A method, apparatus and medium for implementing blacklist and whitelist access control

Abstract

This invention discloses a method, apparatus, and medium for implementing blacklist / whitelist access control. The method includes: responding to a user's request to access the ABI platform, routing through a gateway to a pre-created blacklist / whitelist access control tool at the service entry point of each module, wherein the blacklist / whitelist access control tool is included in the ABI platform code as a Maven dependency; the blacklist / whitelist access control tool obtains the input parameter value of the request; the blacklist / whitelist access control tool compares the input parameter value with a whitelist of users maintained by the Nacos configuration center and a blacklist of users automatically recorded and synchronized by Redis to determine whether the user has permission to access the ABI platform.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of access control, and more particularly, to a black and white list access control implementation method, device and medium. BACKGROUND

[0002] ABI platform is a full-link data application platform that integrates BI data access, BI data modeling and processing, AI data management and algorithm development, AI image management and training management, and AI and BI-based data analysis and mining. It can meet various complex analysis needs encountered in enterprise operation and help enterprises realize efficient digital transformation. For ABI platform, which is mainly aimed at enterprise internal users, there are usually fixed users and sensitive data. Before going online, users who can access the system need to be strictly sorted and controlled. In order to better control data security risks and reduce potential security risks in formal operation, developers need to control the black and white list at the system entrance. Before going online, users who can access the system are sorted and configured into the white list. At the same time, a black list is maintained to identify malicious user attack behaviors. When a user appears in both the white list and the black list, the user's access to the system is still disabled. With the black and white list control function, the system can verify the access of each user, reducing the overall data security risk of the system.

[0003] Although the black and white list can control the access range of the system entrance and reduce the risk of sensitive data leakage, if such black and white list functions are added to the code of all service entrances of the system, it will bring a lot of work to the developers. At the same time, maintaining two lists will also bring some workload to the operation and maintenance personnel, consuming time and effort. When the black and white list function is no longer needed, the related code may need to be cleaned up to reduce the amount of redundant code. Moreover, such a large number of repeated modifications that seriously invade the code will also produce unpredictable additional risks, not only increasing the time and labor costs, but also affecting the overall stability of the system. SUMMARY

[0004] In view of the deficiencies of the prior art, the present application provides a black and white list access control implementation method, device and medium.

[0005] According to one aspect of the present application, a black and white list access control implementation method is provided, comprising:

[0006] In response to a user's request to access the ABI platform, the request is routed through the gateway to the pre-created black and white list access control tool of each module service entrance, wherein the black and white list access control tool is introduced into the ABI platform code in the form of Maven dependency;

[0007] The black and white list access control tool acquires the in parameter value of the request;

[0008] The black and white list access control tool compares the in parameter value with a white list user list maintained by a Nacos configuration center and a black list user list automatically recorded and synchronized by Redis, and determines whether the user has the permission to access the ABI platform.

[0009] Optionally, the creation process of the black and white list access control tool is as follows:

[0010] A user white list access control annotation and a user black list access control annotation are created, and the user white list access control annotation or the user black list access control annotation and parameter information are added to a service entry method that needs to be controlled by a white list or a black list;

[0011] A white list configuration class and a black list configuration class are created, and are used to integrate the white list configuration and the black list configuration into the Nacos configuration center;

[0012] A white list list acquisition class and a black list list acquisition class are created, and are respectively used to acquire a white list list in a yaml format of the Nacos and a black list list in a Redis Key-Value format;

[0013] A white list aspect class and a black list aspect class are created, and are respectively used for aspect logic processing of the white list and the black list.

[0014] Optionally, the method further includes that a developer adds the white list access control annotation or the user black list access control annotation to the target service entry method, and configures the black and white list access control tool to the target service entry method.

[0015] Optionally, the user white list access control annotation and the user black list access control annotation include a custom field attribute name and return information after authentication failure.

[0016] According to another aspect of the present application, a black and white list access control implementation device is provided, comprising:

[0017] A request module is configured to respond to a request of a user accessing an ABI platform, and route the request to a pre-created black and white list access control tool of a service entry of each module through a gateway, wherein the black and white list access control tool is introduced into the ABI platform code in a Maven dependent manner;

[0018] An acquisition module is configured to acquire, by the black and white list access control tool, an in parameter value of the request;

[0019] The comparison module is used for the black and white list access control tool to compare the input parameter value with a white list user list maintained by the Nacos configuration center and a black list user list automatically recorded and synchronized by Redis, to determine whether the user has the access right to the ABI platform.

[0020] According to still another aspect of the present application, there is provided a computer readable storage medium storing a computer program for executing the method according to any one of the preceding aspects of the present application.

[0021] According to still another aspect of the present application, there is provided an electronic device comprising: a processor; a memory for storing instructions executable by the processor; and the processor configured to read the executable instructions from the memory and execute the instructions to implement the method according to any one of the preceding aspects of the present application.

[0022] Thus, the present application provides a black and white list access control implementation method, which implements a black and white list access control tool for an ABI platform, configures into a service entry code in a zero-invasive manner through a self-defined annotation, and then matches a white list implemented by a Nacos configuration center for dynamic configuration and a malicious access black list automatically recorded and synchronized by Redis, so as to easily implement the black and white list access control function. The present application can improve the data security and system stability, greatly reduce the time and labor cost of R&D, operation and maintenance personnel, perfectly avoid other risks caused by invasive code modification, and has a broad application prospect. BRIEF DESCRIPTION OF DRAWINGS

[0023] The exemplary embodiments of the present application can be more completely understood in reference to the following drawings:

[0024] Figure 1 is a flowchart of the black and white list access control implementation method provided by an exemplary embodiment of the present application;

[0025] Figure 2 is a whole architecture diagram of the black and white list access control of the ABI platform provided by an exemplary embodiment of the present application;

[0026] Figure 3 is a business flowchart of the black and white list access control of the ABI platform provided by an exemplary embodiment of the present application;

[0027] Figure 4 is a hierarchical design diagram of the black and white list access control of the ABI platform provided by an exemplary embodiment of the present application;

[0028] Figure 5 is a structure diagram of the black and white list access control implementation device provided by an exemplary embodiment of the present application;

[0029] Figure 6 is a structure of an electronic device provided by an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0030] Hereinafter, example embodiments according to the present application will be described in detail with reference to the accompanying drawings. It should be apparent that these described embodiments are merely exemplary of the present application and should not be considered limiting the scope of the present application. Therefore, the disclosure of these embodiments is intended to be illustrative, but not limiting of the scope of the present application.

[0031] It should be noted that the relative arrangement of the components and steps, the numerical expressions, and numerical values set forth in these embodiments are not limiting of the scope of the present application unless otherwise specifically indicated.

[0032] It should be understood by those skilled in the art that the terms "first", "second", and the like, in the embodiments of the present application, are used only to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they indicate a logical sequence between them.

[0033] It should also be understood that in the embodiments of the present application, "a plurality of" can mean two or more, and "at least one" can mean one, two, or more.

[0034] It should also be understood that for any component, data, or structure mentioned in the embodiments of the present application, unless specifically limited or unless the context clearly indicates otherwise, it can be understood as one or more.

[0035] In addition, the term "and / or" in the present application is only a description of the association relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can represent the existence of A alone, the existence of A and B together, and the existence of B alone. In addition, the character " / " in the present application generally represents an "or" relationship between the front and rear associated objects.

[0036] It should also be understood that the description of each embodiment of the present application emphasizes the differences between the embodiments, and the same or similar parts can be referred to each other, and for the sake of brevity, will not be repeated.

[0037] At the same time, it should be understood that, for the convenience of description, the size of each part shown in the drawings is not drawn in accordance with the actual proportional relationship.

[0038] The following description of at least one example embodiment is merely illustrative in nature and is in no way limiting of the application or its use.

[0039] Techniques, methods, and devices known to those of ordinary skill in the relevant art can not be discussed in detail, but where appropriate, the techniques, methods, and devices should be considered as part of the specification.

[0040] It should be noted that like numerals and letters refer to like items throughout the drawings, and once an item is defined in one drawing, it is not necessary to discuss it further in subsequent drawings.

[0041] Embodiments of the present application can be applied to terminal devices, computer systems, servers, and other electronic devices, which can operate with many other general-purpose or special-purpose computing system environments or configurations. Examples of well-known terminal devices, computing systems, environments, and / or configurations suitable for use with terminal devices, computer systems, servers, and other electronic devices include, but are not limited to, personal computers, server computers, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, minicomputers, mainframe computers, and distributed cloud computing technology environments that include any of the above systems, and the like.

[0042] Terminal devices, computer systems, servers, and other electronic devices can be described in the general context of computer system-executable instructions, such as program modules, being executed by the computer system. Generally, program modules can include routines, programs, objects, components, logic, data structures, and the like, which perform particular tasks or implement particular abstract data types. Computer systems / servers can be implemented in a distributed cloud computing environment, in which tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules can be located in local or remote computer system storage media including storage devices.

[0043] Exemplary method

[0044] Figure 1 is a flowchart of a black and white list access control implementation method provided by an exemplary embodiment of the present application. The present embodiment can be applied to electronic devices, such as Figure 1 As shown in the figure, the black and white list access control implementation method 100 includes the following steps:

[0045] Step 101, in response to a user's request to access the ABI platform, the pre-created black and white list access control tool of each module service entrance is routed through the gateway, wherein the black and white list access control tool is introduced into the ABI platform code in the form of Maven dependency;

[0046] Step 102, the black and white list access control tool obtains the input parameter value of the request;

[0047] Step 103, the black and white list access control tool compares the parameter value with the white list user list maintained by the Nacos configuration center and the black list user list automatically recorded and synchronized by Redis, and determines whether the user has the access right of the ABI platform.

[0048] Specifically, the present application aims to realize a black and white list access control tool for the ABI platform, which is configured into the target service entrance code in a zero-intrusion pluggable manner, that is, the black and white list access control function can be easily realized. At the same time, the white list is dynamically configured through the Nacos configuration center, the malicious access user exceeding the threshold of password error times is recorded through Redis, and is automatically synchronized to the black list, the whole process does not need human intervention. While improving the data security of the system, it can reduce the time, labor cost of R&D, operation and maintenance and operation personnel, enhance the overall stability, availability of the system, and reduce other risks caused by invasive code modification. The overall architecture is as follows Figure 2 Overall architecture diagram of ABI platform black and white list access control.

[0049] Since the black and white list access control function belongs to the general function that can be reused in the entrance service of each module of the ABI platform, it can be extracted as a pluggable tool and used by the entrance service of each module of the ABI platform code. This tool is based on Java development language and SpringBoot framework, uses custom annotations, AOP aspect technology and the integration capabilities of the framework to Nacos, Redis and other components, and finally realizes the black and white list access control function.

[0050] When the user accesses the ABI platform, the request first passes through the Gateway gateway and is routed to the black and white list access control tool of each module entrance service through the gateway. The tool can obtain the parameter value of any specified field, compare it with the white list user list maintained by the Nacos configuration center and the black list user list automatically recorded and synchronized by Redis, and determine whether the access user has the access right of the ABI platform. This black and white list access control tool is introduced into the ABI platform code in the form of Maven dependency, and can be automatically loaded and instantiated at platform startup through configuration class, which is convenient for subsequent use. Developers only need to add custom annotations on the target method to quickly and elegantly enable the target method to have black and white list access control capability. The overall process is as follows Figure 3 Business process diagram of ABI platform black and white list access control.

[0051] The technical solution of the present application is as follows:

[0052] The main development steps of the pluggable black and white list access control tool consist of five steps.

[0053] First, create two custom annotations, `@DoUserWhiteList` and `@DoUserBlackList`, to handle user whitelist access control and user blacklist access control, respectively. To use them, add the annotation to the service entry method that requires whitelist or blacklist control and pass the necessary parameters. The parameters for these two custom annotations are identical, including custom field attribute names and return information after authentication failure. Specifically, `@DoUserWhiteList` and `@DoUserBlackList` each have two attributes: `customKey` and `failResult`. `customKey` retrieves the required method parameter values ​​from one or more input parameters of the method it modifies; `failResult` returns the failure information for users not on the whitelist or on the blacklist when access is blocked.

[0054] Secondly, create a new configuration class `UserWhiteListAutoConfigure`. Its purpose is to load the whitelist information maintained by the Nacos configuration center integrated into the Spring Boot framework into memory for use in subsequent whitelist access control logic. Then, create another configuration class `UserBlackListAutoConfigure`. Its purpose is to load the blacklist information maintained by the Redis component integrated into the Spring Boot framework into memory for use in subsequent blacklist access control logic.

[0055] Next, create a new JavaBeanUserWhiteListProperties to retrieve the Nacos whitelist in YAML format. This is done by adding `@Value("${xxx.xxx}")` to the class properties, along with the specific configuration information in Nacos configuration files such as `application.yml` and `bootstrap.yml`, to obtain the corresponding configuration content. Then, create a JavaBeanUserBlackListProperties to retrieve the Redis blacklist in Key-Value format, and use the utility class `RedisTemplate` to perform Redis read and write operations.

[0056] With the aforementioned configuration classes and JavaBeans, UserWhiteListAutoConfigure can automatically inject and configure the Nacos whitelist obtained from UserWhiteListProperties at platform startup, enabling comparison and verification in the whitelist access control logic. Similarly, UserBlackListAutoConfigure can automatically inject and configure the Redis blacklist obtained from UserBlackListProperties at platform startup, enabling comparison and verification in the blacklist access control logic.

[0057] Next, two new aspect classes, UserWhiteListDoJoinPoint and UserBlackListDoJoinPoint, are created to handle the aspect logic for whitelists and blacklists, respectively. Their function is to match target methods annotated with `@DoUserWhiteList` or `@DoUserBlackList`, extract the values ​​passed in as parameters of the added custom annotations, and perform business logic judgments and processing. This is the core of the entire blacklist / whitelist access control tool. The `UserWhiteListDoJoinPoint` and `UserBlackListDoJoinPoint` aspect classes are defined as aspect classes by adding the `@Aspect` annotation, and then the `@Pointcut` annotation defines the pointcut. The pointcut is used to locate the specific position of the custom annotation, and then `@Around` is used to weave the method at the pointcut position. The `@Around` annotation ensures that when a method annotated with `@DoUserWhiteList` or `@DoUserBlackList` is called, the method annotated with `@Around` will be entered first. This method will judge and process the specific business logic of the blacklist / whitelist access control, such as allowing whitelisted users and blocking blacklisted users. The specific logic of the method containing the `@Around` annotation is as follows: It retrieves the target method matched by the pointcut using `getMethod()`, then obtains the custom annotation added to this method using `getAnnotation()`, and gets the information of the annotation's attributes (i.e., the specific whitelist or blacklist content) using `getFieldValue()`. Each value of this content is iterated through and compared with the values ​​in the Nacos whitelist obtained from the `UserWhiteListAutoConfigure` configuration class or the Redis blacklist obtained from the `UserBlackListAutoConfigure` configuration class to determine whether to block or allow the accessing user. If blocking is required, the `failResult` attribute configured on the custom annotation is returned. If allowing access, the `jp.proceed()` method is called to allow the code to continue execution. Ultimately, the user's request is passed to the target method and a response is obtained. Layered design as follows... Figure 4 A layered design diagram of blacklist and whitelist access control on the ABI platform.

[0058] The key technical point of this invention is:

[0059] 1. This invention primarily addresses the access security issues of sensitive data in ABI platforms. Utilizing the Java programming language and the Spring Boot framework, it proposes a tool and method for blacklist / whitelist access control. Since ABI platforms often store a company's most sensitive business data or confidential documents, the lack of strict access control poses significant data security risks, potentially causing incalculable losses. Adding blacklist / whitelist access control functionality to all service entry points in the system would inevitably impose a huge workload on developers. When the blacklist / whitelist functionality is no longer needed, the relevant code must be cleaned up to reduce redundant code in the system. Therefore, extensive and repeated modifications to such highly intrusive code can introduce unpredictable additional risks and affect system stability. This invention, however, configures blacklist / whitelist access control functionality into the target system code in a non-intrusive manner. By adding custom annotations to each service entry method as needed, and combining this with the blacklist / whitelist list, access control functionality can be easily implemented.

[0060] 2. Maintaining separate blacklists and whitelists incurs a significant workload for operations and maintenance personnel, and untimely updates can still pose a serious risk of data leakage. Furthermore, Spring Boot's properties and YAML configuration files are stored within the project code; each configuration change requires a project restart to load the configuration file, impacting system availability and increasing operational costs—a time-consuming and labor-intensive process. Therefore, dynamic configuration is a better option, as newly modified configurations take effect immediately without requiring a project restart. This invention utilizes the Nacos configuration center to dynamically maintain whitelist configurations, while Redis automatically records malicious users exceeding a threshold for incorrect username and password attempts and synchronizes these records to the blacklist in real time. The entire process requires no manual intervention, reducing time and labor costs and enhancing system availability.

[0061] As a crucial platform for internal data analysis and graphical visualization within enterprises, the ABI platform plays a vital role in supporting critical decision-making. Consequently, it stores the company's most sensitive business data or confidential documents. Without strict access control, there will be significant data security risks, potentially causing incalculable losses to the company.

[0062] Therefore, this invention provides a method for implementing blacklist / whitelist access control, creating a blacklist / whitelist access control tool for the ABI platform. This tool is configured into the service entry code in a non-intrusive manner through custom annotations. Combined with a dynamically configured whitelist via Nacos configuration center and a malicious access blacklist automatically recorded and synchronized via Redis, blacklist / whitelist access control functionality can be easily implemented. This method significantly reduces the time and manpower costs for R&D, operations, and maintenance personnel while improving data security and system stability, perfectly avoiding other risks associated with intrusive code modifications, and has broad application prospects.

[0063] Exemplary apparatus

[0064] Figure 5 This is a schematic diagram of the structure of a blacklist / whitelist access control implementation device provided in an exemplary embodiment of the present invention. Figure 5 As shown, the device 500 includes:

[0065] Request module 510 is used to respond to user requests to access the ABI platform, and to route them through the gateway to the pre-created blacklist and whitelist access control tools at the service entry points of each module. The blacklist and whitelist access control tools are imported into the ABI platform code as Maven dependencies.

[0066] The module 520 is used by the blacklist / whitelist access control tool to obtain the input parameter values ​​of the request.

[0067] The comparison module 530 is used by the blacklist / whitelist access control tool to compare the input parameter value with the whitelist of users maintained by the Nacos configuration center and the blacklist of users automatically recorded and synchronized by Redis to determine whether the user has permission to access the ABI platform.

[0068] Optionally, the creation process of the blacklist / whitelist access control tool in request module 510 is as follows:

[0069] The first newly created submodule is used to create user whitelist access control annotations and user blacklist access control annotations. Add user whitelist access control annotations or user blacklist access control annotations and parameter information to the service entry methods that need to be whitelisted or blacklisted.

[0070] The second newly created submodule is used to create whitelist configuration classes and blacklist configuration classes, which are used to integrate whitelist configuration and blacklist configuration into the Nacos configuration center.

[0071] The third newly created submodule is used to create a whitelist list retrieval class and a blacklist list retrieval class, which are used to retrieve the Nacos whitelist list in YAML format and the Redis blacklist list in Key-Value format, respectively.

[0072] The fourth new submodule is used to create whitelist aspect classes and blacklist aspect classes, which are used for aspect logic processing of whitelist and blacklist respectively.

[0073] Optionally, the device 500 also includes a configuration module for developers to add whitelist access control annotations or user blacklist access control annotations to the target service entry method, thereby configuring the whitelist / blacklist access control tool to the target service entry method.

[0074] Optionally, user whitelist access control annotations and user blacklist access control annotations include: custom field attribute names and return information after authentication failure.

[0075] Exemplary electronic device

[0076] Figure 6 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. For example... Figure 6 As shown, the electronic device 60 includes one or more processors 61 and a memory 62.

[0077] The processor 61 may be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0078] The memory 62 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 61 may execute the program instructions to implement the methods of the software programs of the various embodiments of the present invention described above, and / or other desired functions. In one example, the electronic device may also include an input device 63 and an output device 64, these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0079] In addition, the input device 63 may also include, for example, a keyboard, a mouse, etc.

[0080] The output device 64 can output various information to the outside. The output device 64 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0081] Of course, for the sake of simplicity,Figure 6 Only some of the components of this electronic device relevant to the present invention are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.

[0082] Exemplary computer program product and computer readable storage medium

[0083] In addition to the methods and apparatus described above, embodiments of the present invention may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps in the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0084] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0085] Furthermore, embodiments of the present invention may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps of the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0086] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0087] The basic principles of the present invention have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in the present invention are merely examples and not limitations, and should not be considered as essential features of each embodiment of the present invention. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the present invention to the necessity of employing the aforementioned specific details.

[0088] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0089] The block diagrams of devices, systems, devices, and systems involved in this invention are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, systems, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0090] The methods and systems of the present invention may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of the present invention are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, the present invention may also be implemented as a program recorded on a recording medium, the program comprising machine-readable instructions for implementing the methods according to the present invention. Thus, the present invention also covers recording media storing programs for performing the methods according to the present invention.

[0091] It should also be noted that in the systems, apparatus, and methods of the present invention, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered equivalents of the present invention. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the invention. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the invention. Therefore, the invention is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0092] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the invention to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A method of implementing black and white list access control, characterized by, Comprise: In response to the user's request to access the ABI platform, the pre-created black and white list access control tool reaches each module service entrance through the gateway routing, wherein the black and white list access control tool is introduced into the ABI platform code in the form of Maven dependency; The black and white list access control tool obtains the input parameter value of the request; The black and white list access control tool compares the input parameter value with the white list user list maintained by the Nacos configuration center and the black list user list automatically recorded and synchronized by Redis to determine whether the user has the access right of the ABI platform; The creation process of the black and white list access control tool is as follows: New user white list access control annotation and user black list access control annotation, add the user white list access control annotation or the user black list access control annotation and parameter information on the service entrance method which needs to be controlled by white list or black list; New white list configuration class and black list configuration class are used to integrate white list configuration and black list configuration into Nacos configuration center; New white list list acquisition class and black list list acquisition class are used to acquire Nacos's yaml format white list list and Redis Key-Value format black list list respectively; New white list aspect class and black list aspect class are used for white list and black list aspect logic processing respectively.

2. The method of claim 1, wherein, Also include: The developer adds the white list access control annotation or the user black list access control annotation on the target service entrance method, and configures the black and white list access control tool to the target service entrance method.

3. The method of claim 1, wherein, The user white list access control annotation and the user black list access control annotation include: custom field attribute name and return information after authentication failure.

4. A black and white list access control implementation apparatus characterized by comprising: Comprise: A request module is configured to, in response to a user's request to access an ABI platform, pre-created black and white list access control tools reach each module service entrance through a gateway routing, wherein the black and white list access control tools are introduced into the ABI platform code in the form of Maven dependency; An acquisition module is configured to, in response to a user's request to access an ABI platform, pre-created black and white list access control tools reach each module service entrance through a gateway routing, wherein the black and white list access control tools are introduced into the ABI platform code in the form of Maven dependency; A comparison module is configured to, in response to a user's request to access an ABI platform, pre-created black and white list access control tools reach each module service entrance through a gateway routing, wherein the black and white list access control tools are introduced into the ABI platform code in the form of Maven dependency; The creation process of the black and white list access control tool in the request module is as follows: A first new submodule is configured to, in response to a user's request to access an ABI platform, pre-created black and white list access control tools reach each module service entrance through a gateway routing, wherein the black and white list access control tools are introduced into the ABI platform code in the form of Maven dependency; A second new submodule is configured to, in response to a user's request to access an ABI platform, pre-created black and white list access control tools reach each module service entrance through a gateway routing, wherein the black and white list access control tools are introduced into the ABI platform code in the form of Maven dependency; The third newly created submodule is used for newly creating a whitelist list obtaining class and a blacklist list obtaining class, and is used for respectively obtaining a whitelist list in a yaml format of Nacos and a blacklist list in a Redis Key-Value format. The fourth newly created submodule is used for newly creating a whitelist aspect class and a blacklist aspect class, and is used for respectively processing aspect logic of the whitelist and the blacklist.

5. The apparatus of claim 4, wherein, Further comprising: A configuration module is configured to add the whitelist access control annotation or the user blacklist access control annotation on a target service entry method by a developer, and configure the black and white list access control tool to the target service entry method.

6. The apparatus of claim 4, wherein, The user whitelist access control annotation and the user blacklist access control annotation comprise a self-defined field attribute name and return information after authentication failure.

7. A computer readable storage medium characterized by, The storage medium stores a computer program, and the computer program is used for executing the method in any one of claims 1-3.

8. An electronic device, comprising: The electronic device comprises: A processor; A memory for storing executable instructions of the processor; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method in any one of claims 1-3.

Images