Access control method and device and program deployment method and device

Abstract

The invention relates to an access control method and device and a program deployment method and device, and relates to the technical field of computers. The access control method comprises the following steps: receiving an access request for a subprogram initiated by a user through a main program; determining a judgment result according to whether a first attribute of the access request is matched with a second attribute of the subprogram, the second attribute being determined according to related information of a service corresponding to the subprogram; and under the condition that the judgment result is matching, allowing the user to access the subprogram.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to an access control method, an access control device, a program deployment method, a program deployment device, an electronic device, and a non-volatile computer-readable storage medium. Background Art

[0002] With the development of network technology and computing technology, the main program (such as main application, etc.) can provide services to users through multiple sub-programs (such as micro-applications, etc.). For example, for services based on the micro-application open platform, developers can package micro-applications and upload them to the platform.

[0003] In the use of micro-applications, a system package of the related technology includes multiple sub-program modules; when the sub-programs are put on the shelves, the registration of each sub-program of the related technology is independent. Summary of the invention

[0004] According to some embodiments of the present disclosure, there is provided an access control method, comprising: receiving an access request for a subprogram initiated by a user through a main program; determining a judgment result based on whether a first attribute of the access request matches a second attribute of the subprogram, wherein the second attribute is determined based on relevant information of a business corresponding to the subprogram; and allowing the user to access the subprogram if the judgment result is a match.

[0005] In some embodiments, the first attribute includes first access path information of one or more access pages of the access request, and the second attribute includes second access path information of one or more associated pages of the subroutine.

[0006] In some embodiments, the first access path information includes address information of each of the one or more access pages, and the second access path information includes address information of each of the one or more associated pages.

[0007] In some embodiments, one or more access pages include multiple access pages, the first access path information includes routing information between each of the multiple access pages, one or more associated pages include multiple associated pages, and the second access path information includes routing information between each of the multiple associated pages.

[0008] In some embodiments, the relevant information includes business requirements, and the association relationship between the subprogram and one or more associated pages is determined according to the business requirements.

[0009] In some embodiments, the business includes multiple sub-businesses, the related information includes the processing order of the multiple sub-businesses, and the routing information between each of the multiple associated pages is determined according to the processing order of the sub-businesses.

[0010] In some embodiments, determining the judgment result includes: determining the judgment result according to whether the subprogram is an associated subprogram of the main program.

[0011] In some embodiments, the association relationship between the main program and the associated sub-program is determined according to the needs of the business corresponding to the main program and the needs of the business corresponding to the associated sub-program.

[0012] In some embodiments, the first attribute comprises a key for the access request and the second attribute comprises a key for the subroutine.

[0013] In some embodiments, the first attribute includes a key of an access request and first access path information of one or more access pages of the access request, and the second attribute includes a key of a subprogram and second access path information of one or more associated pages of the subprogram. Determining a judgment result includes: determining whether the subprogram is an associated subprogram of a main program; in the case where the subprogram is an associated subprogram of the main program, determining whether the key of the access request matches the key of the subprogram; in the case where the key of the access request matches the key of the subprogram, determining the judgment result based on whether the first access path information matches the second access path information.

[0014] In some embodiments, the subprogram is packaged according to the following steps: determining one or more associated pages of the subprogram according to the business requirements corresponding to the subprogram; configuring the second attribute for the subprogram according to the one or more associated pages; and packaging the subprogram using the second attribute as a label.

[0015] In some embodiments, the subprogram is one of a plurality of subprograms to be accessed, and each of the plurality of subprograms to be accessed is encapsulated and packaged respectively.

[0016] In some embodiments, the access control method further includes: if the judgment result is a mismatch, denying the main program access to the subprogram, retaining an error log, and prompting the user that the access request is an illegal request and / or requiring the user to return to the previous page.

[0017] According to other embodiments of the present disclosure, a program deployment method is provided, including: configuring attributes of the subprogram according to relevant information of the business corresponding to the subprogram, the attributes of the subprogram being used to determine whether a user who initiates an access request through a main program is allowed to access the subprogram; and encapsulating the subprogram using the attributes as labels.

[0018] In some embodiments, the attributes of the subprogram include access path information of one or more associated pages of the subprogram.

[0019] In some embodiments, the access path information includes address information of each of one or more associated pages, and the relevant information includes business requirements. Based on the relevant information of the business corresponding to the subprogram, configuring the attributes of the subprogram includes: determining the association relationship between the subprogram and one or more associated pages based on the business requirements.

[0020] In some embodiments, one or more associated pages include multiple associated pages, the access path information includes routing information between each of the multiple associated pages, the business includes multiple sub-businesses, the related information includes the processing order of the multiple sub-businesses, and the routing information between each of the multiple associated pages is determined according to the processing order of the sub-businesses.

[0021] In some embodiments, the program deployment method also includes: determining whether the subprogram has an association relationship with at least one main program based on the business requirements corresponding to the subprogram and the business requirements corresponding to at least one main program, and the association relationship is used to determine whether the main program that initiates the access request is allowed to access the subprogram.

[0022] According to some other embodiments of the present disclosure, there is provided an access control device, comprising: a receiving unit, for receiving an access request for a subprogram initiated by a user through a main program; a judging unit, for determining a judgment result according to whether a first attribute of the access request matches a second attribute of the subprogram, wherein the second attribute is determined according to relevant information of a business corresponding to the subprogram; and a control unit, for allowing the user to access the subprogram when the judgment result is a match.

[0023] According to some further embodiments of the present disclosure, a program deployment device is provided, including: a configuration unit, used to configure the attributes of the subprogram according to relevant information of the business corresponding to the subprogram, the attributes of the subprogram being used to determine whether a user who initiates an access request through a main program is allowed to access the subprogram; and an encapsulation unit, used to encapsulate the subprogram using the attributes as labels.

[0024] According to some further embodiments of the present disclosure, there is provided an electronic device, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute the access control method or program deployment method in any embodiment of the present disclosure based on instructions stored in the memory device.

[0025] According to some further embodiments of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the access control method or program deployment method in any embodiment of the present disclosure is implemented.

[0026] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present application. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

[0028] Figure 1 A flowchart showing an access control method according to some embodiments of the present disclosure is shown;

[0029] Figure 2 A schematic diagram showing access path information of a subroutine according to some embodiments of the present disclosure;

[0030] Figure 3 A flowchart showing a program deployment method according to some embodiments of the present disclosure;

[0031] Figures 4a to 4e A flowchart showing a program deployment method and an access control method according to some embodiments of the present disclosure;

[0032] Figure 5a to 5c A schematic diagram showing a program deployment page according to some embodiments of the present disclosure;

[0033] Figure 6 A block diagram showing an access control device according to some embodiments of the present disclosure;

[0034] Figure 7 A block diagram showing a program deployment apparatus according to some embodiments of the present disclosure;

[0035] Figure 8 A block diagram showing an electronic device according to some embodiments of the present disclosure;

[0036] Fig. 9 A block diagram showing some other embodiments of the electronic device of the present disclosure;

[0037] Fig.10 The following is a block diagram showing some further embodiments of the electronic device of the present disclosure. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present disclosure and its application or use. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0039] Unless otherwise specifically stated, the relative arrangement of the parts and steps described in these embodiments, numerical expressions and numerical values ​​do not limit the scope of the present disclosure. At the same time, it should be understood that, for ease of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship. The technology, methods and equipment known to ordinary technicians in the relevant field may not be discussed in detail, but in appropriate cases, the technology, methods and equipment should be regarded as a part of the authorization specification. In all examples shown and discussed here, any specific value should be interpreted as being merely exemplary, rather than as a limitation. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further discussed in subsequent drawings.

[0040] As mentioned above, since a system package (i.e., program package, deployment package, etc.) may contain multiple sub-programs, the system package listed may easily cause incorrect access to multiple sub-programs. This may cause users to access sub-programs that they do not have permission to access from the main program, thereby reducing data security.

[0041] In response to the above technical problems, the present disclosure intends to add attribute configuration to the subroutine at the code level and add access process judgment to ensure data security.

[0042] For example, the technical solution disclosed in the present invention is aimed at multiple sub-programs launched based on the same system package. When the main program accesses its exclusive sub-program, if the user wants to access the sub-program permissions that are not configured by the main program by modifying the access attributes, the access will be directly denied, an error will be reported, and the information will be recorded and returned to the main program. If the number of times a user is denied exceeds a threshold, the user can be directly added to the blacklist; the user can continue to initiate access requests only after applying for release and being approved. In this way, the access security and data security of the sub-program are guaranteed.

[0043] The inventors of the present disclosure have discovered the following problems in the above-mentioned related technologies: during the use of the subprogram, illegal access requests may occur, resulting in page access errors, which pose a significant threat to the use process security and data security of the subprogram.

[0044] In view of this, the present disclosure proposes an access control technology solution that can improve the use process security and data security of the subroutine.

[0045] The present disclosure proposes a solution to control illegal requests in the case where multiple subprograms are deployed in the same system package. The technical solution of the present disclosure solves and optimizes the practical problem based on the above scenario and application technology.

[0046] In some embodiments, on the one hand, in the permission control of accessing subprograms, based on the idea of ​​authentication control, the business attributes of subprograms are configured at the code level to protect the security requests of subprograms associated with multiple pages of a system. The technical solution disclosed in the present invention is not a single improvement in scenario expansion and control method diversity, but a deployment solution that integrates the code level with the business level. On the other hand, since security solutions need to be applicable to be useful, the technical solution disclosed in the present invention adds diversified security strategies to the actual security solution to increase security protection.

[0047] For example, the technical solution of the present disclosure can be implemented through the following embodiments.

[0048] Figure 1 A flowchart of an access control method according to some embodiments of the present disclosure is shown.

[0049] like Figure 1 As shown, in step 110, an access request for a subprogram initiated by a user through a main program is received. For example, the subprogram has a pre-bound second attribute, including second access path information of one or more associated pages of the subprogram.

[0050] In some embodiments, the subprogram is one of a plurality of subprograms to be accessed, and each of the plurality of subprograms to be accessed is encapsulated and packaged respectively.

[0051] In some embodiments, the second attribute is determined based on relevant information of the business corresponding to the subroutine.

[0052] For example, in the configuration stage of a subprogram, the business requirements must first be obtained, and the purpose of the subprogram must be preliminarily determined based on the business requirements. This is mainly to determine which business scenarios the subprogram involves, and thus determine which program pages the subprogram needs to be associated with (i.e., the associated pages of the subprogram).

[0053] For example, based on an application scenario where there are multiple subprograms in a main program, users need two business functions provided by at least two subprograms - real-name authentication and device binding. Some of the associated pages of these two business functions are the same, while others are different.

[0054] In the above embodiment, although both subprograms need to load the customer's personal information, after adding the customer's personal information, the subsequent operations of the two subprograms are different, resulting in different associated pages corresponding to the subsequent operations. According to the different scenarios of the business needs corresponding to the subprograms, the scenarios that should be implemented in this configuration phase can be clarified. In order to avoid page jump errors between the two subprograms, it is necessary to pre-configure the associated pages of each subprogram to improve the security of page access.

[0055] In step 120, a judgment result is determined based on whether the first attribute of the access request matches the second attribute of the subprogram. The second attribute is determined based on relevant information of the service corresponding to the subprogram.

[0056] In some embodiments, the first attribute includes first access path information of one or more access pages of the access request, and the second attribute includes second access path information of one or more associated pages of the subroutine.

[0057] For example, based on the acquired business requirements, the associated pages involved in the subroutine can be screened out; according to the actual business logic, the routing information between different pages can be defined. In the case where the business requirements include real-name authentication requirements, the association relationship between pages (including routing information) can be determined according to the business processing logic and the product process designed according to the product prototype. For example, a business includes multiple sub-businesses, and the processing logic includes the processing order of multiple sub-businesses.

[0058] In this way, the user's authority can be limited to the association relationship, thereby completing the determination of the business processing flow of the subprogram.

[0059] In some embodiments, the subprogram is packaged with the second attribute as a label. For example, the subprogram can be modularly configured in advance, with the attribute of the subprogram as a label, and modularly configured and packaged at the code level according to the configuration order.

[0060] For example, the subprogram is packaged according to the following steps: determining one or more associated pages of the subprogram according to the business requirements corresponding to the subprogram; configuring the second attribute for the subprogram according to the one or more associated pages; and packaging the subprogram using the second attribute as a label.

[0061] For example, the access path information includes the address information of the page and the routing information between multiple pages. Figure 2 The embodiment in the embodiment binds the access path information with the subprogram to achieve the encapsulation of the subprogram.

[0062] Figure 2 A schematic diagram showing access path information of a subroutine according to some embodiments of the present disclosure.

[0063] like Figure 2 As shown, the developer of the subprogram has developed three subprograms, namely, subprogram A, B, and C. These three subprograms contain a total of 12 pages, represented by numbers 1 to 12. Now these three subprograms need to be put on the open platform.

[0064] In some embodiments, the relevant information of the business includes the needs of the business, and the association relationship between the sub-program and one or more associated pages is determined according to the needs of the business; the business includes multiple sub-businesses, the relevant information includes the processing order of the multiple sub-businesses, and the routing information between each of the multiple associated pages is determined according to the processing order of the sub-businesses.

[0065] For example, the first access path information includes address information of each of one or more accessed pages, and the second access path information includes address information of each of one or more associated pages. The address information may include the URL (Uniform Resource Locator) of each page.

[0066] In some embodiments, the one or more access pages include multiple access pages, the first access path information includes routing information between each of the multiple access pages, the one or more associated pages include multiple associated pages, and the second access path information includes routing information between each of the multiple associated pages.

[0067] For example, when the subprogram contains one or more associated pages, the second access path information includes the address information of each associated page (such as the URL of each associated page, etc.); when the subprogram contains multiple associated pages, the second access path information also includes routing information between each associated page, that is, the order of accessing each associated page.

[0068] In some embodiments, a subroutine includes multiple associated pages such as Figure 2 shown.

[0069] Figure 2 The result of encapsulating the associated pages of three subroutines through the modular configuration process is shown.

[0070] For example, according to the business requirements of subprogram A, its associated pages are determined to include 1, 4, 7, 9, and 11, and then the address information of these pages can be determined; according to the processing logic of the business of subprogram A, its corresponding page access sequence, that is, routing information, is determined to be 1, 4, 7, 9, and 11. The second access path information of subprogram A can include the URLs of pages 1, 4, 7, 9, and 11, and the access sequence between pages 1, 4, 7, 9, and 11.

[0071] For example, according to the business requirements of subprogram B, its associated pages are determined to include 1, 2, 6, 9 and 12, and then the address information of these pages can be determined; according to the processing logic of the business of subprogram B, its corresponding page access order, that is, routing information, is determined to be 1, 2, 6, 9 and 12.

[0072] For example, according to the business requirements of subprogram C, its associated pages are determined to include 1, 3, 5, 8 and 10, and the address information of these pages can be determined; according to the processing logic of the business of subprogram C, its corresponding page access order, that is, routing information, is determined to be 1, 3, 5, 8 and 10.

[0073] In some embodiments, subprograms A, B and C are all subprograms to be accessed, and can be packaged and packed separately. For example, the three packaged subprograms can be packaged into three subprogram packages and put on the system.

[0074] In the above embodiment, since each subprogram corresponds to different services, the logical relationship of its associated page (such as routing information) is also different, so the logical relationship corresponding to the subprogram is associated and pre-configured with address information and routing information at the code level. In this way, the modular configuration of the subprogram can be completed according to business requirements and configuration procedures to control user access to the subprogram, thereby improving security.

[0075] In some embodiments, the judgment result is determined according to whether the subprogram is an associated subprogram of the main program. For example, the association relationship between the main program and the associated subprogram is determined according to the needs of the business corresponding to the main program and the needs of the business corresponding to the associated subprogram.

[0076] For example, after the sub-program is successfully launched, the main program needs to call the sub-program it wants to use, and it needs to associate the main program with the sub-program. The main program's related attributes may include: identification information (such as APPID, etc.), key, access path information, etc. The main program's APPID and the sub-program's APPID can be used to establish an association between the two.

[0077] In some embodiments, the first attribute comprises a key for the access request and the second attribute comprises a key for the subroutine.

[0078] For example, an authentication method may be used to confirm the correctness of the key in the access request, so as to ensure that when the main program issues an access request, the access request of the main program is a legitimate request.

[0079] In some embodiments, the first attribute includes a key of the access request and first access path information of one or more access pages of the access request, and the second attribute includes a key of the subprogram and second access path information of one or more associated pages of the subprogram. Determine whether the subprogram is an associated subprogram of the main program; if the subprogram is an associated subprogram of the main program, determine whether the key of the access request matches the key of the subprogram; if the key of the access request matches the key of the subprogram, determine the judgment result based on whether the first access path information matches the second access path information.

[0080] For example, multiple judgment conditions can be used to determine whether the access request of the main program is legal. Address information and routing information can be used as the main basis for judgment.

[0081] For example, first, confirm whether the main program that makes the access request has an association relationship with the target subprogram; if so, determine whether the keys of the two match; if they match, determine whether the address information and routing information match.

[0082] In the above embodiment, it is ensured that even if a main program user has the authority to access a certain subprogram, he cannot arbitrarily access the associated pages of other subprograms, thereby improving security.

[0083] For example, if a user accesses subprogram A (associated pages are 1, 4, 7, 9, and 11) through the main program, the above association relationship judgment, key matching judgment, and address information matching judgment have been passed, indicating that the main program is a legitimate main program. However, if the user requests to access pages 1, 4, 7, 9, and 11, such as page 2, through the main program by modifying the path or other illegal methods, the routing information matching judgment cannot be passed. In this case, the access request initiated by the main program is judged as an illegal request and is directly rejected by the system. Thus, data security and access security are guaranteed.

[0084] After the attribute matching judgment is made, you can continue to Figure 1 The remaining steps in the control of access.

[0085] In step 130, if the result of the determination is a match, the user is allowed to access the subprogram.

[0086] In some embodiments, the access control method further includes: if the judgment result is a mismatch, denying the main program access to the subprogram, retaining an error log, and prompting the user that the access request is an illegal request and / or requiring the user to return to the previous page.

[0087] For example, if the access request initiated by the user through the main program is a legitimate request, the access request is allowed through permission judgment; if it is an illegal request, access is denied. Logs can be generated based on the judgment results and retained for auditing purposes, thereby improving security.

[0088] In some embodiments, during the system processing stage, access requests that pass the authority judgment may be allowed to perform logical access, and traces may be recorded to complete the entire request chain.

[0089] Figure 3 A flowchart of a program deployment method according to some embodiments of the present disclosure is shown.

[0090] like Figure 3As shown, in step 310, the attributes of the subprogram are configured according to the relevant information of the business corresponding to the subprogram. The attributes of the subprogram are used to determine whether the user who initiates the access request through the main program is allowed to access the subprogram.

[0091] In some embodiments, the attributes of the subprogram include access path information of one or more associated pages of the subprogram.

[0092] In some embodiments, the access path information includes address information of each of the one or more associated pages, and the related information includes business requirements. According to the business requirements, the association relationship between the subprogram and the one or more associated pages is determined.

[0093] In some embodiments, the one or more associated pages include multiple associated pages, the access path information includes routing information between each of the multiple associated pages, and the related information includes a processing logic of the business. The access path information is determined according to the processing logic of the business.

[0094] In some embodiments, whether a subprogram has an association relationship with at least one main program is determined based on the business requirements of the subprogram and the business requirements of at least one main program. The association relationship is used to determine whether the main program initiating the access request is allowed to access the subprogram.

[0095] In step 320, the subroutine is encapsulated using the attribute as a label.

[0096] Figures 4a to 4e A flowchart of a program deployment method and an access control method according to some embodiments of the present disclosure is shown.

[0097] like Figure 4a As shown, in step S1, relevant processing of the subroutine configuration phase is performed, that is, configuration initialization is completed.

[0098] For example, you can configure the properties of the subprogram at the code level, and initialize the Appid, key, address information, and routing information. In this way, you can logically isolate the associated pages of each subprogram in advance by configuring the properties, thereby improving access security.

[0099] In step S2, the relevant processing of the main program and sub-program association stage is performed.

[0100] For example, after completing the configuration initialization, the subprogram is put on the open platform according to the attributes of the subprogram; according to the business authority of the main program in the actual business situation, the main program is associated with the relevant subprograms to establish an association relationship as a basis for judgment in the access request judgment stage.

[0101] The main tasks of the main program and sub-program association phase include: After the sub-program is successfully launched, the main program needs to call the sub-program it wants to use, and it is necessary to associate the main program with the sub-program. The main program's related attributes may include: identification information (such as APPID, etc.), key, access path information, etc. The APPID of the main program and the APPID of the sub-program can be used to establish an association between the two.

[0102] In step S3, relevant processing of the access request judgment phase is performed.

[0103] For example, the system determines whether the access page corresponding to the access request initiated by the user through the main program is a page outside the logical isolation configured in the configuration initialization phase based on the pre-configured attributes such as the association relationship between the main program and the subprogram, address information, and routing information.

[0104] In this way, it is possible to verify secure access and ensure that the access request is a legitimate request. If it is illegal, it is directly rejected, thereby improving security.

[0105] The access request judgment phase mainly involves judging whether the access request of the main program is legal through multiple judgment conditions. Address information and routing information can be used as the main basis for judgment.

[0106] In step S4, the relevant processing of the system processing stage is performed. The main task of this stage is to realize the logical access of the access request that has passed the verification, record the trace, and complete the entire request link.

[0107] In the above embodiment, not only the authentication problem of subprogram access is solved, but also the problem of illegal page access to multiple subprograms in the same system package is solved. Through the attribute configuration of the subprogram, the subprograms developed by the developer can be logically isolated at the code level; if there is illegal intrusion access from the outside, a blacklist rule is set to ensure the access security and data security of the micro-application itself.

[0108] like Figure 4b As shown, step S1 can be implemented through steps S11 to S14.

[0109] In step S11, business requirements are obtained, and the purpose of the subprogram is preliminarily determined based on the business requirements. For example, this step mainly determines which business scenarios the subprogram involves, which program pages it will be associated with, and so on.

[0110] For example, a main program has many sub-program projects, and users need the functions of two of the sub-programs - real-name authentication and device binding. The pages of these two functions are partly the same and partly different.

[0111] Although both subprograms need to load the customer's personal information, the subsequent operations of the two subprograms are different, resulting in different associated pages. According to the different scenarios of business needs corresponding to the subprograms, the scenarios that should be implemented in this configuration phase can be clarified. In order to avoid page jump errors between the two subprograms, it is necessary to configure the associated pages of the subprograms to improve the security of page access.

[0112] In step S12, a subprogram is defined. According to the acquisition result of S11, the pages involved in the subprogram are screened out, and the association relationship between different pages is defined according to the actual business logic.

[0113] For example, when the business requirements include real-name authentication requirements, the association relationship between pages (including routing information) is determined according to the business processing logic and the product flow designed by the product prototype. In this way, the user's authority can be limited to the association relationship, thereby completing the determination of the business processing flow of the subprogram.

[0114] In step S13, the modular configuration of the subprogram is performed. The attributes of the subprogram can be used as the labels of the subprogram, and the subprogram can be configured in the order of configuration processing (such as Figure 4c ), modular configuration and encapsulation at the code level.

[0115] In step S14, the subprograms are packaged and compiled. The three packaged subprograms can be packaged into three subprogram packages and put on the system.

[0116] like Figure 4c As shown, step S13 can be implemented through steps S131 to S134.

[0117] In step 131, identification information of the subprogram may be configured. For example, the identification information may include information such as APPID that can uniquely identify the subprogram.

[0118] In step 132, the keys of the subprogram may be configured. For example, the keys may include a public key and a private key.

[0119] In step 133, the address information of the subprogram may be configured. For example, the address information may include the URL of the associated page, etc.

[0120] In step 134, routing information of the subroutine may be configured.

[0121] For example, the developer of a subprogram has developed three subprograms, namely, subprogram A, B, and C. These three subprograms contain a total of 12 pages, represented by numbers 1 to 12. Now, these three subprograms need to be listed on the open platform.

[0122] According to the business requirements of subprogram A, its associated pages are determined to include 1, 4, 7, 9 and 11, and the address information of these pages can be determined; according to the processing logic of the business of subprogram A, its corresponding page access order, that is, routing information, is determined to be 1, 4, 7, 9 and 11.

[0123] For example, according to the business requirements of subprogram B, its associated pages are determined to include 1, 2, 6, 9 and 12, and then the address information of these pages can be determined; according to the processing logic of the business of subprogram B, its corresponding page access order, that is, routing information, is determined to be 1, 2, 6, 9 and 12.

[0124] For example, according to the business requirements of subprogram C, its associated pages are determined to include 1, 3, 5, 8 and 10, and the address information of these pages can be determined; according to the processing logic of the business of subprogram C, its corresponding page access order, that is, routing information, is determined to be 1, 3, 5, 8 and 10.

[0125] In the above embodiment, since each subprogram corresponds to different services, the logical relationship of its associated page (such as routing information) is also different, so the logical relationship corresponding to the subprogram is associated and pre-configured with address information and routing information at the code level. In this way, the modular configuration of the subprogram can be completed according to business requirements and configuration procedures to control user access to the subprogram, thereby improving security.

[0126] like Figure 4d As shown, step S3 can be implemented through steps S31 to S37.

[0127] In step 31, it is determined whether the main program making the access request has an association relationship with the target subprogram. If so, step S32 is executed; otherwise, step S35 is executed.

[0128] In step S32, it is determined whether the public key and private key of the subprogram and the access request match. If they match, step S33 is executed; otherwise, step S35 is executed.

[0129] In step S33, it is determined whether the address information of the access request matches the address information of the subroutine. If they match, step S34 is executed; otherwise, step S35 is executed.

[0130] In step S34, it is determined whether the routing information of the access request matches the routing information of the subprogram. If they match, step S36 is executed; otherwise, step S35 is executed.

[0131] In step S35, the access request is denied.

[0132] In step S36, the access request is passed.

[0133] In step S37, a log is generated based on the judgment result and retained for auditing purposes.

[0134] In the above embodiment, it is ensured that even if a main program user has the authority to access a certain subprogram, he cannot arbitrarily access the associated pages of other subprograms, thereby improving security.

[0135] For example, if a user accesses subprogram A (associated pages are 1, 4, 7, 9, and 11) through the main program, the above association relationship judgment, key matching judgment, and address information matching judgment have been passed, indicating that the main program is a legitimate main program. However, if the user requests to access pages 1, 4, 7, 9, and 11, such as page 2, through the main program by modifying the path or other illegal methods, the routing information matching judgment cannot be passed. In this case, the access request initiated by the main program is judged as an illegal request and is directly rejected by the system. Thus, data security and access security are guaranteed.

[0136] like Figure 4d As shown, the main program obtains the front-end access request proposed by the user; the subroutine determines whether the access request is legal; if it is legal, it jumps to the page corresponding to the access request to complete the jump of the access request; if it is illegal, an Error alarm is issued and access is denied; the access request is judged to be an illegal access request, and the user is prompted to return to the previous page.

[0137] In the above embodiment, in order to solve the data access security problem in the subprogram open platform, the subprogram's attribute configuration is performed at the code level to ensure the data access security of the subprogram.

[0138] In some embodiments, the method for encapsulating the associated pages of a subroutine includes not only encapsulation of individual pages, but also encapsulation in groups of two or three.

[0139] In the above embodiment, logical access is allowed for access requests that have passed verification, and traces are recorded to complete the entire request chain; if the access request fails verification, it is determined to be an illegal request, access is denied, and error logs are retained to prevent data tampering.

[0140] In the above embodiment, not only the access authentication and other permissions are processed, but also the subroutine request legitimacy is judged based on the address information and routing information. The judgment basis is pre-configured at the code layer, making the judgment condition more accurate and practical, thereby improving security.

[0141] In the above embodiment, multiple levels of judgment conditions are configured to ensure the security and legality of the data.

[0142] Figure 5a to 5cA schematic diagram showing a program deployment page according to some embodiments of the present disclosure.

[0143] like Figure 5a As shown, the subprogram association page includes: a main program information area, which is used to display the name of the main program and other related information; a subprogram list, which is used to display the name, ID and listing status of the subprogram to be associated.

[0144] For example, in response to the user selecting a subprogram in the subprogram list, the page jumps to the subprogram information page of the subprogram.

[0145] like Figure 5b As shown, the subprogram information page includes a subprogram information area for displaying the subprogram's name, ID, key, access path and other attributes and related information.

[0146] For example, in response to the operation of putting the packaged sub-program on the shelves, jump to the sub-program review page.

[0147] like Figure 5c As shown, the subprogram review page includes: a reviewed subprogram information area, which is used to display relevant information of the subprogram and review information, etc.

[0148] Figure 6 A block diagram of an access control device according to some embodiments of the present disclosure is shown.

[0149] like Figure 6 As shown, the access control device 6 includes: a receiving unit 61, which is used to receive an access request for a subprogram initiated by a user through a main program; a judgment unit 62, which is used to determine a judgment result based on whether a first attribute of the access request matches a second attribute of the subprogram, and the second attribute is determined based on relevant information of the business corresponding to the subprogram; and a control unit 63, which is used to allow the user to access the subprogram when the judgment result is a match.

[0150] In some embodiments, the first attribute includes first access path information of one or more access pages of the access request, and the second attribute includes second access path information of one or more associated pages of the subroutine.

[0151] In some embodiments, the first access path information includes address information of each of the one or more access pages, and the second access path information includes address information of each of the one or more associated pages.

[0152] In some embodiments, one or more access pages include multiple access pages, the first access path information includes routing information between each of the multiple access pages, one or more associated pages include multiple associated pages, and the second access path information includes routing information between each of the multiple associated pages.

[0153] In some embodiments, the relevant information includes business requirements, and the association relationship between the subprogram and one or more associated pages is determined according to the business requirements.

[0154] In some embodiments, the business includes multiple sub-businesses, the related information includes the processing order of the multiple sub-businesses, and the routing information between each of the multiple associated pages is determined according to the processing order of the sub-businesses.

[0155] In some embodiments, the determination unit 62 determines the determination result according to whether the subprogram is an associated subprogram of the main program.

[0156] In some embodiments, the association relationship between the main program and the associated sub-program is determined according to the needs of the business corresponding to the main program and the needs of the business corresponding to the associated sub-program.

[0157] In some embodiments, the first attribute comprises a key for the access request and the second attribute comprises a key for the subroutine.

[0158] In some embodiments, the first attribute includes a key of the access request and first access path information of one or more access pages of the access request, and the second attribute includes a key of the subprogram and second access path information of one or more associated pages of the subprogram. The judgment unit 62 judges whether the subprogram is an associated subprogram of the main program; if the subprogram is an associated subprogram of the main program, it judges whether the key of the access request matches the key of the subprogram; if the key of the access request matches the key of the subprogram, it determines the judgment result according to whether the first access path information matches the second access path information.

[0159] In some embodiments, the subprogram is packaged according to the following steps: determining one or more associated pages of the subprogram according to the business requirements corresponding to the subprogram; configuring the second attribute for the subprogram according to the one or more associated pages; and packaging the subprogram using the second attribute as a label.

[0160] In some embodiments, the access control method further includes: if the judgment result is a mismatch, denying the main program access to the subprogram, retaining an error log, and prompting the user that the access request is an illegal request and / or requiring the user to return to the previous page.

[0161] Figure 7 A block diagram showing a program deployment apparatus according to some embodiments of the present disclosure.

[0162] like Figure 7As shown, the program deployment device 7 includes: a configuration unit 71, which is used to configure the attributes of the subprogram according to the relevant information of the business corresponding to the subprogram, and the attributes of the subprogram are used to determine whether the user who initiates the access request through the main program is allowed to access the subprogram; an encapsulation unit 72, which is used to encapsulate the subprogram with the attributes as labels.

[0163] In some embodiments, the attributes of the subprogram include access path information of one or more associated pages of the subprogram.

[0164] In some embodiments, the access path information includes address information of each of the one or more associated pages, and the related information includes business requirements. The configuration unit 71 determines the association relationship between the subprogram and the one or more associated pages according to the business requirements.

[0165] In some embodiments, the one or more associated pages include multiple associated pages, the access path information includes routing information between each of the multiple associated pages, the business includes multiple sub-businesses, the related information includes a processing order of the multiple sub-businesses, and the routing information between each of the multiple associated pages is determined according to the processing order. The configuration unit 71 determines the access path information according to the processing order of the sub-businesses.

[0166] In some embodiments, the configuration unit 71 determines whether a subprogram has an association relationship with at least one main program based on the business requirements corresponding to the subprogram and the business requirements corresponding to at least one main program. The association relationship is used to determine whether the main program initiating the access request is allowed to access the subprogram.

[0167] Figure 8 A block diagram of an electronic device according to some embodiments of the present disclosure is shown.

[0168] like Figure 8 As shown, the electronic device 8 includes a configuration unit 81 , an acquisition unit 82 , a judgment unit 83 and a control unit 84 .

[0169] The configuration unit 81 defines and configures the attributes of the subprogram at the code level according to business requirements. For example, the APPID, key, address information and routing information can be initialized, and the pages required by the subprogram can be logically isolated through configuration to complete the configuration function.

[0170] The acquisition unit 82 acquires attributes of the access request, including APPID, key, address information, routing information, etc., as a basis for the judgment of the judgment unit.

[0171] The judgment unit 83 uses the data acquired by the acquisition unit 82 as a judgment basis, and performs matching and judgment when the acquisition unit 82 transmits the acquired data. For example, it can confirm whether the access request is legal according to the judgment process and pass the result to the control unit 84.

[0172] After obtaining the judgment result, the control unit 84 implements the logical access of the verified access request, records the trace, and completes the entire request chain; if the access request fails to pass the verification and is judged to be an illegal request, the access is denied and the error log is retained.

[0173] In the above embodiment, access security and data security between multiple pages of subprograms in the same system package are guaranteed.

[0174] Fig. 9 A block diagram showing some other embodiments of the electronic device of the present disclosure.

[0175] As shown in FIG. 5 , the electronic device 9 of this embodiment includes: a memory 91 and a processor 92 coupled to the memory 91 , and the processor 92 is configured to execute the access control method or program deployment method in any embodiment of the present disclosure based on instructions stored in the memory 91 .

[0176] The memory 91 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, a database, and other programs.

[0177] Fig.10 The following is a block diagram showing some further embodiments of the electronic device of the present disclosure.

[0178] like Fig.10 As shown, the electronic device 10 of this embodiment includes: a memory 1010 and a processor 1020 coupled to the memory 1010 , and the processor 1020 is configured to execute the access control method or program deployment method in any one of the aforementioned embodiments based on instructions stored in the memory 1010 .

[0179] The memory 1010 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, and other programs.

[0180] The electronic device 10 may also include an input / output interface 1030, a network interface 1040, a storage interface 1050, etc. These interfaces 1030, 1040, 1050, the memory 1010, and the processor 1020 may be connected, for example, via a bus 1060. The input / output interface 1030 provides a connection interface for input / output devices such as a display, a mouse, a keyboard, a touch screen, a microphone, and a speaker. The network interface 1040 provides a connection interface for various networked devices. The storage interface 1050 provides a connection interface for external storage devices such as an SD card and a USB flash drive.

[0181] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0182] So far, the present invention has been described in detail. In order to avoid obscuring the concept of the present invention, some details known in the art are not described. Based on the above description, those skilled in the art can fully understand how to implement the technical solution disclosed here.

[0183] The method and system of the present disclosure may be implemented in many ways. For example, the method and system of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0184] Although some specific embodiments of the present disclosure have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present disclosure. It should be understood by those skilled in the art that the above embodiments may be modified without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. An access control method, comprising: Receive access requests to subprograms initiated by users through the main program; determining a judgment result according to whether a first attribute of the access request matches a second attribute of the subprogram, wherein the second attribute is determined according to relevant information of a business corresponding to the subprogram; In the case where the determination result is a match, the user is allowed to access the subprogram.

2. The access control method according to claim 1, wherein: The first attribute includes first access path information of one or more access pages of the access request, and the second attribute includes second access path information of the one or more associated pages.

3. The access control method according to claim 2, wherein: The first access path information includes address information of each of the one or more access pages, and the second access path information includes address information of each of the one or more associated pages.

4. The access control method according to claim 2, wherein: The one or more access pages include multiple access pages, the first access path information includes routing information between each of the multiple access pages, the one or more associated pages include multiple associated pages, and the second access path information includes routing information between each of the multiple associated pages.

5. The access control method according to claim 2, wherein: The related information includes the business requirements, and the association relationship between the subprogram and the one or more associated pages is determined according to the business requirements.

6. The access control method according to claim 4, wherein: The service includes multiple sub-services, the related information includes a processing order of the multiple sub-services, and the routing information between each of the multiple associated pages is determined according to the processing order.

7. The access control method according to any one of claims 1 to 6, wherein: The determination result includes: The judgment result is determined according to whether the subprogram is an associated subprogram of the main program.

8. The access control method according to claim 7, wherein: The association relationship between the main program and the associated subprogram is determined according to the needs of the business corresponding to the main program and the needs of the business corresponding to the associated subprogram.

9. The access control method according to any one of claims 1 to 6, wherein: The first attribute comprises a key of the access request, and the second attribute comprises a key of the subroutine.

10. The access control method according to any one of claims 1 to 6, wherein: The first attribute includes the key of the access request and first access path information of one or more access pages of the access request, the second attribute includes the key of the subprogram and second access path information of one or more associated pages of the subprogram, and the determination result includes: Determining whether the subprogram is an associated subprogram of the main program; In the case where the subprogram is an associated subprogram of the main program, determining whether the key of the access request matches the key of the subprogram; In the case where the key of the access request matches the key of the subprogram, the judgment result is determined according to whether the first access path information matches the second access path information.

11. The access control method according to any one of claims 1 to 6, wherein: The subroutine is packaged according to the following steps: Determine one or more associated pages of the subprogram according to the business requirements corresponding to the subprogram; configuring the second attribute for the subprogram according to the one or more associated pages; The subroutine is encapsulated using the second attribute as a label.

12. The access control method according to any one of claims 1 to 6, wherein: The subprogram is one of a plurality of subprograms to be accessed, and each of the plurality of subprograms to be accessed is encapsulated and packaged respectively.

13. The access control method according to any one of claims 1 to 6, further comprising: When the judgment result is mismatch, the main program is denied access to the subprogram, an error log is retained, and the user is prompted that the access request is an illegal request and / or the user is required to return to the previous page.

14. A program deployment method, comprising: According to the relevant information of the business corresponding to the subprogram, configure the attribute of the subprogram, and the attribute of the subprogram is used to determine whether to allow the user who initiates the access request through the main program to access the subprogram; The subroutine is encapsulated using the attribute as a label.

15. The program deployment method according to claim 14, wherein: The attributes of the subprogram include access path information of one or more associated pages of the subprogram.

16. The program deployment method according to claim 15, wherein: The access path information includes address information of each of the one or more associated pages, the related information includes the business requirements, and configuring the attributes of the subprogram according to the related information of the business corresponding to the subprogram includes: According to the business requirements, an association relationship between the subprogram and the one or more associated pages is determined.

17. The program deployment method according to claim 15, wherein: The one or more associated pages include multiple associated pages, the access path information includes routing information between each of the multiple associated pages, the service includes multiple sub-services, the related information includes a processing order of the multiple sub-services, and configuring the attributes of the sub-program according to the related information of the service corresponding to the sub-program includes: The access path information is determined according to the processing order of the multiple sub-services.

18. The program deployment method according to any one of claims 14 to 17, further comprising: According to the business requirements corresponding to the subprogram and the business requirements corresponding to at least one main program, it is determined whether the subprogram has an association relationship with the at least one main program, and the association relationship is used to determine whether the main program that initiates the access request is allowed to access the subprogram.

19. An access control device, comprising: A receiving unit, used for receiving an access request for a subprogram initiated by a user through a main program; a judgment unit, configured to determine a judgment result according to whether a first attribute of the access request matches a second attribute of the subprogram, wherein the second attribute is determined according to relevant information of a business corresponding to the subprogram; A control unit is used to allow the user to access the subprogram when the judgment result is a match.

20. A program deployment device, comprising: A configuration unit, configured to configure the attributes of the subprogram according to the relevant information of the business corresponding to the subprogram, wherein the attributes of the subprogram are used to determine whether to allow a user who initiates an access request through the main program to access the subprogram; The encapsulation unit is used to encapsulate the subroutine using the attribute as a label.

21. An electronic device, comprising: Memory; and A processor coupled to the memory, the processor being configured to execute the access control method according to any one of claims 1 to 13 or the program deployment method according to any one of claims 14 to 18 based on instructions stored in the memory device.

22. A non-volatile computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the access control method according to any one of claims 1 to 13 or the program deployment method according to any one of claims 14 to 18 is implemented.

Images