A method and apparatus for processing a call right

Abstract

The application discloses a kind of methods and devices for processing call permissions, and it relates to computer technology field.The specific embodiment of the method includes: according to the application identification and platform authorization identification contained in the call request sent by the calling party;Vector subtraction is carried out on the target application characteristic code corresponding to platform authorization identification and application identification, and the user identification is determined according to the result of vector subtraction;And whether the call permission is opened for the calling party based on user identification;The platform authorization identification obtained by vector addition to the application information and user information of the calling party, overcomes the problem of high consumption of computing resources caused by using hash algorithm or symmetric encryption and decryption algorithm to process platform authorization identification in the prior art, improves the efficiency of processing call permissions, and reduces the maintenance difficulty of platform authorization identification related to call permissions.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and apparatus for processing access permissions. Background Technology

[0002] Currently, the number and variety of Internet applications are growing rapidly, which also places higher demands on the efficiency of developing Internet applications. Typically, some independent software vendors (ISVs) can complete the business logic of their applications by calling open platform systems. Therefore, the platform system needs to authenticate each ISV when each ISV makes a call.

[0003] Platform systems typically configure platform authorization identifiers for each ISV to achieve authentication. These platform authorization identifiers are generally obtained through hash algorithms or symmetric encryption algorithms.

[0004] Existing authentication methods have the following problems: using hash algorithms or symmetric encryption / decryption algorithms in combination with platform authorization identifiers for authentication is a complex calculation process that increases the consumption of computing resources; at the same time, the platform authorization identifiers generated by hash algorithms or symmetric encryption / decryption algorithms have variable lengths, which increases the difficulty of maintaining the platform authorization identifiers. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a method and apparatus for processing call permissions, which can perform vector subtraction on the target application feature codes corresponding to the platform authorization identifier and the application identifier sent by the caller, determine the user identifier based on the result of the vector subtraction, and determine whether the caller has been granted call permissions based on the user identifier. By obtaining the platform authorization identifier through vector addition of the caller's application information and user information, the high computational resource consumption caused by using hash algorithms or symmetric encryption / decryption algorithms to process the platform authorization identifier in the prior art is overcome, thereby improving the efficiency of processing call permissions and reducing the maintenance difficulty of the platform authorization identifier related to call permissions.

[0006] To achieve the above objectives, according to one aspect of the present invention, a method for processing access permissions is provided, comprising:

[0007] The system receives a call request from a caller, the call request containing the caller's application identifier and platform authorization identifier; the platform authorization identifier is a string of a predetermined length obtained by vector summation of the caller's application information and user information.

[0008] From a plurality of stored application feature codes, a target application feature code that matches the application identifier is found, wherein the application feature code is generated based on the application identifier and the length of the application feature code is the same as the length of the platform authorization identifier;

[0009] The platform authorization identifier and the target application feature code are subtracted by vector, and the user identifier is determined based on the result of the vector subtraction; based on the user identifier, it is determined whether the caller has been granted calling permissions.

[0010] Optionally, the method for processing access permissions further includes:

[0011] Receive an access request sent by the caller, the access request containing the caller's application identifier; generate a corresponding application feature code for the application identifier, and save the correspondence between the application identifier and the application feature code.

[0012] Optionally, the access request further includes one or more user identifiers associated with the application identifier;

[0013] The method for handling access permissions further includes: for each user identifier, performing:

[0014] Generate a corresponding user feature code for the user identifier, the length of which is the same as the length of the platform authorization identifier, and save the correspondence between the user identifier and the user feature code; perform vector addition on the application feature code and the user feature code to obtain the platform authorization identifier; send the platform authorization identifier to the caller corresponding to the application identifier and the user identifier.

[0015] Optionally, determining the user identifier based on the result of the vector subtraction includes: finding a user identifier that corresponds to the result of the vector operation.

[0016] Optionally, determining whether to grant calling permissions to the caller based on the user identifier includes: granting calling permissions to the caller if a user identifier that corresponds to the result of the vector operation is found.

[0017] Optionally, the method for processing access permissions includes: the string corresponding to the platform authorization identifier is composed of numbers in base 31.

[0018] To achieve the above objectives, according to a second aspect of the present invention, an apparatus for processing access permissions is provided, characterized in that it includes: a request receiving module, an identifier determining module, and a permission determining module; wherein,

[0019] The request receiving module is used to receive a call request sent by the caller. The call request includes the caller's application identifier and platform authorization identifier. The platform authorization identifier is a string of a set length obtained by vector addition of the caller's application information and user information.

[0020] The identification module is used to search for a target application feature code that matches the application identifier from a plurality of stored application feature codes, wherein the application feature code is generated based on the application identifier and the length of the application feature code is the same as the length of the platform authorization identifier;

[0021] The permission determination module is used to perform vector subtraction between the platform authorization identifier and the target application feature code, determine the user identifier based on the result of the vector subtraction, and determine whether to grant calling permission to the caller based on the user identifier.

[0022] Optionally, the apparatus for processing access permissions further includes: receiving an access request sent by the caller, the access request containing the application identifier of the caller; generating a corresponding application feature code for the application identifier; and saving the correspondence between the application identifier and the application feature code.

[0023] Optionally, the access request further includes one or more user identifiers associated with the application identifier;

[0024] The apparatus further includes: for each of the user identifiers, performing:

[0025] Generate a corresponding user feature code for the user identifier, the length of which is the same as the length of the platform authorization identifier, and save the correspondence between the user identifier and the user feature code; perform vector addition on the application feature code and the user feature code to obtain the platform authorization identifier; send the platform authorization identifier to the caller corresponding to the application identifier and the user identifier.

[0026] Optionally, the apparatus for processing access permissions includes: determining a user identifier based on the result of vector subtraction, including: searching for a user identifier that corresponds to the result of the vector operation.

[0027] Optionally, the apparatus for processing call permissions includes: determining whether to grant call permissions to the caller based on the user identifier, including: granting call permissions to the caller if a user identifier corresponding to the result of the vector operation is found.

[0028] Optionally, the device for processing access permissions includes: the string corresponding to the platform authorization identifier is composed of numbers in base 31.

[0029] To achieve the above objectives, according to a third aspect of the present invention, an electronic device for processing access permissions is provided, characterized in that it includes: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform any of the methods described above for processing access permissions.

[0030] To achieve the above objectives, according to a fourth aspect of the present invention, a computer-readable medium is provided having a computer program stored thereon, characterized in that, when the program is executed by a processor, it implements any of the methods described above for processing access permissions.

[0031] One embodiment of the above invention has the following advantages or beneficial effects: it can determine the user identifier based on the application identifier and platform authorization identifier included in the call request sent by the caller; it can perform vector subtraction on the target application feature encoding corresponding to the platform authorization identifier and the application identifier, and determine the user identifier based on the result of the vector subtraction; and it can determine whether the caller has been granted call permissions based on the user identifier; by obtaining the platform authorization identifier by vector addition of the caller's application information and user information, it overcomes the problem of high computational resource consumption caused by using hash algorithms or symmetric encryption and decryption algorithms to process the platform authorization identifier in the prior art, improves the efficiency of processing call permissions, and reduces the maintenance difficulty of the platform authorization identifier related to call permissions.

[0032] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0033] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0034] Figure 1 This is a flowchart illustrating a method for handling access permissions according to an embodiment of the present invention;

[0035] Figure 2 This is a schematic diagram of a process for determining a platform authorization identifier according to an embodiment of the present invention;

[0036] Figure 3 This is a schematic diagram of the structure of a device for processing access permissions according to an embodiment of the present invention;

[0037] Figure 4 This is an exemplary system architecture diagram in which embodiments of the present invention can be applied;

[0038] Figure 5This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0039] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0040] Existing open platforms authenticate external ISVs using platform authorization identifiers (e.g., openId). Considering the information security of ISV user information and platform system information, a unique internal identifier with a corresponding relationship is usually constructed for each ISV's platform authorization identifier. When a request containing a platform authorization identifier is received from an ISV, the platform authorization identifier can be converted into a unique internal identifier to further enable the ISV to make calls.

[0041] Currently, the main methods for determining the platform authorization identifier are: 1) Concatenating the application identifier corresponding to the ISV with the system's internal unique identifier, then generating the platform authorization identifier through a hash function and Base64 encoding. The system's internal unique identifier corresponding to both the platform authorization identifier and the application identifier is saved. When calling the platform, the matching system's internal unique identifier is found using the platform authorization identifier. 2) Generating a key for each application identifier, then using the key to encrypt the system's internal unique identifier to generate the platform authorization identifier. When calling the platform, the platform authorization identifier is decrypted using the application identifier's key to obtain the corresponding system's internal unique identifier.

[0042] The disadvantages of existing methods are as follows: 1) Disadvantages based on hash algorithms: Due to the irreversibility of hash algorithms, it is necessary to store the correspondence between the platform authorization identifier and the unique identifier inside the system, which increases the consumption of storage space resources; in addition, hash algorithms are computationally complex, which increases the consumption of computing resources; the length of the platform authorization identifier generated by the hash algorithm is not fixed, which increases the difficulty of maintenance, and also has the problem of consuming more network resources; 2) Disadvantages based on symmetric encryption and decryption algorithms: The algorithm is computationally complex, which increases the consumption of computing resources; the length of the generated platform authorization identifier is not fixed, which increases the difficulty of maintaining the platform authorization identifier, and also has the problem of consuming more network resources.

[0043] In view of this, such as Figure 1 As shown, this embodiment of the invention provides a method for processing access permissions, which may include the following steps:

[0044] Step S101: Receive a call request sent by the caller, the call request containing the caller's application identifier and platform authorization identifier; the platform authorization identifier is a string of a set length obtained by vector addition of the caller's application information and user information.

[0045] Specifically, open platform systems can expose their application programming interfaces (APIs) or functions, allowing external applications to call (or add to) the platform software system's resources. Especially in the Internet era, developed platform software systems can be encapsulated into various types of interfaces and made available to Internet application developers, improving application development efficiency. The party calling the open platform system is the caller (e.g., multiple external ISVs). Understandably, open platform systems need to authenticate callers of their interfaces or functions to determine whether the caller has the authority to access the platform system.

[0046] Furthermore, the application identifier included in the received call request is associated with the caller and is used to uniquely identify the developed application. For example, the caller's application identifier is "meta123". The platform authorization identifier included in the received call request is provided to the caller by the open platform system and is used to determine the caller's permissions. Specifically, the platform authorization identifier is a string of a set length obtained by vector addition of the caller's application information and user information. The caller's application information is, for example, a string identifying the application such as an application identifier. The caller's user information is associated with the application information. For example, multiple user information (e.g., user identifiers) corresponding to the application identifier "meta123" are: meta_user1, meta_user2, meta_user3, etc. It can be understood that the same interface of the platform system can be called by different business modules in the application, so different user information can be used to distinguish them.

[0047] Furthermore, a string of a predetermined length obtained by vector-adding the application information and user information of the caller is used as the platform authorization identifier, wherein the platform authorization identifier is a string of a predetermined length (e.g., 32 bits); furthermore, the string corresponding to the platform authorization identifier is composed of numbers in base-31 form; wherein the one-to-one correspondence between base-31 numbers and decimal numbers is as follows:

[0048] Decimal numbers: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30

[0049] Base 31 numbers: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p, q, r, s, t, u

[0050] For example, the platform authorization identifier is "magahkfkajon8qeiibad6e87g2mcbe7p", where m corresponds to the decimal value 22, h corresponds to the decimal value 17, and so on; that is, the string corresponding to the platform authorization identifier is composed of numbers in base 31.

[0051] The description of the authorization identifier for the vector addition calculation platform is consistent with the description of steps S201-S203, and will not be repeated here.

[0052] Step S102: From the stored multiple application feature codes, find the target application feature code that matches the application identifier, wherein the application feature code is generated based on the application identifier, and the length of the application feature code is the same as the length of the platform authorization identifier.

[0053] Specifically, the application feature code is a 32-bit string. The application feature code can be a UUID (Universally Unique Identifier) ​​randomly generated based on the application identifier. For example, the application feature code generated based on application identifier 1 is "c6b0c79f0bfa4f75a4105a1650f4414b". That is, the string corresponding to the application feature code can consist of hexadecimal numbers. When generating the application feature code, it can be generated directly based on the application identifier, or it can be generated by combining the application identifier with one or more other feature information (e.g., time features, application features, etc.). The generation method can utilize functions or software tools. This invention does not limit the specific application information used to generate the application feature code, nor the tools used to generate the application feature code. It is understood that the application identifier and the matching target application feature code can be stored in a database. The target application feature code matching the application identifier can be found through the application identifier. By generating the target application feature code matching the application identifier (used only by the platform system and not visible to the caller), the security of data and information in the platform system is improved.

[0054] Furthermore, the length of the application feature code is the same as the length of the platform authorization identifier; preferably, the length of both the application feature code and the platform authorization identifier are 32-bit strings; it is understood that vector calculations can be performed based on strings of the same length, thereby saving computing resources by reducing the computational difficulty.

[0055] Step S103: Perform vector subtraction on the platform authorization identifier and the target application feature code, and determine the user identifier based on the result of the vector subtraction; determine whether to grant calling permissions to the caller based on the user identifier.

[0056] Specifically, as described in step S101, the platform authorization identifier is a string of a set length obtained by vector addition of the application information and user information of the caller; then, based on the uniqueness of vector operations (addition or subtraction), the user feature code corresponding to the user identifier is obtained by vector subtraction of the platform authorization identifier and the target application feature code; further, the corresponding user identifier is searched from the database using the user feature code; that is, the platform authorization identifier and the target application feature code are vector subtracted; and the user identifier is determined based on the result of the vector subtraction. For example, a platform authorization identifier assigned to application AAA might be "magahkfkajon8qeiibad6e87g2mcbe7p", and a target application feature code corresponding to application AAA might be "c6b0c79f0bfa4f75a4105a1650f4414b". By subtracting the platform authorization identifier from the target application feature code, the user feature code corresponding to the user identifier of application AAA is obtained as "a45a5d65a89d4b7d879d1471b2787d3e". Further, based on the correspondence between user identifiers and user feature codes stored in the database, a matching user identifier is found. The result of the vector subtraction is the application feature code. Further, based on the correspondence between the application feature code and the user identifier, the user identifier is searched, that is, the user identifier that corresponds to the result of the vector operation (the result of the operation is, for example, the application feature code).

[0057] Furthermore, the system confirms whether the user has permission to call the platform system based on the user identifier, that is, it determines whether the caller has been granted calling permission based on the user identifier.

[0058] Furthermore, determining whether to grant calling permissions to the caller based on the user identifier includes: granting calling permissions to the caller if a user identifier corresponding to the result of the vector operation is found; that is, after authentication by the platform system, the caller can further call the platform system's interfaces or functions. It is understood that if no user identifier corresponding to the result of the vector operation is found, a message indicating abnormal calling permissions or call failure can be sent to the caller.

[0059] like Figure 2 As shown, this embodiment of the invention provides a method for determining a platform authorization identifier, which may include the following steps:

[0060] Steps S201-S203 describe the process by which the platform system generates platform authorization identifiers for each caller.

[0061] Step S201: Receive an access request sent by the caller, the access request containing the application identifier of the caller; generate a corresponding application feature code for the application identifier, and save the correspondence between the application identifier and the application feature code.

[0062] Specifically, before invoking the platform system, the caller typically needs to send an access request to the platform system to obtain access and invocation permissions. That is, the system receives the access request sent by the caller, which may contain an application identifier. Further, a corresponding application feature code is generated for the application identifier, and the correspondence between the application identifier and the application feature code is saved. The method for generating the corresponding application feature code for the application identifier is consistent with the description of step S102 and will not be repeated here. Further, the correspondence between the application identifier and the application feature code is saved using a database or file storage method. By saving this correspondence, when a call request is received, the system can search for a target application feature code that matches the application identifier from among multiple stored application feature codes, based on the application identifier contained in the request.

[0063] Step S202: The access request further includes one or more user identifiers associated with the application identifier; for each user identifier, perform the following: generate a corresponding user feature code for the user identifier, the length of the user feature code being consistent with the length of the platform authorization identifier, and save the correspondence between the user identifier and the user feature code.

[0064] Specifically, the same application identifier can correspond to one or more user identifiers. The description of the user identifier is the same as that in step S101, and will not be repeated here.

[0065] Furthermore, each user identifier is obtained from the access request of the caller, and a corresponding user feature code is generated for each application identifier. Assuming that the corresponding user feature code generated based on the user identifier "User123" is "a45a5d65a89d4b7d879d1471b2787d3e", the method for generating the corresponding user feature code based on the user identifier can be to use tools or software to directly generate it based on the string of the user identifier, or to generate it based on the string of the user identifier combined with other user feature information (such as: user network identifier, user device identifier, etc.).

[0066] Furthermore, the length of the user feature code is the same as the length of the platform authorization identifier; the user feature code is a 32-bit string, the content of which can be composed of hexadecimal numbers, and the user feature code can be a UUID randomly generated based on the application identifier; that is, the length of the user feature code is the same as the length of the platform authorization identifier.

[0067] Furthermore, the correspondence between user identifiers and the user feature codes is stored. Preferably, the correspondence between application identifiers and one or more corresponding user identifiers is stored using databases, data tables, files, etc.

[0068] Step S203: Add the application feature code and the user feature code together to obtain the platform authorization identifier; send the platform authorization identifier to the caller corresponding to the application identifier and the user identifier.

[0069] Specifically, the application feature code and the user feature code are vector-added together to obtain the platform authorization identifier;

[0070] For example, the applied feature encoding is "c6b0c79f0bfa4f75a4105a1650f4414b".

[0071] The user's feature code is "a45a5d65a89d4b7d879d1471b2787d3e"

[0072] The application feature code and the user feature code are vector-added together to obtain the platform authorization identifier "magahkfkajon8qeiibad6e87g2mcbe7p". Specifically, the application feature code and the user feature code are treated as 32-dimensional spatial vectors, and each bit in the application feature code or the user feature code is a coordinate value of one dimension. Further, vector addition is performed on the coordinate values ​​of each dimension. Taking the first bit of the application feature code and the first bit of the corresponding user feature code as an example, the vector addition of "c" (corresponding to the decimal number 12) in the application feature code and "a" (corresponding to the decimal number 10) in the user feature code results in the first bit "m" (corresponding to the decimal number 22) of the platform authorization identifier. Similarly, the vector addition of each bit of the application feature code and the user feature code results in the platform authorization identifier "magahkfkajon8qeiibad6e87g2mcbe7p".

[0073] Furthermore, after generating the platform authorization identifier, one or more platform authorization identifiers are sent as return data for the caller's access request to the corresponding caller. That is, the platform authorization identifier is sent to the caller corresponding to the application identifier and the user identifier. Specifically, the platform authorization identifier is a string composed of numbers in base-31 form; preferably, the length of the platform authorization identifier is 32 bits, and the lengths of the application feature code and the user feature code are consistent with the length of the platform authorization identifier. Thus, the user identifier can be determined through vector operations. Compared with the prior art, it is not necessary to configure an additional internal unique identifier for the platform authorization identifier. By determining the length of the platform authorization identifier to a fixed set length (e.g., 32 bits), computing resources and storage resources are saved, and the maintainability of the application feature code, user feature code, and platform authorization identifier is improved.

[0074] This invention does not limit the specific format and content of application identifiers and user identifiers.

[0075] like Figure 3 As shown, this embodiment of the invention provides a device 300 for processing access permissions, including: a request receiving module 301, an identifier determining module 302, and a permission judging module 303; wherein,

[0076] The request receiving module 301 is used to receive a call request sent by the caller. The call request includes the application identifier and platform authorization identifier of the caller. The platform authorization identifier is a string of a set length obtained by vector addition of the application information and user information of the caller.

[0077] The identification module 302 is used to search for a target application feature code that matches the application identifier from a plurality of stored application feature codes, wherein the application feature code is generated based on the application identifier and the length of the application feature code is the same as the length of the platform authorization identifier;

[0078] The permission determination module 303 is used to perform vector subtraction between the platform authorization identifier and the target application feature code, determine the user identifier based on the result of the vector subtraction, and determine whether to grant calling permission to the caller based on the user identifier.

[0079] This invention also provides an electronic device for processing access permissions, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in any of the above embodiments.

[0080] This invention also provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method provided in any of the above embodiments.

[0081] Figure 4 An exemplary system architecture 400 is shown, in which the method or apparatus for processing call permissions can be applied according to embodiments of the present invention.

[0082] like Figure 4 As shown, system architecture 400 may include terminal devices 401, 402, and 403, a network 404, and a server 405. Network 404 serves as the medium for providing communication links between terminal devices 401, 402, and 403 and server 405. Network 404 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0083] Users can use terminal devices 401, 402, and 403 to interact with server 405 via network 404 to receive or send messages, etc. Various client applications can be installed on terminal devices 401, 402, and 403, such as e-commerce client applications, web browser applications, search applications, instant messaging tools, and email clients.

[0084] Terminal devices 401, 402, and 403 can be various electronic devices with displays and supporting various client applications, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0085] Server 405 can be a server that provides various services, such as a backend management server that supports client applications used by users through terminal devices 401, 402, and 403. The backend management server can process received requests from callers and return the corresponding caller's access permission information to the terminal devices.

[0086] It should be noted that the method for processing call permissions provided in the embodiments of the present invention is generally executed by server 405, and correspondingly, the device for processing call permissions is generally set in server 405.

[0087] It should be understood that Figure 4 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0088] The following is for reference. Figure 5 It shows a schematic diagram of the structure of a computer system 500 suitable for implementing a terminal device of the present invention. Figure 5The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0089] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 502 or programs loaded from storage section 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the system 500. The CPU 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0090] The following components are connected to I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to I / O interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 510 as needed so that computer programs read from it can be installed into storage section 508 as needed.

[0091] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by central processing unit (CPU) 501, it performs the functions defined above in the system of this invention.

[0092] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0093] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0094] The modules and / or units described in the embodiments of the present invention can be implemented in software or hardware. The described modules and / or units can also be housed in a processor; for example, a processor can be described as including: a request receiving module, an identifier determining module, and an authorization determining module. The names of these modules do not necessarily limit the module itself; for example, the request receiving module can also be described as "a module that receives a call request sent by a caller."

[0095] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include: receiving a call request sent by a caller, the call request including the caller's application identifier and platform authorization identifier; the platform authorization identifier being a string of a predetermined length obtained by vector addition of the caller's application information and user information; searching for a target application feature code matching the application identifier from a stored plurality of application feature codes, wherein the application feature code is generated based on the application identifier, and the length of the application feature code is consistent with the length of the platform authorization identifier; performing vector subtraction on the platform authorization identifier and the target application feature code, and determining a user identifier based on the result of the vector subtraction; and determining whether to grant the caller calling permissions based on the user identifier.

[0096] The embodiments of the present invention can determine the user identifier based on the application identifier and platform authorization identifier included in the call request sent by the caller; perform vector subtraction on the target application feature encoding corresponding to the platform authorization identifier and the application identifier, and determine whether the caller has been granted call permissions based on the result of the vector subtraction; and determine whether the caller has been granted call permissions based on the user identifier; by obtaining the platform authorization identifier by vector addition of the caller's application information and user information, the problem of high computational resource consumption caused by using hash algorithms or symmetric encryption and decryption algorithms to process the platform authorization identifier in the prior art is overcome, thereby improving the efficiency of processing call permissions and reducing the maintenance difficulty of the platform authorization identifier related to call permissions.

[0097] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for handling access permissions, characterized in that, include: Receive an access request sent by the caller, wherein the access request contains the application identifier of the caller; Generate a corresponding application feature code for the application identifier, and save the correspondence between the application identifier and the application feature code; The access request further includes one or more user identifiers associated with the application identifier; for each user identifier, the following steps are performed: generating a corresponding user feature code for the user identifier, the length of which is the same as the length of the platform authorization identifier, and saving the correspondence between the user identifier and the user feature code; performing vector addition on the application feature code and the user feature code to obtain the platform authorization identifier; sending the platform authorization identifier to the caller corresponding to the application identifier and the user identifier; receiving a call request sent by the caller, the call request including the caller's application identifier and platform authorization identifier; Search for the target application feature code that matches the application identifier from a variety of stored application feature codes; The platform authorization identifier and the target application feature code are subtracted by vector, and the user identifier is determined based on the result of the vector subtraction; based on the user identifier, it is determined whether the calling party has been granted calling permissions.

2. The method according to claim 1, characterized in that, The user identifier is determined based on the result of vector subtraction, including: Find the user identifier that corresponds to the result of subtracting the vector.

3. The method according to claim 1, characterized in that, Determining whether to grant calling permissions to the caller based on the user identifier includes: If a user identifier that corresponds to the result of subtracting the vector is found, the caller is granted calling privileges.

4. The method according to claim 1, characterized in that, The string corresponding to the platform authorization identifier consists of numbers in base 31.

5. An apparatus for processing access permissions, characterized in that, include: The module comprises a request receiving module, an identifier determination module, and an authorization determination module; among which, The request receiving module is configured to receive an access request sent by a caller, the access request including the caller's application identifier; generate a corresponding application feature code for the application identifier, and save the correspondence between the application identifier and the application feature code; the access request further includes one or more user identifiers associated with the application identifier; for each user identifier, perform the following: generate a corresponding user feature code for the user identifier, the length of the user feature code being the same as the length of the platform authorization identifier, and save the correspondence between the user identifier and the user feature code; perform vector addition on the application feature code and the user feature code to obtain the platform authorization identifier; and send the platform authorization identifier to the caller corresponding to the application identifier and the user identifier. The request receiving module is used to receive a call request sent by the caller, the call request including the caller's application identifier and platform authorization identifier; The identification module is used to search for a target application feature code that matches the application identifier from a plurality of stored application feature codes; The permission determination module is used to perform vector subtraction between the platform authorization identifier and the target application feature code, determine the user identifier based on the result of the vector subtraction, and determine whether to grant calling permission to the caller based on the user identifier.

6. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-4.

7. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-4.

Images