Xiaoming can manipulate the data of branch a in reporting module A, branch b in reporting module B, and branch Ca in reporting module C. However, he cannot manipulate data other than those in the above three reporting modules - bank institutions. For example, he cannot manipulate the data of branch a in reporting module A, nor can he manipulate the data of branch b in reporting module C.

[0086] from Figure 2 It is evident that both horizontal and vertical privilege escalation are theoretically effectively protected. In practice, although the intelligent supervision and reporting system implements access control according to this scheme, manifesting as access control on the front-end page (e.g., whether a user has permission to see a menu, page, or button), and also performs some authentication at the interface level, the security issue of unauthorized access still exists.

[0087] Not all request interfaces are authenticated, and the authentication level is inconsistent. This can easily lead to omissions in later iterations and development, resulting in high maintenance costs.

[0088] If an unauthorized person has access to the functional URL interface, they can use third-party tools (such as Postman) to simulate an unauthorized URL to perform business operations.

[0089] For example: User Xiaoming is responsible for handling the processing of branch a in reporting module A and reviewing the processing of branch b in reporting module B, but not for reviewing the processing of branch b in reporting module C. Xiaoming deduced the request URL of the review function of branch b in reporting module C from the request URL of the review function of branch b in reporting module B, and simulated the call using Postman, thus committing unauthorized behavior.

[0090] Given the above examples, interface authentication becomes essential. This necessitates authentication for each business logic interface, which is clearly inefficient and extremely complex to maintain. For instance, if there are 100 business logic interfaces (handling, reviewing, confirming submission, etc.) in Reporting Module A and Reporting Module B, each interface requires either writing code or calling the authentication interface. Furthermore, if performance optimizations or logic iterations are needed later, all 100 business logic interfaces will require corresponding adjustments, resulting in significant time and manpower costs. Therefore, a unified entry point for dedicated interface authentication is crucial to address the issue of unauthorized access. Based on this, this application also provides a gateway-based interface authentication method and apparatus to solve this problem.

[0091] Figure 2 This is a flowchart illustrating a gateway-based interface authentication method provided in an embodiment of this application. This method is applied to, for example... Figure 3 The gateway shown is the gateway to which all user requests must pass. The gateway interceptor intercepts the requests and performs interface authentication. If the interface authentication is successful, the request is forwarded to the corresponding reporting module for business logic processing; if the interface authentication fails, the user request is rejected, and an access denied message is displayed.

[0092] like Figure 2 As shown, the method may include the following steps:

[0093] S210, receives an access request sent by a user terminal;

[0094] S220: Parse the access request to obtain the requested interface resource information, the identifier of the target bank institution, and the identifier of the target user.

[0095] Among them, the same user is configured with one or more roles, and the same role is configured with one or more resources; each resource corresponds to one or more of the following resource information: resource ID, operation ID, operation name, operation URL, request type, and number of dynamic parameters.

[0096] A single user can configure one or more reporting modules; however, the same reporting module under the same user can only be configured with one banking institution.

[0097] A banking institution includes a head office, branches, and sub-branches; there are hierarchical relationships among the head office, branches, and sub-branches; when a user has the authority to access the head office, they also have the authority to access the corresponding branches and sub-branches; when a user has the authority to access a branch, they also have the authority to access the corresponding sub-branches.

[0098] As an example, an access request includes the request URL, request parameters, request body, and user information carried in the request header;

[0099] The system can identify the target user based on the user information carried in the request header, determine the target user's role and resource configuration, the reporting modules the target user has permissions to, and the banking institutions to which those reporting modules belong, based on the target user's identifier; determine the target reporting module based on the request URL; determine the target banking institution's identifier based on the request parameters or request body; and determine whether the target reporting module exists among the reporting modules and banking institutions to which the target user has permissions, and the target banking institution of the target reporting module, to determine whether the target user has permission to access the target banking institution through the target reporting module; if the target user does not have permission to access the target banking institution through the target reporting module, the user request is rejected, and an access denied message is displayed.

[0100] When a target user has permission to access the target bank through the target reporting module, the request interface resource information is determined based on the request URL, and the request interface resource information is matched against the target user's role resource configuration; if the match fails, the user request is rejected and an error message is displayed indicating that the user does not have permission to access.

[0101] First, determine whether the request parameters contain the identifier of the target bank institution; if the request parameters do not contain the identifier of the target bank institution, then determine whether the request body contains the identifier of the target bank institution.

[0102] S230: Based on the pre-determined user role resource configuration, the reporting module with which the user has permissions, and the bank institution of the reporting module, when the target user has the permission to access the target bank institution through the target reporting module, and the requested interface resource information matches the role resource configuration corresponding to the target user, the access request is sent to the target reporting module.

[0103] In some embodiments, if the identifier of the target banking institution is not obtained, the whitelist URL of the target user is determined; and the legitimacy of the access request is determined based on the whitelist URL.

[0104] In some embodiments, combined with Figures 4-7 As shown.

[0105] You can configure the accessible request URLs for resources under a user's corresponding role.

[0106] For example, the configuration result is as follows Figure 4 As shown, users have the right to access the add, select, review, and report submission interfaces of reporting module A, as well as the select, report submission, and statistics interfaces of reporting module B.

[0107] The request URL interface configuration (resource) can be composed of the following six dimensions:

[0108] 1. Resource ID: Locate the ID information of the specified resource (page, menu, button, etc.), establish the association between the resource and the requested interface, and allow the requested interface to be accessed under this resource.

[0109] 2. Operation ID: This refers to the unique identifier of the request interface under the current resource ID. Examples include update, visit, delete, push, review, return, export, pushAgain, view, store, etc.

[0110] 3. Operation Name: This refers to assigning a name to the operation ID for easy understanding. Examples include: Modify, Menu Access, Delete, Submit, Review, Return Modification, Export, Resubmit, View (Details), Add.

[0111] 4. Operation URL: refers to the address information of the URL interface to be requested.

[0112] The operation URL can include various rules, such as:

[0113] Rule 1: Starts with / , but does not end with / ;

[0114] Rule 2: If the URL is static, write the full path and start with the gateway route prefix of the reporting module. The number of parameters does not need to be filled in.

[0115] Rule 3: If the URL is a dynamic URL, then the other fixed path should begin with the gateway route prefix of the reporting module. The number of dynamic parameters is required. For example: if the request path is / A / update / {yyyy-MM-dd} / {id}, and there are two dynamic parameters, yyyy-MM-dd and id, then the operation URL is: / A / update, and the number of dynamic parameters is: 2.

[0116] 5. Request Type: This refers to the request type of the interface, with four options: GET / POST / DELETE / PUT. We typically define them as follows: View Details - GET, Delete - DELETE, Update - PUT, Add - POST.

[0117] 6. Number of dynamic parameters: The number of dynamic parameters in the URL address of the dynamic operation URL.

[0118] Interface configuration example as follows Figure 5 As shown.

[0119] You can also configure the bank institution to which the user's reporting module belongs.

[0120] As shown in the figure, Figure 6 The configuration shown indicates that the user belongs to branch a of reporting module A and branch b of reporting module B. Due to the nature of banking operations, institutions have hierarchical relationships; for example, the head office can manipulate data from branches and sub-branches, branches can manipulate sub-branches' data, and sub-branches can only manipulate their own data. Based on the above configuration, the user has the right to manipulate data from branch a of reporting module A and its subordinate institutions, and also has the right to manipulate data from branch b of reporting module B and its subordinate institutions.

[0121] It can perform interface authentication for all user requests. Combined with... Figure 7 As shown, the specific interface authentication steps in the gateway are as follows:

[0122] Step 1) Parse the corresponding reporting module identifier in the URL. If parsing fails, the request is rejected with an "Access denied" message; if parsing succeeds, proceed to the next step.

[0123] Step 2) Obtain the organization code (org) from the input parameters in the request URL, the request body, or the required parameter. If none of these are present, parse the token1 from the request header of the URL. If the org parameter is missing or empty, determine if it is a whitelisted URL for user login, etc. If so, allow interface authentication; otherwise, indicate unauthorized access. If it exists, proceed to the next step.

[0124] The request header token of the URL is an encrypted string, typically used to store basic information about the logged-in user, such as username, nickname, email address, and profile picture. In this embodiment, the request header token stores the organizational information of the module to which the user belongs, which can be obtained through a decryption algorithm.

[0125] Step 3) Determine if the current user has configured the corresponding reporting module and its affiliated bank. If the corresponding reporting module and its affiliated bank are not configured, indicate that access is denied; otherwise, proceed to the next step.

[0126] Step 4) Determine whether the org organization code in the current request is the bank organization code and its subordinate organization codes of the current user's corresponding reporting module. If not, indicate that access is denied; otherwise, proceed to the next step.

[0127] Step 5) Based on the current URL's address information, request type, and number of dynamic parameters, determine whether it has been configured in the resource request interface corresponding to the current user's role. If not configured, display an "Access Denied" message; otherwise, authentication passes, and the request is forwarded to the corresponding reporting module service.

[0128] This application embodiment uses a gateway interceptor for unified interface authentication, avoiding the risk of authentication omissions or logical errors that might have existed in the original reporting modules. It unifies the authentication dimensions and verification logic, significantly reducing the manpower and time costs required for subsequent authentication logic iterations and adjustments. By implementing interface authentication in real-time through configuration of users, roles, resources, request interfaces, reporting modules, and affiliated organizations, it effectively addresses the security vulnerability of unauthorized data manipulation, further enhancing the system's security and robustness.

[0129] Figure 8 This is a schematic diagram of a gateway-based interface authentication device provided in an embodiment of this application. Figure 8 As shown, the device includes:

[0130] The receiving module 801 is used to receive access requests sent by user terminals;

[0131] The parsing module 802 is used to parse the access request to obtain the requested interface resource information, the identifier of the target bank institution, and the identifier of the target user;

[0132] The sending module 803 is used to determine the target reporting module based on the pre-determined user role resource configuration, the reporting module with which the user has permissions, and the banking institution of the reporting module. When the target user has the permission to access the target banking institution through the target reporting module, and the request interface resource information matches the role resource configuration corresponding to the target user, the access request is sent to the target reporting module.

[0133] In some embodiments, a single user may be configured with one or more roles, and a single role may be configured with one or more resources;

[0134] Each resource corresponds to one or more of the following resource information: resource ID, operation ID, operation name, operation URL, request type, and number of dynamic parameters.

[0135] In some embodiments, the same user configures one or more reporting modules;

[0136] Only one banking institution can be configured for the same reporting module under the same user.

[0137] In some embodiments, a banking institution includes a head office, branches, and sub-branches; wherein there is a hierarchical relationship between the head office, branches, and sub-branches;

[0138] 0 When a user has permission to operate the head office, they also have permission to access the corresponding branches and sub-branches of that head office.

[0139] When a user has permission to access a branch from the head office, they also have permission to access the sub-branches corresponding to that branch.

[0140] In some embodiments, the access request includes a request URL, request parameters, a request body, and user information carried in the request header;

[0141] The parsing module specifically includes:

[0142] The first determination module is used to determine the identifier of the target user based on the user information carried in the request header, and to determine the target user's role and resource configuration and permissions based on the target user's identifier.

[0143] The reporting module and the banking institutions that submit the reporting module;

[0144] 0. The second determination module determines the target reporting module based on the request URL;

[0145] The third determination module determines the identifier of the target banking institution based on the request parameters or the request body;

[0146] The judgment module is used to determine whether the target user has the permission to access the target bank through the target reporting module based on whether the target reporting module exists in the reporting module and the bank institution of the reporting module, and the target bank institution of the target reporting module.

[0147] The matching module is used to determine the request interface resource information based on the request URL when the target user has the permission to access the target banking institution through the target reporting module, and to match the request interface resource information with the target user's role resource configuration.

[0148] In some embodiments, the third determining module is specifically used for:

[0149] Determine if the request parameters contain an identifier for the target bank institution;

[0150] If the identifier of the target bank is not present in the request parameters, then determine whether the identifier of the target bank is present in the request body.

[0151] In some embodiments, the whitelist module is used to determine the whitelist URL of the target user if the identifier of the target banking institution is not obtained; and to determine whether the access request is legitimate based on the whitelist URL.

[0152] This application also provides an electronic device, such as... Figure 9 As shown, it includes a processor 910, a communication interface 920, a memory 930, and a communication bus 940, wherein the processor 910, the communication interface 920, and the memory 930 communicate with each other through the communication bus 940.

[0153] Memory 930 is used to store computer programs;

[0154] When the processor 910 executes the program stored in the memory 930, it implements the steps described in any of the above method embodiments.

[0155] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0156] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0157] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0158] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0159] The implementation methods and beneficial effects of the various components of the electronic device in the above embodiments for solving the problem can be found in [reference needed]. Figure 2 The steps in the illustrated embodiments are used to implement the electronic device. Therefore, the specific working process and beneficial effects of the electronic device provided in this application will not be repeated here.

[0160] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores instructions that, when executed on a computer, cause the computer to perform any of the gateway-based interface authentication methods described in the above embodiments.

[0161] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the gateway-based interface authentication methods in the above embodiments.

[0162] Those skilled in the art will understand that the embodiments in this application can be provided as methods, systems, or computer program products. Therefore, the embodiments in this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, the embodiments in this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0163] This application describes embodiments of methods, apparatus (systems), and computer program products according to embodiments of this application with reference to flowchart illustrations and / or block diagrams. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0164] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0165] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0166] Although preferred embodiments have been described in this application, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of this application.

[0167] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of the embodiments of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims in this application and their equivalents, then this application also intends to include these modifications and variations.

Claims

1. A gateway-based interface authentication method, characterized in that, The method includes: Receive access requests sent by user terminals; The access request is parsed to obtain the requested interface resource information, the identifier of the target banking institution, and the identifier of the target user; Based on the pre-determined user role resource configuration, the reporting module with which the user has permissions, and the bank institution of the reporting module, when the target user has the permission to access the target bank institution through the target reporting module, and the request interface resource information matches the role resource configuration corresponding to the target user, the access request is sent to the target reporting module. Among them, the same user is configured with one or more roles, and the same role is configured with one or more resources; Each resource corresponds to one or more of the following resource information: resource ID, operation ID, operation name, operation URL, request type, and number of dynamic parameters.

2. The method according to claim 1, characterized in that, A single user can configure one or more reporting modules; Only one banking institution can be configured for the same reporting module under the same user.

3. The method according to claim 2, characterized in that, Banking institutions include head offices, branches, and sub-branches; among them, there are hierarchical relationships between head offices, branches, and sub-branches. When a user has permission to operate the head office, they also have permission to access the corresponding branches and sub-branches of that head office. When a user has permission to access a branch from the head office, they also have permission to access the sub-branches corresponding to that branch.

4. The method according to claim 1, characterized in that, The access request includes the request URL, request parameters, request body, and user information carried in the request header; The access request is parsed to obtain the requested interface resource information, the identifier of the target banking institution, and the identifier of the target user, including: Based on the user information carried in the request header, the identifier of the target user is determined, and based on the identifier of the target user, the role resource configuration of the target user, the reporting module that the target user has permission to access, and the banking institution of the reporting module are determined. The target reporting module is determined based on the requested URL; The identifier of the target banking institution is determined based on the request parameters or the request body; Based on determining whether the target user has permission to access the target bank institution through the target reporting module, and whether the target reporting module exists in the reporting module's banking institution, and the target reporting module's target banking institution, it is determined whether the target user has permission to access the target banking institution through the target reporting module. When the target user has permission to access the target banking institution through the target reporting module, the request interface resource information is determined based on the request URL, and the request interface resource information is matched with the target user's role resource configuration.

5. The method according to claim 4, characterized in that, The step of determining the identifier of the target banking institution based on the request parameters or the request body includes: Determine whether the request parameters contain an identifier for the target banking institution; If the identifier of the target bank institution is not present in the request parameters, then it is determined whether the identifier of the target bank institution exists in the request body.

6. The method according to claim 4, characterized in that, Also includes: If the identifier of the target bank is not obtained, determine the whitelist URL of the target user; The legitimacy of the access request is determined based on the whitelisted URLs.

7. A gateway-based interface authentication device, characterized in that, The device includes: The receiving module is used to receive access requests sent by user terminals; The parsing module is used to parse the access request to obtain the requested interface resource information, the identifier of the target banking institution, and the identifier of the target user; The sending module is used to determine the target reporting module based on the pre-determined user role resource configuration, the reporting module that the user has permission to access, and the bank institution that the reporting module belongs to. When the target user has permission to access the target bank institution through the target reporting module, and the request interface resource information matches the role resource configuration corresponding to the target user, the access request is sent to the target reporting module. Among them, the same user is configured with one or more roles, and the same role is configured with one or more resources; Each resource corresponds to one or more of the following resource information: resource ID, operation ID, operation name, operation URL, request type, and number of dynamic parameters.

8. An electronic device, characterized in that, The electronic device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-6.

Images