Data access control method, device, system and storage medium

Abstract

The present application relates to the field of communications, and in particular to a data access control method, device, system and storage medium. The method includes: obtaining a login request from a user terminal, the login request including the IP information and account information of the user terminal; determining the current service node accessed by the user terminal according to the IP information; determining the registration node set associated with the account information according to the correspondence between the account information and the registration node set pre-set in the global table; when the current service node does not match the registration node set, determining the target node according to the registration node set, and accessing data according to the target node; when the current service node matches the registration node set, using the current service node as the target node, and accessing data according to the target node. The method can effectively adapt to the data security regulations of different regions, and is conducive to improving the security of data of service nodes.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a data access control method, device, system and storage medium. Background Art

[0002] In some business scenarios, the company's products are widely sold to many countries and regions around the world. Since each country or region has its own unique laws and regulations, these regulations restrict the sharing and interoperability of user data and device information between different countries. For example, due to the laws and regulations of region A and region B, the device data counted by region A and region B cannot be synchronized. Therefore, the data returned when users access different nodes may be different.

[0003] Traditional distributed routing solutions or distributed database systems, although they perform well in data distribution and management, often lack adaptability to differences in regulations in different countries. These systems are usually designed to process and store data indiscriminately, and cannot effectively adapt to data security regulations in different regions, which is not conducive to improving the security of device data. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a data access control method, device, system and storage medium to solve the problem that the prior art cannot effectively adapt to the data security regulations of different regions, which is not conducive to improving the security of device data.

[0005] A first aspect of an embodiment of the present application provides a data access control method, the method comprising:

[0006] Obtaining a login request from a user terminal, the login request including the IP information and account information of the user terminal;

[0007] Determine the current service node accessed by the user terminal according to the IP information;

[0008] According to the correspondence between the account information and the registered node set preset in the global table, determining the registered node set associated with the account information;

[0009] When the current service node does not match the registered node set, a target node is determined according to the registered node set, and data is accessed according to the target node;

[0010] When the current service node matches the registered node set, the current service node is used as the target node, and data access is performed according to the target node.

[0011] In combination with the first aspect, in a first possible implementation manner of the first aspect, before determining the registration node set associated with the account information according to the correspondence between the account information and the registration node set preset in the global table, the method further includes:

[0012] Obtaining a registration request from a user terminal, the registration request including user device information and account information requested to be registered by the user terminal;

[0013] Determine the above-mentioned registration node set according to the above-mentioned user equipment information;

[0014] A correspondence between the above account information and the above registered node set is established.

[0015] In combination with the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, determining the registration node set according to the user equipment information includes:

[0016] Acquire the first location information of the user equipment;

[0017] Determine a first area to which the first location information of the user equipment belongs;

[0018] According to a preset correspondence relationship between regions and service node sets, the service node set corresponding to the first region is determined to be the registration node set corresponding to the account information.

[0019] In combination with the second possible implementation manner of the first aspect, in a third possible implementation manner of the first aspect, before determining, according to a preset correspondence relationship between regions and service node sets, that the service node set corresponding to the first region is the registration node set corresponding to the account information, the method further includes:

[0020] Determining second location information of the user terminal according to the IP information of the user terminal;

[0021] When both the second location information and the first location information belong to the first area, determining the service node set corresponding to the first area as the registration node set corresponding to the account information according to the preset correspondence relationship between the area and the service node set;

[0022] When the second location information and the first location information belong to different areas, the registration request of the user terminal is rejected.

[0023] In combination with the first aspect, in a fourth possible implementation manner of the first aspect, accessing data according to the target node includes:

[0024] Determine the first menu information corresponding to the account information of the login request according to the preset correspondence between the account information and the menu information;

[0025] Performing data access to the target node according to the first menu information;

[0026] Alternatively, according to a preset correspondence between the account information and the authority information, role information and group information, determine the first authority information, first role information and first group information corresponding to the account information of the login request;

[0027] Data access is performed on the target node according to the first permission information, the first role information and the first grouping information.

[0028] In combination with the first aspect, in a fifth possible implementation manner of the first aspect, determining the target node according to the registered node set includes:

[0029] Determining second location information of the user terminal according to the IP information of the user terminal;

[0030] According to the third position information of the registered nodes in the registered node set, a registered node whose third position information is closest to the second position information is determined as a target node.

[0031] In combination with any one of the first aspect to the fifth possible implementation manner of the first aspect, in a sixth possible implementation manner of the first aspect, the current service node does not match the registered node set, including:

[0032] The current service node is different from any registration node in the registration node set;

[0033] The above current service node matches the above registered node set, including:

[0034] The current service node is different from a registered node in the registered node set.

[0035] A second aspect of an embodiment of the present application provides a data access control device, the device comprising:

[0036] A login request acquisition unit, used to acquire a login request from a user terminal, wherein the login request includes IP information and account information of the user terminal;

[0037] A current service node determining unit, configured to determine the current service node accessed by the user terminal according to the IP information;

[0038] A registration node set determination unit, configured to determine the registration node set associated with the account information according to the correspondence between the account information and the registration node set preset in the global table;

[0039] A first data access unit, configured to determine a target node according to the registered node set when the current service node does not match the registered node set, and perform data access according to the target node;

[0040] The second data access unit is used to, when the current service node matches the registered node set, use the current service node as a target node and perform data access according to the target node.

[0041] A third aspect of an embodiment of the present application provides a data access control system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the methods of the first aspect when executing the computer program.

[0042] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any one of the above methods in the first aspect are implemented.

[0043] Compared with the prior art, the embodiments of the present application have the following beneficial effects: when receiving a login request from a user terminal, the embodiments of the present application determine the current service node accessed by the user terminal based on the IP information in the login request, determine the registered node set of interest based on the account information in the login request, and when the current service node does not match the registered node set, determine the target node for data access based on the registered node set, and when the current service node matches the registered node, use the current service node as the target node for data access, so that the pre-set account information accesses the current service node that matches the registered node set, or accesses data based on the registered node set, thereby being able to effectively adapt to the data security regulations of different regions and being beneficial to improving the security of data at the service nodes. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0045] Figure 1 This is a schematic diagram of a service node application scenario provided by an embodiment of the present application;

[0046] Figure 2 It is a schematic diagram of an implementation flow of a data access control method provided in an embodiment of the present application;

[0047] Figure 3This is a schematic diagram of an implementation process of establishing a corresponding relationship provided in an embodiment of the present application;

[0048] Figure 4 This is a schematic diagram of an implementation process of determining a registration node set based on the location of user equipment information provided by an embodiment of the present application;

[0049] Figure 5 This is a schematic diagram of an implementation flow of verifying a user terminal provided by an embodiment of the present application;

[0050] Figure 6 is a schematic diagram of a data access control device provided in an embodiment of the present application;

[0051] Figure 7 It is a schematic diagram of a data access control system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0053] In order to illustrate the above technical solution of the present application, a specific embodiment is provided below for illustration.

[0054] In some business scenarios, the company's products are widely sold to many countries and regions around the world. Since each country or region has its own unique laws and regulations, these regulations restrict the sharing and interoperability of user data and device information between different countries. For example, in Figure 1 In the application scenario shown, region A includes service node 1, region B includes service node 2 and service node 3, and region C includes service node 4, service node 5 and service node 6. In a common distributed service solution, data in service node 1, service node 2, service node 3, service node 4, service node 5 and service node 6 are synchronized and interoperable, and when a user accesses data at a service node, the data can be routed to any node in the distributed service node, which cannot meet the security requirements for data and device information in different countries or regions.

[0055] The region may be a range of a country, or may include more than two countries. For example, the region of Southeast Asia may include multiple countries.

[0056] In order to solve the above problems, the present application embodiment proposes a data access control method, the execution subject of the method can be a service node in a distributed service network, such as Figure 2 As shown, the method includes:

[0057] In S201, a login request of a user terminal is obtained, where the login request includes IP information and account information of the user terminal.

[0058] The user terminal in the embodiment of the present application may include a mobile terminal, a fixed terminal, etc. The mobile terminal may include, for example, a smart phone, a tablet computer, or a laptop computer, etc. The fixed terminal may include a desktop computer, etc.

[0059] When obtaining the login request of the user terminal, the login request sent by the user terminal can be obtained through the web page of the user terminal, or through the APP of the user terminal. For example, the user terminal can receive the service address through the browser, display the login page according to the service address, and the user terminal receives the login information including account information and sends the login request to the service node. Alternatively, the user terminal can display the login option information through the APP interface, and when the user terminal receives the login information including account information, it sends the login request to the service node.

[0060] The IP information of the user terminal is the IP information of the user terminal that sends the login request, which may include the IP address of the user terminal, etc. The IP information of the user terminal may be obtained through the HTTP header information, or through the built-in IP information acquisition function.

[0061] The account information of the user terminal may include the account number and password used by the user terminal to request login. The account number used by the user terminal to request login has a unique identifier that can be used to distinguish different users. After the service node verifies the account number and password, it can be determined that the account is a registered account.

[0062] In S202, the current service node accessed by the user terminal is determined according to the IP information.

[0063] According to the IP information of the user terminal, the current service node accessed by the user terminal of the IP information can be determined in a variety of ways, including:

[0064] The current service node accessed by the user terminal of the IP information is determined according to the routing policy. The current service node accessed by the user terminal can be determined by capturing and analyzing the network traffic through a network traffic analysis system or a network monitoring tool.

[0065] According to the cache and distribution strategy, the current service node accessed by the user terminal of the IP information is determined. For example, the nearest edge service node can be found according to the IP information of the user terminal as the current service node accessed by the user terminal.

[0066] The current service node accessed by the user terminal refers to the service node accessed by the user terminal at the current moment.

[0067] In S203, the registration node set associated with the account information is determined according to the correspondence between the account information and the registration node set preset in the global table.

[0068] The global table in the embodiment of the present application is a table that records the correspondence between the global registration node set and the account information. The global table can be stored in a separate global table server, and the user stores the correspondence between the account information and the registration node set when the user registers. When it is necessary to access the data in the service node, a data query request can be sent to the global table server to query the registration node set corresponding to the account information. According to the registration node set returned by the global table server, the registration node set corresponding to the account information included in the login request sent by the user terminal can be determined.

[0069] The global table can also be distributed and stored in each service node. When any service node receives a registration request from a user terminal, the corresponding relationship between the account information and the registration node set in the global table is updated according to the registration request of the user terminal, and updated to each service node in two steps.

[0070] The registration node set may include one or more service nodes. Figure 1 As shown, region A includes service node 1. In the corresponding relationship in region A, the registration node set corresponding to the account information includes a single registration node. Region B includes 2 service nodes, namely service node 2 and service node 3. In the corresponding relationship in region B, the registration node set corresponding to the account information includes two registration nodes. Region C includes 3 service nodes, namely service node 4, service node 5 and service node 6. In the corresponding relationship in region B, the registration node set corresponding to the account information includes 3 registration nodes.

[0071] In S204, when the current service node does not match the registered node set, a target node is determined according to the registered node set, and data access is performed according to the target node.

[0072] When the current service node is matched with the registered node set, if any registered node in the registered node set is different from the current service node, it means that the current service node does not match the registered node set.

[0073] For example, the registered node set corresponding to area A includes the registered node 1. If the registered node 1 is different from the current service node, the current service node does not match the registered node set.

[0074] The registration node set corresponding to area B includes registration node 2 and registration node 3. If registration node 2 is different from the current service node, and registration node 3 is different from the current service node, the current service node does not match the registration node.

[0075] The registration node set corresponding to region C includes registration node 4, registration node 5 and registration node 6. If registration node 4 is different from the current service node, registration node 5 is different from the current service node, and registration node 6 is different from the current service node, the current service node does not match the registration node.

[0076] Since the currently accessed node does not match the registered node set, rerouting is required according to the registered node set to access the data of the registered nodes in the registered node set.

[0077] When the registration node set includes more than two registration nodes, the target node currently accessed by the user terminal may be determined according to the distance between the registration node and the user terminal.

[0078] For example, the second location information of the user terminal can be determined based on the IP address of the user terminal, and the distances between the third location information of each registration node in the registration node set and the second location information of the current service node can be calculated in turn based on the third location information of each registration node in the pre-set registration node set, and the registration node corresponding to the third location information with the smallest distance is selected as the target node in the registration node set.

[0079] The target node in the registered node set is not limited to being determined by distance, but may also be determined based on status information such as the number of connections and load of the registered node.

[0080] After the target node is determined, data access to the target node may be performed according to at least one of menu information, authority information, role information and group information of the target node.

[0081] In the embodiment of the present application, the correspondence between menu information, permission information, role information, group information and data content can be preset. For different account information, the corresponding menu information, permission information, role information and group information are different, so that the data content that the account information can access is different, thereby effectively satisfying the control of different account information's access to different data or operation permissions.

[0082] In S205, when the current service node matches the registered node set, the current service node is used as a target node, and data access is performed according to the target node.

[0083] When the current service node is matched with the registered node set, if there is a registered node in the registered node set that is the same as the current service node, it means that the current service node matches the registered node set.

[0084] For example, the registered node set corresponding to area A includes the registered node 1. If the registered node 1 is the same as the current service node, the current service node matches the registered node set.

[0085] The registration node set corresponding to area B includes registration node 2 and registration node 3. If registration node 2 is the same as the current service node, or registration node 3 is the same as the current service node, it means that the current service node matches the registration node.

[0086] The registration node set corresponding to region C includes registration node 4, registration node 5 and registration node 6. If registration node 4 is the same as the current service node, or registration node 5 is the same as the current service node, or registration node 6 is the same as the current service node, then the current service node matches the registration node.

[0087] Since the current access node matches the registered node set, the current service node can be directly used as the target node to access the data in the current service node.

[0088] After the target node is determined, data access to the target node may be performed according to at least one of menu information, authority information, role information and group information of the target node.

[0089] In the embodiment of the present application, the correspondence between menu information, permission information, role information, group information and data content can be preset. For different account information, the corresponding menu information, permission information, role information and group information are different, so that the data content that the account information can access is different, thereby effectively satisfying the control of different account information's access to different data or operation permissions.

[0090] In the embodiment of the present application, in order to make the account information correspond effectively to the registered node set, before determining the registered node set associated with the account information, the following may also be included: Figure 3 The corresponding relationship establishment process shown includes:

[0091] In S301, a registration request of a user terminal is obtained, where the registration request includes user device information and account information requested to be registered by the user terminal.

[0092] When registering at a user terminal, in order to improve the reliability of the user's registered account information, the registration request needs to include the user device information used for viewing or operation. The user device information may include information such as the serial number and verification code of the user device. The user terminal may obtain the user device information by receiving user input or by scanning a QR code.

[0093] In 302, the registration node set is determined according to the user equipment information.

[0094] The location information of the user equipment can be determined according to the user equipment information, and the registration node set can be determined based on the location of the user equipment information. Specifically, Figure 4 As shown, including:

[0095] In S401, first location information of the user equipment is obtained.

[0096] The user equipment in the embodiment of the present application may include devices such as inverters and batteries. During the use of devices such as inverters or batteries, private data may be generated, and the security of the usage data of the user equipment needs to be improved. Therefore, the security of the data of the service node storing the usage data of the user equipment needs to be improved, and the usage data in the user equipment is stored in the service node in the area to which the user equipment belongs.

[0097] Among them, when obtaining the first location information of the user equipment, the location information of the user equipment can be determined according to the positioning device of the user equipment, and the first location information of the user equipment can be determined through a predetermined communication link, including a wireless communication link such as a 2G, 3G, 4G or 5G communication link.

[0098] The positioning device of the user equipment may include a device based on base station positioning. The wireless communication module of the user equipment, including a 4G module, may determine the distance between the user equipment and the wireless communication base station. Since the location information of the wireless communication base station is determined in advance, the first location information of the user equipment may be determined by the distance between two or more wireless positioning base stations and the user equipment.

[0099] In S402, a first area to which the first location information of the user equipment belongs is determined.

[0100] According to the geographical location range corresponding to the pre-defined area, the first area to which the first location information of the user equipment belongs can be searched. For example, the pre-defined area can be the location range where a country is located, or the location range where two or more countries are located, or one of the location ranges of multiple location ranges divided by a country. The set area can include one service node, or more than two service nodes.

[0101] In S403, according to a preset correspondence relationship between regions and service node sets, it is determined that the service node set corresponding to the first region is the registration node set corresponding to the account information.

[0102] The correspondence between the region and the service node may include the correspondence between the region and a single service node, or may include the correspondence between the region and more than two service nodes. According to the correspondence, one or more than two registration nodes included in the registration node set corresponding to the account information may be determined.

[0103] In S303, a correspondence between the account information and the registered node set is established.

[0104] According to the correspondence between the account information and the registered node set in the first area, the correspondence between the account information and the registered node set can be determined, and the correspondence between the account information and one or more registered nodes can be determined.

[0105] In a possible implementation, before determining that the service node set corresponding to the first area is the registration node set corresponding to the account information, the embodiment of the present application may also verify the user terminal, such as Figure 5 As shown, the verification process for the user terminal includes:

[0106] In S501, second location information of the user terminal is determined according to the IP information of the user terminal.

[0107] According to the preset correspondence between IP information and regions, the region to which the IP information of the user terminal belongs can be determined, and the determined region to which the user terminal belongs is used as the second location information.

[0108] For example, based on the IP address in the IP information of the user terminal, determine the IP segment to which the IP address belongs, and based on the correspondence between the IP segment and the area, determine the area to which the IP segment belongs, thereby determining the area to which the IP information of the user terminal belongs, that is, the second location information corresponding to the user terminal.

[0109] In S502, when the second location information and the first location information both belong to the first area, the service node set corresponding to the first area is determined as the registration node set corresponding to the account information according to the preset correspondence between the area and the service node set.

[0110] When the second location information and the first location information belong to the same area, it can be determined that the user terminal and the user equipment are in the same area, and the user terminal is a valid registered user terminal. According to the pre-set correspondence between the area and the service node set, the service node set corresponding to the first area can be determined to be the registration node set corresponding to the above account information.

[0111] The first location information belongs to the first area. When the second location information and the first location information belong to the same area, it means that the second location information also belongs to the first area.

[0112] In S503, when the second location information and the first location information belong to different areas, the registration request of the user terminal is rejected.

[0113] If the second location information and the first location information belong to different areas, it means that the area to which the user terminal belongs is different from the area to which the user device belongs. In order to improve data security, the registration request of the user terminal can be rejected. By verifying the location information of the user terminal and the location information of the user device, the binding of account information outside the area with the registration node set can be effectively reduced, thereby improving the security of the use of relevant data of the user device.

[0114] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0115] Figure 6 A schematic diagram of a data access control device provided in an embodiment of the present application, the device comprising:

[0116] A login request acquisition unit 601 is used to acquire a login request from a user terminal, wherein the login request includes IP information and account information of the user terminal;

[0117] A current service node determining unit 602 is used to determine the current service node accessed by the user terminal according to the IP information;

[0118] A registered node set determining unit 603 is used to determine the registered node set associated with the account information according to the correspondence between the account information and the registered node set preset in the global table;

[0119] A first data access unit 604 is configured to determine a target node according to the registered node set and perform data access according to the target node when the current service node does not match the registered node set;

[0120] The second data access unit 605 is used to, when the current service node matches the registered node set, use the current service node as a target node and perform data access according to the target node.

[0121] Figure 6 The data access control device shown, with Figure 2 The data access control method shown corresponds to.

[0122] Figure 7Schematic diagram of a data access control system provided by an embodiment of the present application. Figure 7 As shown, the data access control system 7 of this embodiment includes: a processor 70, a memory 71, and a computer program 72 stored in the memory 71 and executable on the processor 70, such as a data access control program. When the processor 70 executes the computer program 72, the steps in the above-mentioned data access control method embodiments are implemented. Alternatively, when the processor 70 executes the computer program 72, the functions of the modules / units in the above-mentioned device embodiments are implemented.

[0123] Exemplarily, the computer program 72 may be divided into one or more modules / units, which are stored in the memory 71 and executed by the processor 70 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program 72 in the data access control system 7.

[0124] The data access control system may include, but is not limited to, a processor 70 and a memory 71. Those skilled in the art will appreciate that Figure 7 It is only an example of a data access control system 7 and does not constitute a limitation of the data access control system 7. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the above-mentioned data access control system may also include input and output devices, network access devices, buses, etc.

[0125] The processor 70 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0126] The memory 71 may be an internal storage unit of the data access control system 7, such as a hard disk or memory of the data access control system 7. The memory 71 may also be an external storage device of the data access control system 7, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the data access control system 7. Furthermore, the memory 71 may include both an internal storage unit and an external storage device of the data access control system 7. The memory 71 is used to store the computer program and other programs and data required by the data access control system. The memory 71 may also be used to temporarily store data that has been output or is to be output.

[0127] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the above-mentioned device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0128] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0129] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0130] In the embodiments provided in the present application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are only schematic. For example, the division of the above modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0131] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0132] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0133] If the above-mentioned integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by hardware related to computer program instructions. The above-mentioned computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the above-mentioned computer program includes computer program code, and the above-mentioned computer program code can be in source code form, object code form, executable file or some intermediate form. The above-mentioned computer-readable medium may include: any entity or device capable of carrying the above-mentioned computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the above-mentioned computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0134] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some of the technical features therein by equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A data access control method, characterized in that: The execution subject of the method is a service node in a distributed service network, and the method includes: Obtaining a login request from a user terminal, wherein the login request includes IP information and account information of the user terminal; Determine the current service node accessed by the user terminal according to the IP information; Determine the registration node set associated with the account information according to the correspondence between the account information and the registration node set preset in the global table; When the current service node does not match the registered node set, determining a target node according to the registered node set, and performing data access according to the target node; When the current service node matches the registered node set, using the current service node as a target node, and performing data access according to the target node; Before determining the registration node set associated with the account information according to the correspondence between the account information and the registration node set preset in the global table, the method further includes: Obtaining a registration request from a user terminal, the registration request including user device information and account information requested to be registered by the user terminal; Determine the registration node set according to the user equipment information; Establishing a correspondence between the account information and the registration node set; Determining the registration node set according to the user equipment information includes: Acquire first location information of a user equipment, where the user equipment is an inverter or a battery, and determine the first location information of the user equipment through a wireless communication link; Determine a first area to which the first location information of the user equipment belongs; According to a preset correspondence relationship between regions and service node sets, the service node set corresponding to the first region is determined as the registration node set corresponding to the account information.

2. The method according to claim 1, characterized in that Before determining, according to a preset correspondence relationship between regions and service node sets, that the service node set corresponding to the first region is the registration node set corresponding to the account information, the method further includes: Determining second location information of the user terminal according to the IP information of the user terminal; When both the second location information and the first location information belong to the first area, determining the service node set corresponding to the first area as the registration node set corresponding to the account information according to a preset correspondence relationship between the area and the service node set; When the second location information and the first location information belong to different areas, rejecting the registration request of the user terminal.

3. The method according to claim 1, characterized in that Accessing data according to the target node includes: Determine the first menu information corresponding to the account information of the login request according to the preset correspondence relationship between the account information and the menu information; Performing data access on the target node according to the first menu information; Alternatively, according to a preset correspondence between the account information and the authority information, role information and group information, determining the first authority information, first role information and first group information corresponding to the account information of the login request; Data is accessed to the target node according to the first authority information, the first role information and the first grouping information.

4. The method according to claim 1, characterized in that: Determining a target node according to the registered node set includes: Determining second location information of the user terminal according to the IP information of the user terminal; According to the third location information of the registered nodes in the registered node set, a registered node whose third location information is closest to the second location information is determined as a target node.

5. The method according to any one of claims 1 to 4, characterized in that: The current service node does not match the registered node set, including: The current service node is different from any registration node in the registration node set; The current service node matches the registered node set, including: The current serving node is different from a registered node in the registered node set.

6. A data access control device, characterized in that: The execution subject of the device is a service node in a distributed service network, and the device includes: A login request acquisition unit, used to acquire a login request from a user terminal, wherein the login request includes IP information and account information of the user terminal; A current service node determining unit, configured to determine a current service node accessed by the user terminal according to the IP information; A registered node set determining unit, configured to determine the registered node set associated with the account information according to the correspondence between the account information and the registered node set preset in the global table; A first data access unit, configured to determine a target node according to the registered node set and perform data access according to the target node when the current service node does not match the registered node set; A second data access unit, configured to, when the current service node matches the registered node set, use the current service node as a target node and perform data access according to the target node; The device is also used to obtain a registration request from a user terminal, the registration request includes user equipment information and account information for which the user terminal requests registration; determine the registration node set based on the user equipment information; establish a correspondence between the account information and the registration node set; determine the registration node set based on the user equipment information, including: obtaining first location information of the user equipment, where the user equipment is an inverter or a battery, and determining the first location information of the user equipment through a wireless communication link; determining a first area to which the first location information of the user equipment belongs; and determining, based on a pre-set correspondence between an area and a service node set, that the service node set corresponding to the first area is the registration node set corresponding to the account information.

7. A data access control system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images