Unified autonomous access service system for enterprise mobile office
By designing a unified autonomous access service system, combined with Spring Cloud Gateway, Nacos, Redis, RabbitMQ and RBAC/ABAC modules, the data storage insecure and permission management problems in enterprise mobile offices are solved, and flexible routing management and multiple permission control are realized. , simplifies third-party service integration and improves the satisfaction of system security and personalized functions.
Patent Information
- Application Number
- CN202411236795.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-04
- Publication Date
- 2024-12-24
AI Technical Summary
In the mobile office of enterprises, there are problems such as insufficient data storage, rapid integration of third-party services and multi-authority combination management and control, resulting in the risk of data leakage and functions that do not meet personalized needs.
A unified autonomous access service system was designed, including a login unit, an access unit, a business application unit, a data processing unit, a permission control unit and a logging unit. Spring Cloud Gateway is used as a gateway service, combining Nacos registration module and Token authentication Module, using Redis and RabbitMQ for data processing, and implements multiple permission control through RBAC and ABAC modules.
It realizes dynamic management of routing policies, arbitrary combination of multiple permissions, simplifies the integration process of third-party services, improves system flexibility and operation and maintenance efficiency, and ensures the satisfaction of data security and personalized functions.
Smart Images
Figure CN119182572A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of enterprise mobile office, and in particular to a unified autonomous access service system for enterprise mobile office. Background Art
[0002] With the rapid development of information technology and the widespread popularity of mobile devices, enterprise mobile office has become an indispensable driving force for improving work efficiency and strengthening team collaboration. Although the existing enterprise mobile office has greatly simplified the development process and improved implementation efficiency by integrating third-party platforms, it still faces a series of challenges, including but not limited to the difficulty in fully realizing personalized customization functions, data security concerns, and uncertain risks that may be caused by high dependence on third parties. These have become bottlenecks that restrict its effectiveness and widespread application.
[0003] When enterprise data is stored on third-party servers through third-party platforms, there may be risks of data leakage or abuse. Although these platforms claim to have strict security measures, the control of enterprises over data is weakened. In addition, the functions and services provided by third-party platforms are standardized and it is difficult to fully meet the personalized needs of enterprises. If enterprises have special workflows or business needs, they may need to compromise or incur additional development costs to integrate. Finally, enterprises are highly dependent on third-party platforms. Once the platform fails, service is interrupted, or policy changes occur, it may directly affect the normal operation of the enterprise, and the enterprise lacks direct control and response measures. Therefore, in response to the above problems, a unified autonomous access service system for enterprise mobile office is proposed. Summary of the invention
[0004] In this embodiment, a unified autonomous access service system for enterprise mobile office is provided to solve the problems in the prior art of insufficient security of data storage, inability to quickly integrate third-party services and perform management and control of multiple authority combinations.
[0005] According to one aspect of the present application, a unified autonomous access service system for enterprise mobile office is provided, including a login unit, an access unit, a business application unit, a data processing unit, a permission control unit and a log recording unit, wherein the login unit is connected to the access unit, the access unit is connected to the business application unit, the business application unit is connected to the data processing unit, the business application unit and the data processing unit are both connected to the permission control unit, and the access unit, the business application unit, the data processing unit and the permission control unit are all connected to the log recording unit.
[0006] Furthermore, the login unit includes an SCG module and a lightweight adaptation module.
[0007] Furthermore, the full name of SCG in the SCG module is Spring Cloud Gateway.
[0008] In this technical solution, Spring Cloud Gateway is used as a gateway service to handle request routing and filtering in the microservice architecture. It provides strategies such as current limiting, degradation, retry, monitoring, and logging to protect services from excessive pressure, and provides backup responses or shuts down some unnecessary functions when the target service fails or there are too many requests to ensure service availability. Spring Cloud Gateway defines which requests should be forwarded to which services by configuring routing rules, and supports the use of filters to modify requests before or after they are routed, achieving fine-grained control of requests.
[0009] Furthermore, the SCG module includes a Nacos registration module and a Token authentication module, and the Nacos registration module and the Token authentication module are connected.
[0010] In this technical solution, Nacos is a platform for service discovery, configuration management, and service governance, which aims to simplify tasks such as service registration, configuration management, and service governance in microservice architecture. Token authentication is a mechanism for identity authentication and authorization. It uses tokens to communicate securely between clients and servers to verify the identity of users and authorize access to protected resources.
[0011] Furthermore, the data processing unit includes a Redis module and a RabbitMQ module.
[0012] Furthermore, the full name of Redis in the Redis module is Remote Dictionary Server.
[0013] In this technical solution, Redis is an open source memory data structure storage system that uses memory to store data and supports multiple data types, such as strings, hashes, lists, sets, ordered sets, etc. Redis supports data persistence and can save data on disk to ensure data security. In addition, Redis also provides atomic operations and transaction functions to ensure data consistency and integrity. RabbitMQ is an open source message broker software (also known as message-oriented middleware) that implements the Advanced Message Queuing Protocol (AMQP). The RabbitMQ server is written in Erlang, and clustering and failover are built on the open telecommunications platform framework. All major programming languages have client libraries that communicate with the proxy interface.
[0014] Furthermore, the authority control unit includes an RBAC module and an ABAC module, and the RBAC module is connected to the ABAC module.
[0015] Furthermore, the full name of RBAC in the RBAC module is Role-Based Access Control.
[0016] In this technical solution, RBAC determines the access rights of users by assigning them predefined roles, and each role is associated with specific permissions. This model is simple and easy to manage, and is suitable for scenarios where permissions need to be assigned quickly. The advantages of RBAC include simplicity, easy management, scalability, and high performance.
[0017] Furthermore, the full name of ABAC in the ABAC module is Attribute-Based Access Control.
[0018] In this technical solution, ABAC determines access rights through attributes (such as resource attributes, environment attributes, user attributes, etc.), which can be creation date, resource owner, file name, data sensitivity, etc. ABAC provides more fine-grained control and can more flexibly respond to changing access requirements, such as limiting HR role personnel to access employee and payroll information at specific times or branches.
[0019] Furthermore, the log recording unit includes a storage module and a query module, and the storage module and the query module are connected.
[0020] The positive and progressive effects of the present invention are:
[0021] 1. The present invention realizes the dynamic management capability of routing policies through the unified gateway design. Administrators can easily add, modify or delete routing rules in the unified interface without restarting the service, and the rules take effect immediately, which greatly improves the system flexibility and operation and maintenance efficiency;
[0022] 2. The system supports any combination of multiple permissions, tailoring access rights for different roles and departments to achieve precise permission management.
[0023] 3. The present invention simplifies the integration process of third-party services, and enterprises can quickly connect existing systems or new services to a unified platform without additional development work. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0025] Figure 1 This is an overall schematic diagram of an embodiment of the present application;
[0026] Figure 2 A schematic diagram of an access unit according to an embodiment of the present application;
[0027] Figure 3 A schematic diagram of a data processing unit according to an embodiment of the present application.
[0028] Figure 4 A schematic diagram of a permission control unit according to an embodiment of the present application.
[0029] Figure 5 A schematic diagram of a log recording unit according to an embodiment of the present application.
[0030] In the figure: 1. Login unit; 2. Access unit; 3. Business application unit; 4. Data processing unit; 5. Permission control unit; 6. Logging unit; 7. SCG module; 8. Nacos registration module; 9. oken authentication module; 10. Lightweight adaptation module; 11. Redis module; 12. RabbitMQ module; 13. RBAC module; 14. ABAC module; 15. Storage module; 16. Query module. DETAILED DESCRIPTION
[0031] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.
[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0033] In the present application, the terms "upper", "lower", "left", "right", "front", "back", "top", "bottom", "inner", "outer", "middle", "vertical", "horizontal", "lateral", "longitudinal" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings. These terms are mainly used to better describe the present application and its embodiments, and are not used to limit the indicated devices, elements or components to have a specific orientation, or to be constructed and operated in a specific orientation.
[0034] In addition, some of the above terms may be used to express other meanings in addition to indicating orientation or positional relationship. For example, the term "on" may also be used to express a certain dependency or connection relationship in some cases. For those of ordinary skill in the art, the specific meanings of these terms in this application can be understood according to specific circumstances.
[0035] In addition, the terms "installed", "set", "provided with", "connected", "connected", and "socketed" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral structure; it can be a mechanical connection, or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be an internal connection between two devices, elements, or components. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.
[0036] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0037] See also Figure 1-3As shown, a unified autonomous access service system for enterprise mobile office includes a login unit 1, an access unit 2, a business application unit 3, a data processing unit 4, an authority control unit 5 and a log recording unit 6, wherein the login unit 1 is connected to the access unit 2, the access unit 2 is connected to the business application unit 3, the business application unit 3 is connected to the data processing unit 4, the business application unit 3 and the data processing unit 4 are both connected to the authority control unit 5, and the access unit 2, the business application unit 3, the data processing unit 4 and the authority control unit 5 are all connected to the log recording unit 6.
[0038] The login unit 1 includes an SCG module 7 and a lightweight adaptation module 10 .
[0039] The full name of SCG in the SCG module 7 is Spring Cloud Gateway.
[0040] As a gateway service, Spring Cloud Gateway is used to handle request routing and filtering in microservice architecture. It provides strategies such as current limiting, degradation, retry, monitoring, and logging to protect services from excessive pressure, and provides backup responses or shuts down some unnecessary functions when the target service fails or there are too many requests to ensure service availability. Spring Cloud Gateway defines which requests should be forwarded to which services by configuring routing rules, and supports the use of filters to modify requests before or after they are routed, achieving fine-grained control of requests.
[0041] The SCG module 7 includes a Nacos registration module 8 and a Token authentication module 9, and the Nacos registration module 8 and the Token authentication module 9 are connected.
[0042] Nacos is a platform for service discovery, configuration management, and service governance. It aims to simplify tasks such as service registration, configuration management, and service governance in microservice architecture. Token authentication is a mechanism for identity authentication and authorization. It uses tokens to communicate securely between clients and servers to verify the identity of users and authorize access to protected resources.
[0043] The data processing unit 4 includes a Redis module 11 and a RabbitMQ module 12 .
[0044] The full name of Redis in the Redis module 11 is Remote Dictionary Server.
[0045] Redis is an open source memory data structure storage system that uses memory to store data and supports multiple data types, such as strings, hashes, lists, sets, ordered sets, etc. Redis supports data persistence and can save data on disk to ensure data security. In addition, Redis also provides atomic operations and transaction functions to ensure data consistency and integrity. RabbitMQ is an open source message broker software (also known as message-oriented middleware) that implements the Advanced Message Queuing Protocol (AMQP). The RabbitMQ server is written in Erlang, and clustering and failover are built on the open telecommunications platform framework. All major programming languages have client libraries that communicate with the broker interface.
[0046] The authority control unit 5 includes a RBAC module 13 and an ABAC module 14 , and the RBAC module 13 is connected to the ABAC module 14 .
[0047] The full name of RBAC in the RBAC module 13 is Role-Based Access Control.
[0048] RBAC determines access rights by assigning users predefined roles, with each role associated with specific permissions. This model is simple and easy to manage, and is suitable for scenarios where permissions need to be assigned quickly. The advantages of RBAC include simplicity, ease of management, scalability, and high performance.
[0049] The full name of ABAC in the ABAC module 14 is Attribute-Based Access Control.
[0050] ABAC determines access rights through attributes (such as resource attributes, environment attributes, user attributes, etc.), which can be creation date, resource owner, file name, data sensitivity, etc. ABAC provides more fine-grained control and can more flexibly respond to changing access requirements, such as limiting HR role personnel to access employee and payroll information at specific times or branches.
[0051] The log recording unit 6 includes a storage module 15 and a query module 16 , and the storage module 15 and the query module 16 are connected.
[0052] When using this application, you log in through the login unit 1, such as a mobile phone APP, etc. When logging in, you enter the SCG module 7 in the access unit 2, and the employee authenticates the registration information through the Nacos registration module 8 and the Token authentication module 9. As a microservice gateway, Gateway not only implements a unified login entrance, but also ensures the security and legitimacy of all requests through the Token authentication module 9, laying a solid foundation for subsequent service calls. As the integration of the registration center, the Nacos registration module 8 provides strong support for dynamic service management. Through the Nacos registration module 8, we have realized automatic registration, health check, configuration management and dynamic routing of service instances, ensuring efficient discovery and calling between services, adding, modifying and even offline services, and can respond in real time, ensuring the high flexibility and stability of the system. Relying on the registration capability, all integrated services achieve efficient and transparent communication through RPC. This design reduces direct dependencies, enhances the decoupling of the system, and makes service calls more convenient and easy to manage. Through the introduction of the dynamic service perception mechanism, the instant notification of service status changes (online, offline) is ensured. The system can automatically adapt to changes in service topology without manual intervention, further improving the robustness and availability of the system.
[0053] The introduction of lightweight adapter module 10 allows third-party applications to access the platform through simple configuration rather than a large amount of customized development, reducing integration costs and enabling external systems to be safely and smoothly integrated into the enterprise's internal ecosystem, expanding the boundaries of enterprise services and promoting ecological collaboration;
[0054] After passing the authentication, the business application unit 3 is accessed through the SCG module 7 to process the business, ensuring that the employee can seamlessly access all integrated business applications after one authentication. The transaction information in the business application unit 3 is stored through the Redis module 11. The RabbitMQ module 12 can pass messages from one application to another, and pass information between different applications.
[0055] At the authority management level, access control is performed on the business application unit 3 and the data processing unit 4 through the RBAC module 13 and the ABAC module 14 in the authority control unit 5, realizing multi-dimensional combined authority authentication based on personnel, departments, regions and even specific interfaces. Through this fine-grained authority division, precise control of enterprise resource access is ensured, which not only meets the needs of complex organizational structures, but also strengthens the security isolation of data.
[0056] The relevant operation information of the access unit 2 , the business application unit 3 , the data processing unit 4 and the authority control unit 5 are all stored through the storage module 15 in the log recording unit 6 , and the relevant operation information can be queried through the query module 16 .
[0057] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A unified autonomous access service system for enterprise mobile office, featuring: The invention comprises a login unit (1), an access unit (2), a business application unit (3), a data processing unit (4), a permission control unit (5) and a log recording unit (6); the login unit (1) is connected to the access unit (2), the access unit (2) is connected to the business application unit (3), the business application unit (3) is connected to the data processing unit (4), the business application unit (3) and the data processing unit (4) are both connected to the permission control unit (5), and the access unit (2), the business application unit (3), the data processing unit (4) and the permission control unit (5) are all connected to the log recording unit (6).
2. The unified autonomous access service system for enterprise mobile office according to claim 1, characterized in that: The login unit (1) comprises an SCG module (7) and a lightweight adaptation module (10).
3. The unified autonomous access service system for enterprise mobile office according to claim 2, characterized in that: The full name of SCG in the SCG module (7) is Spring Cloud Gateway.
4. The unified autonomous access service system for enterprise mobile office according to claim 2, characterized in that: The SCG module (7) comprises a Nacos registration module (8) and a Token authentication module (9), and the Nacos registration module (8) and the Token authentication module (9) are connected.
5. The unified autonomous access service system for enterprise mobile office according to claim 1, characterized in that: The data processing unit (4) comprises a Redis module (11) and a RabbitMQ module (12).
6. The unified autonomous access service system for enterprise mobile office according to claim 5, characterized in that: The full name of Redis in the Redis module (11) is Remote Dictionary Server.
7. The unified autonomous access service system for enterprise mobile office according to claim 1, characterized in that: The authority control unit (5) comprises a RBAC module (13) and an ABAC module (14), and the RBAC module (13) is connected to the ABAC module (14).
8. The unified autonomous access service system for enterprise mobile office according to claim 7, characterized in that: The full name of RBAC in the RBAC module (13) is Role-Based Access Control.
9. The unified autonomous access service system for enterprise mobile office according to claim 7, characterized in that: The full name of ABAC in the ABAC module (14) is Attribute-Based Access Control.
10. The unified autonomous access service system for enterprise mobile office according to claim 1, characterized in that: The log recording unit (6) comprises a storage module (15) and a query module (16), and the storage module (15) and the query module (16) are connected.