Resource authorization use method and system based on shared special area

Abstract

The invention relates to the technical field of government affair service data sharing and opening, in particular to a resource authorization using method and system based on a shared special district, comprising the following steps: an initiator creates a special district and appoints participants: the initiator creates the shared special district and appoints all parties participating in the special district, the participants can only be added by the initiator in a specific mode, and the participants can only be added by the initiator in a specific mode; the management control on the use range of the special area is ensured; resource association: through an interface of a data directory system, a participant associates a directory list of the participant with a special area, so that resources under a directory are mounted under the special area, and association information is stored in a relational database and is subjected to soft association with special area information; the method has the beneficial effects that by means of the mode, departments in the sharing special area can freely share and exchange resources, the application auditing process is not needed, and the use efficiency of the resources is improved. And non-related personnel can be prevented from applying for corresponding resources, so that the approval pressure of a provider is reduced.

Description

Technical Field

[0001] The present invention relates to the field of government service data sharing and opening technology, and specifically to a resource authorization use method and system based on a shared zone. Background Art

[0002] The government service data sharing and opening technology is a technology that generates authorization based on department application records, and then the user uses the authorization to obtain the shared content. This technology requires the user to select the resources shared by the provider in the sharing platform and initiate an application to the provider, and then obtain the resources after the provider approves it.

[0003] In the traditional resource authorization model, resource providers and users usually need to go through cumbersome application and approval processes to achieve resource sharing and use. This model is not only inefficient, but may also lead to resource waste and duplicate authorization problems. With the continuous development of data sharing and cloud computing technology, higher requirements are placed on efficient resource management and flexible authorization.

[0004] Most existing resource management systems rely on centralized authorization platforms to control resource access rights through complex application and approval processes. However, this approach is inadequate when dealing with large-scale, multi-level resource sharing, and it is difficult to meet the needs of modern enterprises for efficient resource utilization and rapid response. Summary of the invention

[0005] The purpose of the present invention is to provide a resource authorization use method and system based on a shared zone to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a resource authorization method based on a shared zone, the method comprising the following steps:

[0007] The initiator creates a zone and specifies participants: The initiator creates a shared zone and specifies the parties that will participate in the zone. Participants can only be added by the initiator in a specific way to ensure management and control over the use scope of the zone;

[0008] Resource association: Through the interface of the data directory system, participants associate their directory lists with the zone, and realize the attachment of resources under the directory to the zone. The associated information is stored in the relational database and softly associated with the zone information.

[0009] Preferably, the method further comprises the following steps:

[0010] Resource management: The resource provider manages the properties of the parent directory of the resource in the zone, and sets the sharing scope and access rights of the resource by setting the sharing scope of the directory, including the authorization verification and cancellation process before moving the resource out of the shared zone;

[0011] Authorization management: Resource providers can directly authorize other participants to use resources in the zone by setting usage rules and associating the rules with users, without the need for traditional application approval processes.

[0012] Preferably, the method further comprises the following steps:

[0013] Authorization information synchronization: Push the authorization information of the zone to the platform's application authorization system through the dubbo interface or rest interface to ensure the consistency of the authorization information of the shared zone and the authorization information of the application system to prevent duplicate authorization;

[0014] Resource usage method: Based on the resource type, such as interface service, file or library table, different methods such as interface authorization code and data exchange task are adopted to allow users to obtain and use resources, and record resource usage operations.

[0015] Preferably, the method further includes the following detailed steps regarding resource usage rules:

[0016] Interface type resources: Three default usage rules are designed for interface type resources: high frequency, medium frequency, and low frequency, including the frequency of interface calls, usage period, and available time range. The provider creates custom rules based on the default rules and associates the rules with the user to implement authorization;

[0017] Library and table type resources: The default rule is all fields of the shared library and table. The provider selects the authorized fields to create new rules and pushes the rules to the exchange tool through the data exchange system interface to generate a data exchange task for the user to transfer data.

[0018] File type resources: The provider directly associates the file resources with the user to complete the authorization, without the need for additional rule configuration.

[0019] Preferably, the following authorization cancellation and authority change steps are also included:

[0020] Authorization cancellation: When the provider cancels the association between the user and the usage rules, the zone automatically cancels the user's authorization and pushes the cancellation information through the corresponding interface, such as the gateway and data exchange system, to ensure that the user can no longer access the cancelled resources;

[0021] Permission changes: The provider may modify the established usage rules at any time within the zone and update the authorization information through the corresponding mechanism to adapt to changes in resource usage requirements.

[0022] A resource authorization use system based on a shared zone, the system comprising:

[0023] The zone creation module is used by the initiator to create a shared zone and specify participants, ensuring the initiator's ability to manage the use scope of the zone;

[0024] The resource association module is used to associate the directory resources under the participants to the zone through the data directory system interface, and store the association information in the relational database to softly associate it with the zone information;

[0025] Resource sharing management module, which allows resource providers to set the sharing scope and access rights of resources in the zone, including the authorization verification function before moving resources out of the shared zone;

[0026] The resource authorization module allows resource providers to directly authorize resources to other participants in the zone. Authorization is achieved by setting usage rules and associating the rules with the users, without the need for traditional application approval processes.

[0027] The authorization synchronization module is used to push the authorization information of the zone to the platform's application authorization system through the dubbo interface or the rest interface to maintain the consistency of the authorization information and prevent duplicate authorization.

[0028] Preferably, the resource sharing management module also includes:

[0029] The permission control unit is used to limit shared resources to a dedicated area by modifying the display scope of directories and resources, and not to display them to the public on the sharing platform;

[0030] The authorization verification unit is used to verify whether the resource has been authorized to other users before the resource is moved out of the shared area, and requires the authorization to be cancelled before it can be moved out.

[0031] Preferably, the resource authorization module further includes:

[0032] The rule configuration unit is used to generate different types of resource usage rules, including high-frequency, medium-frequency, and low-frequency usage rules for interface type resources, field authorization rules for library and table type resources, and direct authorization rules for file type resources;

[0033] The rule application unit is used to associate the configured usage rules with the users in the zone to implement authorized management of resources.

[0034] Preferably, the rule configuration unit further includes:

[0035] The interface rule configuration subunit is used to set the values ​​of interface call frequency, usage period, and available time range according to the gateway performance upper limit, and create customized interface usage rules;

[0036] The library table rule configuration subunit is used to select the library table fields you want to authorize and create new library table resource usage rules;

[0037] The file rule configuration subunit is used to directly associate resources with users without the need for additional rule configuration.

[0038] Preferably, the system further comprises:

[0039] Resource usage record module, used to record all resource usage operations, including interface calls and data exchange tasks, so that the initiator and participants can view resource usage and audit trails;

[0040] The authorization revocation module is used to automatically cancel the user's authorization after the resource provider cancels the association between the user and the usage rules, and synchronously updates the authorization record and system status.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] The resource authorization use method and system based on the shared zone proposed by the present invention can enable departments in the shared zone to freely share and exchange resources without going through the application review process, thereby improving the efficiency of resource use. It can also prevent non-related personnel from applying for corresponding resources, thereby reducing the approval pressure on the provider. Users can also use resources directly through the shared zone without having to enter the sharing platform to find the required resources and then apply for them, thereby simplifying the use steps. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] For example, see Figure 1 The present invention provides a technical solution: a resource authorization method based on a shared zone, the method comprising the following steps:

[0046] 1. The initiator creates a zone and specifies the participants. The participants can only be specified by the initiator and cannot be added by other means, so as to ensure the initiator's ability to manage the use scope of the zone. Resource association is carried out according to the dimension of the data directory, that is, directly associate all resources under the data directory. The zone uses the rest interface of the directory system to obtain the directory list of the participants, and then the participants select the directory to associate with the corresponding zone, so as to realize the attachment of the resources under the directory to the zone. The association information falls directly into the relational database and is soft-associated with the zone information.

[0047] 2. In the zone, the resource provider (i.e. the original uploader of the resource) manages the properties of the parent directory of the resource in the zone, and sets the sharing scope and access rights of the resource by setting the sharing scope of the directory. Specifically, the resource provider can choose to limit the accessibility of the resource to the zone. The provider will also move the resource out of the shared zone. Before moving it out, the shared zone will verify the authorization of the resource. If the resource has been authorized to other users in the zone, the authorization must be revoked before the resource can be moved out of the zone. The zone pushes the sharing scope of the zone directory to the directory system and resource system, and modifies the display scope of the directory and resources so that they are not displayed to the public on the sharing platform.

[0048] 3. Resource providers can directly authorize other participants within the zone without going through the traditional application approval process. They only need to set the usage rules themselves and associate the usage rules with the users. Participants in the zone can also directly browse the resources in the zone and apply for resources that are not shared with them, and obtain authorization through the normal application process.

[0049] 4. The zone authorization uses the dubbo interface or rest interface to communicate with the platform's application authorization, and pushes the authorization information to the platform's application authorization system to ensure the consistency of the shared zone authorization information and the application system authorization information, and avoid duplicate authorization.

[0050] 5. After the shared zone is authorized, different methods are used to allow users to use resources according to the types of authorized resources. For interface service resources, the interface authorization code and usage documents will be obtained through the rest interface and provided to the user, so that the user can call the interface correctly. For file or library table resources, the encapsulated data exchange tool (such as nifi) interface will be called to generate an exchange task, so that the user can transfer the resources to his own environment through the exchange tool. All resource usage operations will be recorded for easy viewing by the initiator and participants.

[0051] 6. The shared zone will generate different resource usage rules for the provider to choose from based on the resource type. The provider can authorize the user by associating the usage rules with the user in the zone, and the user will use the resources according to the restrictions of the usage rules. Different types of resource rules are as follows

[0052] 1) For interface type resources, the zone has designed three default usage rules: high frequency, medium frequency, and low frequency. The values ​​of the interface call frequency, usage period, and available time range for each usage rule are different. The rule indicators are set according to the performance upper limit of the gateway, and the provider creates its own usage rules based on the default rules. After creating the rules, the user can be authorized by associating the user with the rules. The usage rules will be pushed to the gateway after the user binds the application that uses the interface, and the gateway will then control the user's calls based on the usage rules. When the user is removed from the usage rules, the deauthorization information will be pushed directly to the gateway, so that the user can no longer use the interface.

[0053] 2) For resources of library table type, the default rule is to share all fields of the library table. The provider can select the fields that they want to authorize and create new usage rules accordingly. Finally, select the user of the rule. After the selection is completed, the zone will push the rule to the data exchange tool through the interface of the data exchange system. The exchange tool will generate an exchange task based on the rule, and the user will then transfer the data to his own environment through the exchange tool. One rule can be used to authorize multiple users. When the user is removed from the rule, the interface of the exchange system will be called again to stop the data exchange task, thereby stopping the sharing of the data.

[0054] 3) For file-type resources, the provider can complete authorization by directly associating the resources with the user, without the need for additional rule configuration.

[0055] Embodiment 2, based on embodiment 1, proposes a resource authorization use system based on a shared zone, the system comprising:

[0056] The zone creation module is used by the initiator to create a shared zone and specify participants, ensuring the initiator's ability to manage the use scope of the zone;

[0057] The resource association module is used to associate the directory resources under the participants to the zone through the data directory system interface, and store the association information in the relational database to softly associate it with the zone information;

[0058] The resource sharing management module allows resource providers to set the sharing scope and access rights of resources in the zone, including the authorization verification function before moving resources out of the shared zone; it also includes: the permission control unit, which is used to limit the shared resources to the zone by modifying the display scope of the directory and resources, and not to display them to the public on the sharing platform;

[0059] The authorization verification unit is used to verify whether the resource has been authorized to other users before the resource is moved out of the shared area, and requires the authorization to be cancelled before it can be moved out.

[0060] The resource authorization module allows resource providers to directly authorize resources to other participants in the zone by setting usage rules and associating the rules with the users, without the need for traditional application approval processes; it also includes:

[0061] The rule configuration unit is used to generate different types of resource usage rules, including high-frequency, medium-frequency, and low-frequency usage rules for interface type resources, field authorization rules for library and table type resources, and direct authorization rules for file type resources;

[0062] The rule application unit is used to associate the configured usage rules with the users in the zone to implement the authorization management of resources;

[0063] The rule configuration unit further includes:

[0064] The interface rule configuration subunit is used to set the values ​​of interface call frequency, usage period, and available time range according to the gateway performance upper limit, and create customized interface usage rules;

[0065] The library table rule configuration subunit is used to select the library table fields you want to authorize and create new library table resource usage rules;

[0066] The file rule configuration subunit is used to directly associate resources with users without the need for additional rule configuration.

[0067] The authorization synchronization module is used to push the authorization information of the zone to the platform's application authorization system through the dubbo interface or the rest interface to maintain the consistency of the authorization information and prevent duplicate authorization.

[0068] The system also includes:

[0069] Resource usage record module, used to record all resource usage operations, including interface calls and data exchange tasks, so that the initiator and participants can view resource usage and audit trails;

[0070] The authorization revocation module is used to automatically cancel the user's authorization after the resource provider cancels the association between the user and the usage rules, and synchronously updates the authorization record and system status.

[0071] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A resource authorization method based on a shared zone, characterized in that: The method comprises the following steps: The initiator creates a zone and specifies participants: The initiator creates a shared zone and specifies the parties that will participate in the zone. Participants can only be added by the initiator in a specific way to ensure management and control over the use scope of the zone; Resource association: Through the interface of the data directory system, participants associate their directory lists with the zone, and realize the attachment of resources under the directory to the zone. The associated information is stored in the relational database and softly associated with the zone information.

2. A resource authorization method based on a shared zone according to claim 1, characterized in that: The following steps are also included: Resource management: The resource provider manages the properties of the parent directory of the resource in the zone, and sets the sharing scope and access rights of the resource by setting the sharing scope of the directory, including the authorization verification and cancellation process before moving the resource out of the shared zone; Authorization management: Resource providers can directly authorize other participants to use resources in the zone by setting usage rules and associating the rules with users, without the need for traditional application approval processes.

3. A resource authorization method based on a shared zone according to claim 1, characterized in that: The following steps are also included: Authorization information synchronization: Push the authorization information of the zone to the platform's application authorization system through the dubbo interface or rest interface to ensure the consistency of the authorization information of the shared zone and the authorization information of the application system to prevent duplicate authorization; Resource usage method: Based on the resource type, such as interface service, file or library table, different methods such as interface authorization code and data exchange task are adopted to allow users to obtain and use resources, and record resource usage operations.

4. A resource authorization method based on a shared zone according to claim 3, characterized in that: It also includes the following detailed steps on resource usage rules: Interface type resources: Three default usage rules are designed for interface type resources: high frequency, medium frequency, and low frequency, including the frequency of interface calls, usage period, and available time range. The provider creates custom rules based on the default rules and associates the rules with the user to implement authorization; Library and table type resources: The default rule is all fields of the shared library and table. The provider selects the authorized fields to create new rules and pushes the rules to the exchange tool through the data exchange system interface to generate a data exchange task for the user to transfer data. File type resources: The provider directly associates the file resources with the user to complete the authorization, without the need for additional rule configuration.

5. The resource authorization method based on a shared zone according to claim 1 is characterized in that: It also includes the following authorization cancellation and permission change steps: Authorization cancellation: When the provider cancels the association between the user and the usage rules, the zone automatically cancels the user's authorization and pushes the cancellation information through the corresponding interface, such as the gateway and data exchange system, to ensure that the user can no longer access the cancelled resources; Permission changes: The provider may modify the established usage rules at any time within the zone and update the authorization information through the corresponding mechanism to adapt to changes in resource usage requirements.

6. A resource authorization system based on a shared zone according to the resource authorization method based on a shared zone according to any one of claims 1 to 5, characterized in that: The system comprises: The zone creation module is used by the initiator to create a shared zone and specify participants, ensuring the initiator's ability to manage the use scope of the zone; The resource association module is used to associate the directory resources under the participants to the zone through the data directory system interface, and store the association information in the relational database to softly associate it with the zone information; Resource sharing management module, which allows resource providers to set the sharing scope and access rights of resources in the zone, including the authorization verification function before moving resources out of the shared zone; The resource authorization module allows resource providers to directly authorize resources to other participants in the zone. Authorization is achieved by setting usage rules and associating the rules with the users, without the need for traditional application approval processes. The authorization synchronization module is used to push the authorization information of the zone to the platform's application authorization system through the dubbo interface or the rest interface to maintain the consistency of the authorization information and prevent duplicate authorization.

7. A resource authorization system based on a shared zone according to claim 6, characterized in that: The resource sharing management module also includes: The permission control unit is used to limit shared resources to a dedicated area by modifying the display scope of directories and resources, and not to display them to the public on the sharing platform; The authorization verification unit is used to verify whether the resource has been authorized to other users before the resource is moved out of the shared area, and requires the authorization to be cancelled before it can be moved out.

8. A resource authorization system based on a shared zone according to claim 6, characterized in that: The resource authorization module also includes: The rule configuration unit is used to generate different types of resource usage rules, including high-frequency, medium-frequency, and low-frequency usage rules for interface type resources, field authorization rules for library and table type resources, and direct authorization rules for file type resources; The rule application unit is used to associate the configured usage rules with the users in the zone to implement authorized management of resources.

9. A resource authorization system based on a shared zone according to claim 8, characterized in that: The rule configuration unit further includes: The interface rule configuration subunit is used to set the values ​​of interface call frequency, usage period, and available time range according to the gateway performance upper limit, and create customized interface usage rules; The library table rule configuration subunit is used to select the library table fields you want to authorize and create new library table resource usage rules; The file rule configuration subunit is used to directly associate resources with users without the need for additional rule configuration.

10. A resource authorization system based on a shared zone according to claim 6, characterized in that: The system also includes: Resource usage record module, used to record all resource usage operations, including interface calls and data exchange tasks, so that the initiator and participants can view resource usage and audit trails; The authorization revocation module is used to automatically cancel the user's authorization after the resource provider cancels the association between the user and the usage rules, and synchronously updates the authorization record and system status.

Images