Data processing method and related equipment

Abstract

The embodiment of the invention provides a data processing method and related equipment, and the method comprises the steps: receiving a data access request sent by a first application program, the data access request carrying a first open identifier; the data access request is used for requesting to access service data related to the first open identifier in the second application program through the access control software toolkit; the access control software toolkit and the first application program are authorized to log in through the second application program; in response to the data access request, obtaining requested service data from a server corresponding to the second application program through the access control software toolkit; and desensitizing the service data to obtain response data, and returning the response data to the first application program. According to the embodiment of the invention, the security of the data in the accessed application program can be effectively ensured in a scene with a higher data security requirement.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and specifically to a data processing method and related equipment, and in particular to a data processing method, a data processing device, a computer device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the development of Internet technology, two applications can access each other's data. For example, the two applications are a first application (such as a third-party application) and a second application (the application corresponding to the platform). The process of the first application accessing the data in the second application includes: the first application can make an authorization login request through the second application. After obtaining the authorization of the second application, the first application can directly access the authorized data in the second application. However, in scenarios with higher requirements for data security, this data access process cannot guarantee the security of accessing data. Summary of the invention

[0003] The embodiment of the present application provides a data processing method, which can effectively ensure the data security in the accessed application in a scenario with higher data security requirements.

[0004] On the one hand, an embodiment of the present application provides a data processing method, the method comprising:

[0005] Receive a data access request sent by a first application, the data access request carrying a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through an access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application;

[0006] In response to the data access request, obtaining the requested business data from the server corresponding to the second application program through the access control software toolkit;

[0007] The business data is desensitized to obtain response data, and the response data is returned to the first application.

[0008] On the one hand, an embodiment of the present application provides a data processing method, the method comprising:

[0009] Sending a data access request of the first application to the access control software toolkit, wherein the data access request carries the first open identifier; the data access request is used to request access to business data related to the first open identifier in the second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application;

[0010] Receiving response data returned by the access control software toolkit, where the response data is obtained by the access control software toolkit in response to the data access request, obtaining the requested business data from the server corresponding to the second application, and performing desensitization processing on the business data;

[0011] The response data is displayed in the first application.

[0012] On the one hand, an embodiment of the present application provides a data processing method, the method comprising:

[0013] Receive a data access request of a first application sent by an access control software toolkit, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application;

[0014] In response to the data access request, obtaining the requested business data based on the first open identifier;

[0015] The business data is returned to the access control software toolkit so that the access control software toolkit performs desensitization processing on the business data to obtain response data, and the access control software toolkit returns the response data to the first application.

[0016] On the one hand, an embodiment of the present application provides a data processing device, the device comprising:

[0017] A receiving unit, configured to receive a data access request sent by a first application, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through an access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application;

[0018] A processing unit, configured to obtain the requested business data from a server corresponding to the second application program through an access control software toolkit in response to the data access request;

[0019] The processing unit is also used to desensitize the business data, obtain response data, and return the response data to the first application.

[0020] The processing unit is also used for:

[0021] The data access request is authenticated using a second open identifier; the second open identifier is obtained during the process of the access control software toolkit performing authorized login via the second application program;

[0022] If the data access request is successfully authenticated, executing the step of obtaining the requested business data from the server corresponding to the second application program through the access control software toolkit in response to the data access request;

[0023] The authentication process is used to verify whether the authorization object identified by the first open identifier and the authorization object identified by the second open identifier are the same object; if they are the same object, the data access request authentication is successful.

[0024] The processing unit is also used for:

[0025] Based on the preset access control rules, access control processing is performed on data access requests;

[0026] Among them, the access control rules include at least one of the following: frequency rules, time rules, and permission rules; the frequency rules are used to stipulate that the frequency of the first application sending data access requests must be less than the frequency threshold; the time rules are used to stipulate that the time when the first application sends data access requests must be within a preset time period; the permission rules are used to stipulate that the authorized object identified by the first open identifier must have the authority to access the requested business data.

[0027] The processing unit can be specifically used for:

[0028] In response to the data access request, encrypt the data access request using the first encryption ticket to obtain an encrypted data access request;

[0029] Sending an encrypted data access request to the server, so that the server uses the first decryption ticket corresponding to the first encryption ticket to decrypt the encrypted data access request and obtain the business data, and uses the second encryption ticket to encrypt the business data to obtain the encrypted business data;

[0030] Receive the encrypted business data returned by the server, and use the second decryption ticket corresponding to the second encryption ticket to decrypt the encrypted business data to obtain the business data;

[0031] The first encryption ticket and the second decryption ticket are obtained during the process of the access control software toolkit performing authorized login through the second application program.

[0032] The structure of the access control software toolkit includes an interaction layer and a cross-platform layer;

[0033] The interaction layer is used to perform interface interaction with the first application and to provide an application programming interface for the first application;

[0034] The cross-platform layer is used to provide an interactive interface to the interactive layer and provide various processing logics for the access control software toolkit; the cross-platform layer is introduced into the engineering file of the access control software toolkit in the form of a static library;

[0035] The access control software toolkit provides access control services for the first application program in a dynamic library manner.

[0036] The cross-platform layer includes at least one interface processing thread and at least one input and output thread; the processing unit can be specifically used for:

[0037] Render the business data through the interface processing thread in the access control software toolkit to generate interface display data;

[0038] The interface display data is determined as the response data.

[0039] The process of the access control software toolkit performing authorized login through the second application program includes:

[0040] Receive a data access authorization code transmitted by the first application; the data access authorization code is obtained by the first application during the process of authorized login through the second application, and is transmitted to the access control software toolkit by calling an application programming interface provided by the access control software toolkit;

[0041] Based on the data access authorization code, a login request is initiated to the server, where the login request includes the data access authorization code;

[0042] A login ticket is received from the server based on the data access authorization code; the login ticket is used to indicate that the access control software toolkit has successfully authorized the login through the second application; the login ticket includes at least one of the following: a second open identifier, a first encryption ticket, and a second decryption ticket.

[0043] Wherein, after the access control software toolkit successfully logs in through the second application program through authorization, a direct communication connection is established with the server;

[0044] The business data is transmitted in an independent communication channel formed between the access control software toolkit and the server based on a direct communication connection between the access control software toolkit and the server.

[0045] On the one hand, an embodiment of the present application provides a data processing device, the device comprising:

[0046] A sending unit, used for sending a data access request of a first application to an access control software toolkit, wherein the data access request carries a first open identifier; the data access request is used for requesting access to business data related to the first open identifier in a second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application;

[0047] A receiving unit, used to receive response data returned by the access control software toolkit, wherein the response data is obtained by the access control software toolkit in response to the data access request, obtaining the requested business data from the server corresponding to the second application program, and performing desensitization processing on the business data;

[0048] The processing unit is configured to display the response data in the first application.

[0049] The process of the first application program performing authorized login through the second application program includes:

[0050] Calling the application programming interface provided by the authorization login software toolkit, initiating an authorization login request to the server through the second application, causing the server to respond to the authorization login request, and generating a first open identifier, an authorization code, and a data access authorization code based on the login account of the second application;

[0051] The application programming interface provided by the authorization login software toolkit is called, and the first open identification, authorization code and data access authorization code returned by the server are received through the second application.

[0052] The processing unit is also used for:

[0053] Determine, based on the business requirements of the first application, the data type of the business data that the first application needs to access from the second application;

[0054] If the business data to be accessed is sensitive data, a data access request is generated based on the first open identifier, and a step of sending the data access request of the first application to the access control software toolkit is performed;

[0055] Among them, sensitive type data includes at least one of the following: data with an importance greater than an importance threshold, and data with a privacy level higher than a privacy threshold.

[0056] The processing unit is also used for:

[0057] If the business data to be accessed is non-sensitive data, the required business data is obtained from the server based on the authorization code;

[0058] The non-sensitive type includes at least one of the following: data whose importance is less than or equal to an importance threshold, and data whose privacy is less than or equal to a privacy threshold.

[0059] The access control software toolkit and the authorization login software toolkit are two independent software toolkits; or, the access control software toolkit and the authorization login software toolkit are the same software toolkit;

[0060] The first application supports one or more of an access control software toolkit and an authorization login software toolkit.

[0061] On the one hand, an embodiment of the present application provides a data processing device, the device comprising:

[0062] A receiving unit is used to receive a data access request of a first application program sent by an access control software toolkit, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application program through the access control software toolkit; the access control software toolkit and the first application program both perform authorized login through the second application program;

[0063] A processing unit, configured to obtain requested business data based on the first open identifier in response to the data access request;

[0064] The returning unit is used to return the business data to the access control software toolkit, so that the access control software toolkit performs desensitization processing on the business data to obtain response data, and the access control software toolkit returns the response data to the first application.

[0065] In one aspect, an embodiment of the present application provides a computer device, the computer device comprising:

[0066] a processor suitable for executing a computer program;

[0067] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned data processing method is implemented.

[0068] On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is loaded by a processor and executes the above-mentioned data processing method.

[0069] On the one hand, an embodiment of the present application provides a computer program product, which includes a computer program or computer instructions, and the computer program or computer instructions implement the above-mentioned data processing method when executed by a processor.

[0070] In an embodiment of the present application, a data access request sent by a first application is received, and the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through an access control software toolkit; the access control software toolkit and the first application are both authorized to log in through the second application; then in response to the data access request, the requested business data is obtained from the server corresponding to the second application through the access control software toolkit; the business data is desensitized to obtain response data, and the response data is returned to the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control software toolkit, which avoids the first application directly obtaining business data from the server corresponding to the second application, and can effectively ensure the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of directly returning the business data to the first application. The first application cannot use the business data for other purposes, which further improves the security of the business data. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1 An architectural diagram of a data processing system provided for an exemplary embodiment of the present application;

[0073] Figure 2 A schematic diagram of the structure of an access control SDK provided for an exemplary embodiment of the present application;

[0074] Figure 3 A schematic diagram of a data processing flow provided for an exemplary embodiment of the present application;

[0075] Figure 4 A schematic diagram of an authorization interface invocation provided for an exemplary embodiment of the present application;

[0076] Figure 5 A data processing flow diagram provided for another exemplary embodiment of the present application;

[0077] Figure 6a A schematic diagram of displaying organizational structure subordinate information of objects in a conference application provided by an exemplary embodiment of the present application;

[0078] Figure 6b A schematic diagram of a process for accessing document information in an instant messaging application provided by an exemplary embodiment of the present application;

[0079] Figure 7 A flowchart of a data processing method provided for an exemplary embodiment of the present application;

[0080] Figure 8 A flowchart of a data processing method provided for another exemplary embodiment of the present application;

[0081] Fig. 9 A flowchart of a data processing method provided for another exemplary embodiment of the present application;

[0082] Fig.10 A schematic diagram of the structure of a data processing device provided for an exemplary embodiment of the present application;

[0083] Fig.11 A schematic diagram of the structure of a data processing device provided for another exemplary embodiment of the present application;

[0084] Fig.12 A structural schematic diagram of a data processing device provided for yet another exemplary embodiment of the present application;

[0085] Fig.13 A schematic diagram of the structure of a computer device provided for an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0086] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0087] First, the relevant technical terms involved in the embodiments of the present application are explained.

[0088] 1. First Application and Second Application

[0089] The first application and the second application may be APPs (Applications) independently installed in the same terminal device or different terminal devices. The first application and the second application may be instant messaging APPs, game APPs, social APPs, conference APPs, and the like.

[0090] Among them, the second application can provide services for the first application, and the first application can be called a third-party APP relative to the second application. The services here may include but are not limited to: authorized login service, data access service. Authorized login service means that the first application can log in through the second application for authorization; the so-called authorized login refers to a simple and secure interactive process between the first application and the second application. There is no need to enter the login data of the authorized object in the first application. The process of logging in to the first application can be realized by using the authorization of the second application. The so-called authorized object refers to the object (such as a user) that authorizes the first application to log in through the second application for authorization. Data access service means that the first application can access the business data in the second application after being authorized to log in by the second application.

[0091] 2. SDK (Software Development Kit)

[0092] SDK is a collection of development tools used by software engineers to build applications for specific software packages, software frameworks, hardware platforms, operating systems, etc. In the embodiment of the present application, SDK may include at least one of the following: access control SDK (which may be called WWLink SDK), authorization login SDK.

[0093] The access control SDK and the authorization login SDK can be provided by the second application, and the first application can support access to the access control SDK and the authorization login SDK. The first application can initiate an authorization login request to the second application through the authorization login SDK to obtain the authorization code, data authorization code, open identification, etc. When the authorization code, data authorization code, and open identification are obtained, the first application is successfully logged in.

[0094] The first application can access the business data in the second application through the access control SDK. Since the access control SDK is introduced to perform access control processing, the business data in the second application can be accessed through the access control SDK to ensure the security of the business data.

[0095] 3. Authorization code

[0096] The authorization code can be used to directly access the business data within the authorized scope in the second application. Schematically, the authorization code defines the authorization scope. For example, the second application contains schedule information and email information. The authorization code defines the authorization scope that only contains schedule information. Then, the schedule information in the second application can be directly accessed through the authorization code, but the email information in the second application cannot be accessed through the authorization code.

[0097] The authorization code has the following characteristics: ① The authorization code has a validity period. When the authorization code exceeds the validity period, the authorization code becomes invalid. ② The authorization code supports regular replacement. For example, the authorization code will be replaced by a new authorization code by the server every one day or two hours. At this time, you need to obtain the authorization code again.

[0098] 4. Data access authorization code (SDK_code)

[0099] The data access authorization code is the credential that the server corresponding to the second application uses to authorize the access control SDK to log in. The access control SDK can exchange the data access authorization code for the login state and login ticket required for data access requests. When the login ticket is successfully exchanged for the data access authorization code, the access control SDK is successfully logged in.

[0100] The data access authorization code has the following characteristics: ① The data access authorization code is a one-time consumption feature, that is, when the access control SDK uses the data access authorization code to perform an authorized login, the data access authorization code will become invalid. ② The data access authorization code has a validity period. When the data access authorization code exceeds the validity period, the data access authorization code will become invalid. In principle, the validity period of the data access authorization code is 10 minutes. When the data access authorization code exceeds 10 minutes, the data access authorization code will become invalid. ③ The data access authorization code supports regular replacement. For example, the data access authorization code will be replaced by a new data access authorization code on the server every day or every two hours. At this time, the data access authorization code needs to be obtained again.

[0101] Among them, the login ticket may include but is not limited to: an open identifier, an encryption ticket, and a decryption ticket. The open identifier is used to identify the authorized object, the encryption ticket can be used to encrypt data (such as data access requests, business data), and the decryption ticket is used to decrypt the encrypted data (such as the encrypted business data in the embodiment of the present application). It should be understood that the login ticket has a validity period. When the login ticket exceeds the validity period, it needs to be renewed.

[0102] It should be noted that in this application, the relevant data involved in the login authorization and data access process, for example: object information (such as nickname, account information), document information, organizational structure subordination information, etc. When the above embodiments of this application are applied to specific products or technologies, the permission or consent of the object must be obtained, and the relevant data collection, use and processing processes must comply with the relevant laws, regulations and standards of the region, comply with the principles of legality, legitimacy and necessity, and do not involve the acquisition of data types prohibited or restricted by laws and regulations. In some optional embodiments, the relevant data involved in the embodiments of this application are obtained after the object has been authorized separately. In addition, when obtaining the separate authorization of the object, the purpose of the relevant data involved is indicated to the object.

[0103] In the embodiment of the present application, a data processing scheme is provided, and the general principle of the data processing scheme is as follows: receiving a data access request sent by a first application, the data access request carries a first open identifier; the data access request is used to request access to the business data related to the first open identifier in the second application through the access control SDK; the access control SDK and the first application are both authorized to log in through the second application; then in response to the data access request, the requested business data is obtained from the server corresponding to the second application through the access control SDK; the business data is desensitized to obtain response data, and the response data is returned to the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control SDK, which avoids the first application directly obtaining the business data from the server corresponding to the second application, and effectively ensures the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of being directly returned to the first application. The first application cannot use the business data for other purposes, which further ensures the security of the business data and is more suitable for scenarios with higher data security requirements.

[0104] Next, the data processing system provided in the embodiment of the present application is described.

[0105] See also Figure 1 , is an architecture diagram of a data processing system provided by an exemplary embodiment of the present application. The data processing system may include a terminal device 101 and a server 102. The present application does not limit the number of terminal devices and servers. Among them:

[0106] The terminal device 101 can run a first application and a second application. Schematically, the first application can be an application for initiating a meeting, a third-party APP, etc., and the second application can be an instant messaging application, a social application, etc. It should be understood that the first application and the second application can also run in different terminal devices. Schematically, the first application runs in the terminal device 101, and the second application runs in other terminal devices except the terminal device 101. This embodiment of the present application does not limit this. The terminal device 101 may include, but is not limited to: a smart phone, a tablet computer, a smart wearable device, an intelligent voice interaction device, a smart home appliance, a personal computer, a vehicle-mounted terminal, a smart camera, a virtual reality device (such as an AR (Augmented Reality, augmented reality) device), etc., and this application does not limit this.

[0107] The second application may provide an access control SDK and an authorization login SDK, and the first application may support access to one or more of the access control SDK and the authorization login SDK. Figure 1 In the first application, access control SDK is accessed (or embedded).

[0108] The first application can initiate an authorization login to the second application to obtain an object ticket (such as UserTicket), and initiate an authorization login request to the server 102 through the object ticket to obtain a data access authorization code, an authorization code, a first open identifier, etc. The data access authorization code can be used to log in to the access control SDK. After the access control SDK is successfully logged in, the first application can access the business data in the second application through the access control SDK according to business needs, or directly obtain the business data in the corresponding permission range of the second application from the server 102 through the authorization code.

[0109] The access control SDK can authorize login to the server 102 through the data access authorization code. The access control SDK provided in the embodiment of the present application has the following functions: ① Data access control: Access control is performed on the data access request sent by the first application. The access control here may include but is not limited to: controlling the frequency of the first application sending the data access request, controlling the time when the first application sends the data access request, etc. Through the access control of the data access request, malicious applications can be prevented from accessing the business data in the second application, thereby improving the security of the data. ② Data access authentication: Authentication processing is performed on the data access request, that is, the first open identifier in the data access request is verified. ③ Data encryption: Encrypt the data access request, obtain the encrypted data access request, and send it to the server 102. ④ Data decryption: Decrypt the encrypted business data returned by the server 102. ③ Data rendering: Rendering the decrypted business data. Through rendering processing, the original data stream is not provided (that is, the business data is not directly provided), so that the first application cannot obtain the business data by itself and use it for other purposes, further increasing the security of the data.

[0110] In order to realize the functions of access control SDK, such as Figure 2, is a structural diagram of an access control SDK provided by an exemplary embodiment of the present application. The access control SDK may include: an interaction layer and a cross-platform layer. In one implementation, the access control SDK may provide access control services for the first application in a dynamic library manner. By providing access control services for the first application in a dynamic library manner, symbolic links may be completed within the dynamic library, and cross-platform layer symbols may be removed (stripped) so as not to conflict with symbols in the first application. The symbols here may include, but are not limited to: functions or variables, etc., and symbolic links refer to binding variables or functions required by the access control SDK when providing data access control, data access authentication, data encryption and decryption, etc.

[0111] ① The interaction layer can also be called the UI (User Interface) layer. The interaction layer can be used to interact with the first application program and to provide an API (Application Programming Interface) for the first application program. The API here includes but is not limited to: a login interface for the access control SDK, a business interface for obtaining business data, etc. It should be understood that the API provided for the first application program can be an API that is self-encapsulated by each platform according to the platform language characteristics, and the encapsulated API is exposed. The platforms here can include but are not limited to: iOS (Apple operating system), Android (Android operating system), Win (windows operating system), Mac (Macintosh, an operating system for computers).

[0112] ② The cross-platform layer is introduced into the engineering file of the access control software toolkit in the form of a static library. The cross-platform layer can implement the underlying logic, and the cross-platform layer can include a service module (Service), a login module, a protocol module, and a network module. Among them: (1) Service module: used to provide an interactive interface to the interactive layer, cache data, provide interface logic, etc. (2) Login module: used to provide the login state of the access control SDK (i.e., complete the login of the access control SDK) and provide storage services and renewal services for the login tickets in the access control SDK, provide login states for data access requests (such as not logged in, logged in, offline, etc.), etc. (3) Protocol module: used to package business data or data access requests and protocols, encrypt and decrypt data (such as encrypted data access requests, encrypted business data, etc.), etc. (4) Network module: used for data (such as data access requests, business data, etc.) transmission. The network module can support data transmission of long and short communication connections. The transmission here includes receiving and sending.

[0113] In order to implement the underlying logic of the above-mentioned cross-platform layer, the embodiment of the present application also provides a thread model. Among them, the thread model includes at least one interface processing thread (UI thread) and at least one input and output thread (IO thread). Among them, the UI thread is used to call the custom UI component to render the business data. The UI thread can be a resident UI thread, that is, the UI thread always exists in the cross-platform layer and is used to render the business data. The IO thread is used to process the data between each module. Schematically, as shown Figure 2 In the access control SDK, the cross-platform layer can include a UI thread and three IO threads. The UI thread and IO thread have their own message loops in the access control SDK.

[0114] Server 102 is one or more servers corresponding to the second application, and the server is used to provide service support for the second application. Server 102 stores object information (such as object name, account information, etc.) for authorized login and business data of the second application. In one implementation, server 102 is a plurality of servers corresponding to the second application, and server 102 includes a ticket exchange background server for login authorization service and a business server storing business data related to the second application. The functions of server 102 may include but are not limited to: ① Based on the object ticket, exchange the first open identifier, data access authorization code and authorization code for the first application, so as to realize login authorization for the first application. ② Exchange login ticket: Based on the login request containing the data access authorization code sent by the access control SDK, exchange and return the second open identifier, login ticket, etc. for the access control SDK. ③ Based on the first open identifier, return response business data to the access control SDK.

[0115] Server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms, etc.

[0116] In one embodiment, Figure 1 The interaction process between the terminal device and the server shown can be combined with Figure 3 and Figure 4 See Figure 3 , is a schematic diagram of a data processing flow provided by an exemplary embodiment of the present application, the data processing flow mainly includes an access control SDK login process, including steps S301-S311:

[0117] S301. A first application program calls an application programming interface of an authorization login SDK to initiate an authorization request.

[0118] The application programming interface of the authorization login SDK may include but is not limited to: authorization login interface, etc. In specific implementation, the first application may access the authorization login SDK and the access control SDK, and call the login authorization interface of the login authorization SDK to perform authorization login, obtain the object ticket (UserTicket), and generate an authorization request based on the object ticket, and the authorization request is used to request to display the authorization interface of the second application.

[0119] It should be understood that the authorization login SDK and the access control SDK can be two independent SDKs or the same SDK. When the login authorization SDK and the access control SDK are two independent SDKs, the login authorization SDK can be used to authorize the login for the first application in exchange for the first open identifier, authorization code (code), data access authorization code (SDK_code), etc.; the access control SDK is used to control access to the business data in the second application.

[0120] S302: The second application displays an authorization interface in response to the authorization request, where the authorization interface includes object information and authorization options.

[0121] After the authorization interface is displayed, the object may be waited for to confirm the authorization. When the object triggers the authorization option, the process proceeds to step S303. Figure 4 , is a schematic diagram of an authorization interface wake-up provided by an exemplary embodiment of the present application. Figure 4 As shown, the object can trigger the login option in the first application by clicking, double-clicking, etc. In response to the triggering operation on the login option, the first application can call the authorized login SDK and send an authorization request to the second application to evoke the authorization interface of the second application. In response to the authorization request, the second application displays an authorization interface 401, which includes an authorization option 41, and the object can click on the authorization option 41.

[0122] S303: In response to the triggering operation of the authorization option, the second application sends an authorization login request to the server corresponding to the second application.

[0123] The authorization login request includes an object ticket, which can be used to exchange for an authorization code, a data access authorization code, and a first open identifier. The triggering operation may include, but is not limited to, clicking, double-clicking, and sliding the authorization option. Schematically, when the object clicks the authorization option 41, the second application generates an authorization login request based on the object ticket in response to the click operation of the authorization option, and sends the authorization login request to the server corresponding to the second application.

[0124] S304. The server generates a first open identifier, an authorization code, and a data access authorization code in response to the authorization login request based on the login account of the second application, and returns the data access authorization code, the authorization code, and the first open identifier to the second application.

[0125] Specifically, the server responds to the authorized login request, determines the current login account of the second application, and generates a first open identifier, an authorization code (code), and a data access authorization code (SDK_code) based on the login account of the second application, and then returns the data access authorization code, the authorization code, and the first open identifier to the second application based on the object ticket. The first open identifier is used to identify the authorized object, and the authorization code can be used to directly access the business data of the second application within the scope of authority from the server. Schematically, the business data of the second application within the scope of authority can be, for example, non-sensitive data in the second application. The data access authorization code can be used to log in to the access control SDK and access sensitive data in the second application through the access control SDK.

[0126] S305. The second application returns a data access authorization code, an authorization code, and a first open identifier to the login authorization SDK.

[0127] S306: The login authorization SDK returns the data access authorization code, the authorization code, and the first open identifier to the first application. The first application can receive the data access authorization code, the authorization code, and the first open identifier returned by the login authorization SDK, and the first application successfully authorizes the login. If the first application needs to access the business data in the second application, step S307 can be executed.

[0128] Wherein, both the data access authorization code and the authorization code are set with corresponding validity periods. When the existence time of the data access authorization code exceeds the corresponding validity period, or the existence time of the authorization code exceeds the corresponding validity period, or the existence time of the data access authorization code exceeds the corresponding validity period and the existence time of the authorization code exceeds the corresponding validity period, the first application needs to re-call the application programming interface of the authorized login SDK to initiate an authorization request to re-acquire a new data access authorization code, a new authorization code and the first open identifier from the server.

[0129] S307: The first application determines the data type of the business data that the first application needs to access from the second application according to the business requirements of the first application.

[0130] For the business data in the second application, due to the different security and sensitivity of the business data, the data types of the business data that the first application needs to access from the second application can be divided into non-sensitive data and sensitive data. Schematically, the non-sensitive data can be some basic data in the second application, for example, information such as the object avatar and nickname in the second application. The non-sensitive data includes at least one of the following: ① Data whose importance is less than or equal to the importance threshold. The importance threshold can be set according to requirements, such as the importance threshold is 0.6, 0.9, etc. If the importance corresponding to the object avatar and nickname is less than the importance threshold, the object avatar, nickname and other data are non-sensitive data. ② Data whose privacy is less than or equal to the privacy threshold. The privacy threshold can be set according to requirements, such as the privacy threshold is 90, 80, etc. Correspondingly, the sensitive data includes at least one of the following: ① Data whose importance is greater than the importance threshold. Schematically, the second application is an instant messaging application, and the importance of the enterprise architecture information of a certain object in the second application is 1, which is greater than the importance threshold 0.8, then the enterprise architecture information of the object can be considered as sensitive data. ② Data with a privacy level less than or equal to the privacy threshold. The privacy threshold can be set according to needs. Schematically, the second application is an instant messaging application. The privacy level of the document information in the second application is 90, which is greater than the privacy threshold of 80. In this case, the document information is considered to be sensitive data.

[0131] If it is determined according to the business needs of the first application that the data type of the business data to be accessed is non-sensitive data, then the authorization code (code) can be used to directly obtain the business data within the scope of authority indicated by the authorization code from the server, that is, execute step S308. If it is determined according to the business needs of the first application that the data type of the business data to be accessed is sensitive data, then the embodiment of the present application introduces an access control SDK, and interacts with the server through the access control SDK to obtain the corresponding business data. By introducing the access control SDK, it is possible to directly interact with the server instead of the first application, implement access control of the business data in the second application, and increase control and protection of data security. At this time, it is necessary to first use the data access authorization code (SDK_code) to the second application to authorize login to the access control SDK, in exchange for the access control SDK login state required to access sensitive data, the first encryption ticket and the second decryption ticket, etc., that is, execute step S309; ​​then obtain the corresponding business data through the access control SDK.

[0132] S308: If the business data to be accessed is non-sensitive data, the first application program obtains the required business data from the server based on the authorization code.

[0133] As an implementation method, the first application can call the cgi (Common Gateway Interface) of the background server corresponding to the first application, and send a data acquisition request to the server corresponding to the second application, and the data acquisition request carries an authorization code. The server corresponding to the second application can respond to the data acquisition request, obtain the business data requested by the data acquisition request, and return it to the first application.

[0134] S309: If the business data to be accessed is sensitive data, the first application program transmits a data access authorization code to the access control SDK.

[0135] In one implementation, the first application may support access to an access control SDK, and the first application calls an application programming interface (such as a login interface) of the access control SDK to pass a data access authorization code to the access control SDK.

[0136] S310: The access control SDK initiates a login request to the server based on the data access authorization code, wherein the login request includes the data access authorization code. The login request is used to exchange for a login ticket of the access control SDK, and the login ticket is returned.

[0137] S311, the server responds to the login request and returns a login ticket to the access control SDK based on the data access authorization code. The login ticket is used to indicate that the access control SDK has successfully authorized the login through the second application; the login ticket includes at least one of the following: a second open identifier, a first encryption ticket, and a second decryption ticket.

[0138] In a specific implementation, the server responds to the login request, exchanges the login ticket based on the data access authorization code, and returns the login ticket to the access control SDK. It should be understood that the login ticket used by the access control SDK is exchanged in the server, and the login ticket is isolated from the storage of the second application itself and is not mixed with the second application. Therefore, the access control SDK cannot access the services of the second application, which can also ensure data security to a certain extent.

[0139] Among them, the purpose of returning the second open identifier is to authenticate the data access request later. That is to say, when the first application calls the business interface of the access control SDK to access the business data in the second application, the access control SDK needs to require the first application to pass in the first open identifier obtained in exchange for the authorized login SDK. The access control SDK will then compare the passed-in first open identifier with the second open identifier returned by the access control SDK during the authorized login to ensure that the current request is for the same login account before initiating a data access request to prevent access errors caused by switching login accounts.

[0140] After the access control SDK receives the login ticket returned by the server, the access control SDK logs in successfully. The access control SDK can store the login ticket in the storage space of the access control SDK. The login ticket has an effective time and the effective time is controlled by the server. When the access control SDK detects that the login ticket is about to expire, it can initiate a renewal request to the server corresponding to the second application. The renewal request is used to request to re-acquire the login ticket or directly reset the effective time of the login ticket.

[0141] After the access control SDK is successfully logged in, the following is an explanation of the process of the first application program accessing the business data of the second application program through the access control SDK in the embodiment of the present application. Figure 5 , is a schematic diagram of a data processing flow provided by another exemplary embodiment of the present application. The data processing flow can be executed by each device in the above data processing system. The data processing flow includes the following steps S501-S508:

[0142] S501. A first application sends a data access request to an access control SDK. The data access request carries a first open identifier. The data access request is used to request access to business data related to the first open identifier in a second application through the access control SDK.

[0143] The data access request may be a business cgi request. As an implementation method, the first application may call the business interface of the access control SDK and send a data access request to the access control SDK. Schematically, the data access request may be used to access organizational structure subordinate information, document information, etc. in the second application.

[0144] S502: The access control SDK performs authentication processing on the data access request.

[0145] As an implementation method, the access control SDK can obtain the second open identifier and use the second open identifier to authenticate the data access request. If the data access request is successfully authenticated, step S503 is executed; if the data access request is not authenticated, the access control SDK refuses to respond to the data access request and returns a rejection response prompt to the first application. The second open identifier is obtained during the process of the access control software toolkit performing authorization login through the second application.

[0146] Among them, the authentication process is used to verify whether the authorization object identified by the first open identifier and the authorization object identified by the second open identifier are the same object. In other words, the authentication process of the data access request using the second open identifier may include: verifying whether the authorization object identified by the first open identifier and the authorization object identified by the second open identifier are the same object. If the authorization object identified by the first open identifier and the authorization object identified by the second open identifier are the same object, it means that the login account has not been switched. At this time, the login account of the access control SDK and the login account of the second application are the same login account, and it is determined that the data access request authentication is successful. If the authorization object identified by the first open identifier and the authorization object identified by the second open identifier are not the same object, it means that the login account has been switched, and it is determined that the data access request authentication has failed.

[0147] S503. If the data access request is authenticated successfully, the access control SDK responds to the data access request by using the first encryption ticket to encrypt the data access request to obtain an encrypted data access request, and sends the encrypted data access request to the server corresponding to the second application.

[0148] As an implementation method, after the access control SDK successfully logs in, the access control SDK is independently connected to the network and establishes a direct communication connection with the second application. The data between the access control SDK and the server can be transmitted in an independent communication channel formed between the access control SDK and the server based on the direct communication connection between the access control SDK and the server. Other devices cannot obtain the corresponding data, so they can only obtain sensitive types of data from the server through the access control SDK. In this implementation method, sending an encrypted data access request to the server corresponding to the second application may include: the access control SDK sends an encrypted data access request to the server through the independent communication channel formed between the access control SDK and the server.

[0149] S504: The server uses the first decryption ticket corresponding to the first encryption ticket to decrypt the encrypted data access request and obtain the business data.

[0150] It should be understood that the first encryption ticket encrypts the data access request, and the process of decrypting the encrypted data access request by the first decryption ticket on the server can also be understood as: the process of authenticating the data access request. If the data access request cannot be successfully decrypted by the first decryption ticket, it is determined that the first application does not have the authority to the business data requested by the data access request. If the data access request is successfully decrypted by the first decryption ticket, it is determined that the first application has the authority to the business data requested by the data access request.

[0151] In one implementation, the server uses the first decryption ticket corresponding to the first encryption ticket to decrypt the encrypted data access request and then obtain the business data, which may include: the server stores the first decryption ticket corresponding to the first encryption ticket, the server uses the stored first decryption ticket to decrypt the encrypted data access request to obtain the data access request, and determines the object identifier of the first open identifier in the data access request in the second application, and obtains the business data related to the object identifier from the server. The first open identifier is sent to the server to inform the server of the object identity of the requested business data.

[0152] In another implementation, the server includes a logic server, an object identification storage server (openid server), a session server, and a data storage server (crop server). The logic server is used to decrypt the encrypted data access request and to encrypt the business data to be returned; the object identification storage server is used to store the object identification of the object in the second application; the session server is used to verify the validity of the object identification; and the data storage server is used to store data associated with the object identification (such as the login state associated with the object identification, shared document information, etc.).

[0153] The server uses the first decryption ticket corresponding to the first encryption ticket to decrypt the encrypted data access request and then obtains the business data, which may include the following steps: A. The logic server receives the encrypted data access request sent by the access control SDK, and uses the second decryption ticket corresponding to the first encryption ticket to decrypt the encrypted data access request to obtain the data access request. B. Send the first open identifier in the data access request to the object identifier storage server. C. After receiving the first open identifier, the object identifier storage server may perform object resolution on the first open identifier to obtain the object identifier (vid) of the authorized object identified by the first open identifier in the second application, and the object identifier is used to identify the id of the authorized object under the second application architecture. D. The object identifier storage server returns the object identifier to the logic server. E. The logic server may encrypt the object identifier to obtain the encrypted object identifier, and generate a verification request based on the encrypted object identifier, and send the verification request to the session server, and the verification request is used to request verification of the validity of the object identifier. F. In response to the verification request, the session server decrypts the encrypted object identifier to obtain the object identifier, and performs validity verification on the object identifier, and then returns the validity verification result to the logic server. The validity check here may include: checking whether the authorized object indicated by the object identifier has valid identity information in the second application. If the authorized object indicated by the object identifier has valid identity information in the second application, a validity check result indicating that the object identifier is valid is obtained; if the authorized object indicated by the object identifier does not have valid identity information in the second application, a validity check result indicating that the object identifier is invalid is obtained. G. The logic server receives the validity check result. If the validity check result indicates that the object identifier is valid, the logic server initiates a data request to the data storage server. The data request includes the object identifier. The data request is used to request to obtain business data associated with the object identifier. If the validity check result indicates that the object identifier is invalid, a notification indicating that the first open identifier is incorrect is returned to the access control SDK. H. The data storage server responds to the data request, obtains the business data associated with the object identifier, and returns the business data to the logic server.

[0154] S505. The server uses the second encryption ticket to encrypt the business data to obtain encrypted business data, and sends the encrypted business data to the access control SDK.

[0155] As an implementation manner, returning the encrypted service data to the access control SDK may include: the server sending the encrypted service data to the access control SDK through an independent communication channel formed between the access control SDK and the server.

[0156] S506. The access control SDK uses the second decryption ticket corresponding to the second encryption ticket to decrypt the encrypted business data to obtain business data, and desensitizes the business data to obtain response data.

[0157] Among them, the so-called desensitization processing means that the business data is not directly landed (that is, it is not directly returned to the first application), and is only used for the access control SDK to render the UI in the memory. The access control SDK can directly complete the rendering and display of the data in the form of a custom UI component, and does not provide the original data stream (that is, it does not provide business data), and the custom UI component does not provide a data interface for directly obtaining business data. Schematically, when the data access request is to initiate a shared document, the selection of the UI interface and data presented by the document is completely controlled by the access control SDK. The first application can only use or display the rendered business data, but cannot obtain the business data by itself and use it for other purposes. The security of the data is further increased through desensitization processing.

[0158] In one implementation, the access control SDK desensitizes the business data, and obtaining the response data may include: rendering the business data (ie, UI rendering) through an interface processing thread in the access control SDK to generate interface display data; and then determining the interface display data as the response data.

[0159] Among them, rendering the business data through the interface processing thread in the access control SDK to generate interface display data may include: rendering the business data through the interface processing thread in the access control SDK using the UI component customized by the access control SDK to generate interface display data. It should be understood that the interface display data or the response data can be understood as a rendered component rather than the original business data, so that the access control of the data can be further strengthened and the security of data access can be increased.

[0160] S507: The access control SDK returns the response data to the first application.

[0161] S508: The first application displays the response data in the first application.

[0162] In the embodiment of the present application, for sensitive data and non-sensitive data in the second application, when accessing the business data of the second application, two data access methods can be flexibly adopted to obtain the corresponding business data from the server, that is, when the data type of the accessed business data is non-sensitive data, the business data can be directly obtained from the server through the authorization code, and the business data in the second application can be quickly accessed. When the data type of the accessed business data is sensitive data, the data access authorization code can be used to log in to the server for authorization of the access control SDK, and then the access control SDK sends a data access request to the server corresponding to the second application, and the data access request carries the first open identifier; the data access request is used to request access to the business data related to the first open identifier in the second application through the access control software toolkit; then, in response to the data access request, the requested business data is obtained from the server corresponding to the second application through the access control software toolkit; the business data is desensitized to obtain response data, and the response data is returned to the first application. It can be seen that by obtaining business data from the server corresponding to the second application through the access control software toolkit, the first application is prevented from directly obtaining business data from the server corresponding to the second application, and the control of business data access in the second application is strengthened, thereby ensuring the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of directly returning the business data to the first application. The first application cannot use the business data for other purposes, further ensuring the security of the business data. In addition, the data between the access control SDK and the server is encrypted, which can ensure the security of data transmission to a certain extent.

[0163] It should be understood that the above data processing flow can be applied to any two applications, where the first application can log in through the second application for authorization and access the business data in the second application. For example, the first application is a conference application dedicated to initiating conferences, and the second application is an instant messaging application:

[0164] Scenario 1: A conference application accesses the organizational structure information of an object in an instant messaging application.

[0165] The conference application can access the WWLink SDK and access the organizational structure and subordinate information of the objects in the instant messaging application through the business interface provided by the WWLink SDK. The specific scenario is: suppose object 1 is an employee of enterprise A. When logging into the conference application, he uses the instant messaging application to authorize login; object 2 (i.e., object 1's colleague) also uses the instant messaging application to authorize login when logging into the conference application. At this time, Figure 6a , is a schematic diagram of an exemplary embodiment of the present application providing a method for displaying organizational structure and subordinate information of objects in a conference application. Figure 6a In the conference application, a member list 60 is displayed, and the member list 60 includes the organizational structure subordinate information of object 1 (i.e., enterprise A / XX center / X group). The organizational structure subordinate information of object 1 is obtained by the conference application from the server corresponding to the instant messaging application through the business interface of the WWLink SDK when the conference application is connected to the WWLink SDK.

[0166] Scenario 2: A conference application accesses document information in an instant messaging application.

[0167] The conference application is connected to the WWLink SDK and accesses the document information in the instant messaging application through the business interface provided by the WWLink SDK. The specific scenario is: Object 1 is an employee of enterprise A. When logging into the conference application, he uses the instant messaging application to authorize the login. Then, in the conference, Object 1 can choose to share a certain document information in the instant messaging application for document information sharing. Figure 6b As shown, it is a schematic diagram of a process of accessing document information in an instant messaging application provided by an exemplary embodiment of the present application. Object 1 triggers the share document option 61 in the conference application 601. In response to the triggering operation for the share document option 61, the conference application directly opens the rendered select document page 62 from the instant messaging application through the business interface provided by the WWLink SDK. The select document page may contain one or more shareable document information. Assuming that object 1 can select document information 1, the conference application initiates the sharing process in response to the selection operation of document information 1. When object 1 triggers the share option 63, the document information 1 rendered by the WWLink SDK is displayed in the conference application 601.

[0168] Next, the data processing method provided in the embodiment of the present application is described.

[0169] See also Figure 7, is a flow chart of a data processing method provided by an exemplary embodiment of the present application. The data processing method can be executed by the access control SDK. The data processing method may include the following steps S701-S703:

[0170] S701. Receive a data access request sent by a first application, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through an access control software toolkit; both the access control software toolkit and the first application are authorized to log in through the second application.

[0171] S702: In response to the data access request, obtain the requested business data from the server corresponding to the second application program through the access control software toolkit.

[0172] As an implementation method, in response to the data access request, the data access request is directly sent to the server corresponding to the second application through the access control SDK, so that the server obtains the business data based on the data access request and returns the business data.

[0173] As another implementation, in order to ensure the security of data transmission, the data transmitted between the access control SDK and the server can be encrypted. Step S702 may include: in response to a data access request, encrypting the data access request using a first encryption ticket to obtain an encrypted data access request; sending an encrypted data access request to the server so that the server uses a first decryption ticket corresponding to the first encryption ticket to decrypt the encrypted data access request to obtain business data, and uses a second encryption ticket to encrypt the business data to obtain encrypted business data; receiving the encrypted business data returned by the server, and using a second decryption ticket corresponding to the second encryption ticket to decrypt the encrypted business data to obtain business data. The first encryption ticket and the second decryption ticket are obtained during the process of the access control software toolkit performing authorized login through the second application.

[0174] S703: Desensitize the business data to obtain response data, and return the response data to the first application.

[0175] The structure of the access control software toolkit includes an interaction layer and a cross-platform layer; the interaction layer is used to interact with the first application program and to provide an application programming interface for the first application program; the cross-platform layer is used to provide an interaction interface to the interaction layer and provide various processing logics for the access control software toolkit; the cross-platform layer is introduced into the engineering file of the access control software toolkit in the form of a static library; the access control software toolkit provides access control services for the first application program in the form of a dynamic library. The processing logic may include but is not limited to: providing an interaction interface to the interaction layer, caching data, providing interface logic, providing a login state for the access control SDK, providing storage services and renewal services for login tickets in the access control SDK, providing a login state for data access requests (such as providing a first open identifier), packaging business data and data access requests, encrypting and decrypting business data and data access requests, data transmission, and other processing logic.

[0176] The cross-platform layer includes at least one interface processing thread and at least one input and output thread; desensitizing the business data to obtain response data may include: rendering the business data through the interface processing thread in the access control software toolkit to generate interface display data; and determining the interface display data as response data.

[0177] The data processing method further includes steps S704-S705:

[0178] S704: Use the second open identifier to authenticate the data access request; the second open identifier is obtained during the process of the access control SDK performing authorization login through the second application; wherein the authentication process is used to verify whether the authorization object identified by the first open identifier and the authorization object identified by the second open identifier are the same object; if they are the same object, it is determined that the data access request authentication is successful. If they are not the same object, it is determined that the data access authentication fails, and a rejection response prompt message is returned to the first application, and the rejection response prompt message is used to indicate that the data access authentication fails.

[0179] S705: If the data access request authentication is successful, execute step S702.

[0180] The data processing method further includes step S706: performing access control processing on the data access request based on the preset access control rules; wherein the access control rules include at least one of the following: frequency rules, time rules, and authority rules. Next, the access control processing on the data access request based on the preset access control rules is specifically described:

[0181] ① The access control rule includes a frequency rule, which is used to stipulate that the frequency of the first application sending a data access request must be less than a frequency threshold.

[0182] Here, step S706 may include: determining the number of times the first application initiates a data access request within the target time period, and determining the frequency of the first application sending the data access request based on the number, and judging whether the frequency of the first application sending the data access request is greater than the frequency threshold. If the frequency is less than the frequency threshold, step S702 is executed. If the frequency is greater than or equal to the frequency threshold, the access control SDK does not respond to the data access request, and returns a first prompt message of a rejection response to the first application. The first prompt message is used to prompt that the frequency of the current data access request has exceeded the frequency threshold. Among them, the frequency threshold can be set according to demand, such as the frequency threshold can mean that data access requests can only be sent 3 times, 10 times, etc. within the target time. The target time period can refer to 1 day, 1 hour, 30 minutes, etc. Illustratively, the frequency threshold means that data access requests can only be sent three times within one hour. The access control SDK determines that the first application has initiated data access requests twice within one hour. It can be determined that the frequency of the first application sending data access requests is less than the frequency threshold. In response to the data access request, the requested business data can be obtained from the server corresponding to the second application through the access control SDK.

[0183] ② Access control rules include time rules, which are used to stipulate that the time when the first application sends a data access request must be within a preset time period; that is, the first application is controlled to access the business data in the second application only within the preset time period.

[0184] In this embodiment, step S706 may include: determining whether the time of the data access request sent by the first application is within the preset time period, if it is determined that the time of the data access request sent by the first application is within the preset time period, then executing step S702; if it is determined that the time of the data access request sent by the first application is outside the preset time period, then not responding to the data access request, and returning a second prompt message of a rejection response to the first application, the second prompt message is used to prompt to initiate a data access request within the preset time. Among them, the preset time period can be set according to demand, such as the preset time period can be 10:00-12:00, when the time when the first application sends the data access request to the access control SDK is 11:00, it is determined that the time when the first application sends the data access request is within the preset time period, and step S702 can be executed.

[0185] ③ The access control rules include permission rules, which are used to stipulate that the authorized object identified by the first open identifier must have the permission to access the requested business data.

[0186] Step S706 may include: the access control SDK determines whether the authorized object identified by the first open identifier has the authority to access the requested business data based on the data access permission correspondence between the object and the business data; if it is determined that the authorized object has the authority to access the requested business data, step S702 is executed; if it is determined that the authorized object does not have the authority to access the requested business data, the data access request is not responded to, and a third prompt message of a rejection response is returned to the first application, the third prompt message is used to indicate that the authorized object identified by the first open identifier does not have the authority to access the requested business data. Schematically, the data access permission correspondence includes that the authorized object has the authority to access document information 1. When the business data requested by the authorized object identified by the first open identifier to access is document information 1, it can be determined that the authorized object identified by the first open identifier has the authority to access the requested document information 1.

[0187] It should be understood that the above access control rules can be flexibly selected for use, or can be used in combination, for example: the above methods ① and ③ are combined, such as when the frequency of the first application sending data access requests is less than the frequency threshold and the authorized object identified by the first open identifier needs to have the authority to access the requested business data, the access control SDK can respond to the data access request and obtain the requested business data from the server corresponding to the second application through the access control software toolkit. For another example, the above methods ① and ② are combined, such as when the first application sends a data access request within a preset time period, and the frequency of the first application sending a data access request is less than the frequency threshold, the access control SDK can respond to the data access request and obtain the requested business data from the server corresponding to the second application through the access control software toolkit. At this time, the target time period can be a preset time period, that is, the first application needs to initiate a data access request within the preset time, and the frequency of sending data access requests within the preset time period must be less than the frequency threshold. For example: the above ①, ② and ③ can also be used in combination; by using the above access control rules alone or in combination, the control and management of data access can be strengthened, malicious third-party applications can be prevented from attacking the server corresponding to the second application, and the security of data access in the second application is improved. By performing secure access control through the access control SDK, it can be better applied to scenarios where data is more sensitive and has more stringent data requirements.

[0188] Among them, the process of the access control SDK performing authorized login through the second application may include: receiving a data access authorization code transmitted by the first application; the data access authorization code is obtained by the first application in the process of authorized login through the second application, and is transmitted to the access control SDK by calling the application programming interface provided by the access control software toolkit; based on the data access authorization code, initiating a login request to the server, and the login request includes the data access authorization code; receiving a login ticket returned by the server based on the data access authorization code; the login ticket is used to indicate that the access control software toolkit has successfully performed authorized login through the second application; the login ticket includes at least one of the following: a second open identifier, a first encryption ticket and a second decryption ticket.

[0189] In one embodiment, after the access control software SDK successfully authorizes and logs in through the second application, it can be independently connected to the Internet and directly establish a direct communication connection with the server; business data can be transmitted in an independent communication channel formed between the access control SDK and the server based on the direct communication connection between the access control SDK and the server.

[0190] It should be understood that the data between the access control SDK and the server involved in the embodiments of the present application (such as encrypted data requests, encrypted business data, etc.) are all transmitted in an independent communication channel formed between the access control SDK and the server. Through this independent communication channel, the business data in the server can only be obtained through the access control SDK, and other devices cannot directly obtain it, which can ensure the security of data access to a certain extent.

[0191] In an embodiment of the present application, a data access request sent by a first application is received, and the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through an access control software toolkit; the access control software toolkit and the first application are both authorized to log in through the second application; then in response to the data access request, the requested business data is obtained from the server corresponding to the second application through the access control software toolkit; the business data is desensitized to obtain response data, and the response data is returned to the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control software toolkit, which avoids the first application directly obtaining business data from the server corresponding to the second application, and can effectively ensure the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of directly returning the business data to the first application. The first application cannot use the business data for other purposes, which further improves the security of the business data.

[0192] See also Figure 8 , is a flow chart of a data processing method provided by an exemplary embodiment of the present application. The data processing method may be executed by a first application program. The data processing method may include the following steps S801-S803:

[0193] S801. Send a data access request of the first application to the access control SDK, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in the second application through the access control SDK; the access control SDK and the first application both perform authorized login through the second application.

[0194] As an implementation method, the first application can call the service interface of the access control SDK and send the data access request of the first application to the access control SDK. The first open identifier needs to be passed in when calling the service interface of the access control SDK.

[0195] S802, receiving response data returned by the access control SDK, wherein the response data is obtained by the access control software toolkit in response to the data access request, obtaining the requested business data from the server corresponding to the second application, and performing desensitization processing on the business data.

[0196] S803: Display the response data in the first application.

[0197] The process of the first application performing authorized login through the second application may include: calling the application programming interface provided by the authorized login software toolkit, initiating an authorized login request to the server through the second application, causing the server to respond to the authorized login request, and generating a first open identifier, an authorization code, and a data access authorization code based on the login account of the second application. Then, calling the application programming interface provided by the authorized login SDK, and receiving the first open identifier, authorization code, and data access authorization code returned by the server through the second application.

[0198] It should be understood that the access control SDK and the login authorization SDK are two independent SDKs; or, the access control SDK and the authorized login SDK are the same SDK; when the access control SDK and the login authorization SDK are two independent SDKs, the access control SDK can be used for data access control, and the login authorization SDK is used for the first application login authorization. The first application supports access to one or more of the access control SDK and the authorized login SDK. The access control SDK and the authorized login SDK can be provided by the second application, and data access control is performed through the access control SDK provided by the second application, which to a certain extent avoids the first application from directly interacting with the server for data, thereby improving data security.

[0199] The data processing method provided in the embodiment of the present application may further include steps S804-S806:

[0200] S804: Based on the business requirements of the first application, determine the data type of the business data that the first application needs to access from the second application.

[0201] The data type may be sensitive data or non-sensitive data. Sensitive data includes at least one of the following: data with an importance greater than an importance threshold, and data with a privacy level greater than a privacy threshold. Non-sensitive data includes at least one of the following: data with an importance less than or equal to an importance threshold, and data with a privacy level less than or equal to a privacy threshold.

[0202] S805: If the business data to be accessed is sensitive data, a data access request is generated based on the first open identifier, and step S801 is executed.

[0203] It should be noted that the embodiment of the present application can log in to the access control SDK in advance. If the business data to be accessed is sensitive data, the first application can directly execute step S805. Alternatively, if the business data to be accessed is sensitive data, the first application can call the application programming interface of the access control SDK to pass the data access authorization code to the access control SDK, so that the access control SDK uses the data access authorization code to log in to the server to exchange for a login ticket, and after the access control SDK successfully logs in, execute steps S801-S803. This application does not limit this.

[0204] S806: If the business data to be accessed is non-sensitive data, the required business data is obtained from the server based on the authorization code.

[0205] In an embodiment of the present application, a first application sends a data access request of the first application to an access control software toolkit, and the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control software toolkit; the access control software toolkit and the first application both log in through the second application for authorization; receive response data returned by the access control software toolkit, the response data is obtained by the access control software toolkit in response to the data access request, obtaining the requested business data from the server corresponding to the second application, and desensitizing the business data; and display the response data in the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control software toolkit, which avoids the first application directly obtaining the business data from the server corresponding to the second application, and can effectively ensure the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of directly returning the business data to the first application, and the first application cannot use the business data for other purposes, which further improves the security of the business data.

[0206] See also Fig. 9 , is a flow chart of a data processing method provided by an exemplary embodiment of the present application. The data processing method may be executed by a server corresponding to the second application program, and the data processing method may include the following steps S901-S903:

[0207] S901. Receive a data access request from a first application sent by an access control SDK, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control SDK; both the access control SDK and the first application are authorized to log in through the second application.

[0208] As an implementation method, receiving the data access request of the first application sent by the access control SDK may be: receiving the encrypted data access request of the first application sent by the access control SDK, the encrypted data access request is obtained by the access control SDK using the first encryption ticket to encrypt the data access request, and then the server may use the first decryption ticket corresponding to the first encryption ticket to decrypt the encrypted data access request to obtain the data access request. The data access request must include a first open identifier, which can be used to inform the server of the identity of the authorized object currently requesting business data.

[0209] S902: In response to the data access request, obtain the requested business data based on the first open identifier.

[0210] S903: Return the business data to the access control SDK, so that the access control SDK performs desensitization processing on the business data to obtain response data, and the access control SDK returns the response data to the first application.

[0211] As an implementation method, the business data may be directly returned to the access control SDK. As another implementation method, returning the business data to the access control SDK may include: encrypting the business data using the second encryption ticket to obtain encrypted business data, and returning the encrypted business data to the access control SDK, so that the access control SDK uses the second encryption ticket corresponding to the second decryption ticket to decrypt the encrypted business data to obtain the business data, and desensitizes the business data to obtain response data, and the access control SDK returns the response data to the first application.

[0212] In one embodiment, the server can receive an authorization login request initiated by a second application, and in response to the authorization login request, generate a first open identifier, authorization code, and data access authorization code based on the login account of the second application, and then return the first open identifier, authorization code, and data access authorization code to the second application, so that the second application returns the first open identifier, authorization code, and data access authorization code to the authorization login SDK, and the authorization login SDK returns the first open identifier, authorization code, and data access authorization code to the first application.

[0213] Among them, if the data type of the business data that the first application wants to access is non-sensitive data, the server can receive a data acquisition request sent by the first application, and the data acquisition request includes an authorization code. The data acquisition request is sent when the business data that the first application needs to access is non-sensitive data; the server responds to the data acquisition request, obtains the requested business data, and returns it to the first application.

[0214] The data processing method provided in the embodiment of the present application also includes: the server receives a login request sent by the access control SDK, and the login request includes a data access authorization code; the server can exchange a login ticket based on the data access authorization code, and return the login ticket to the access control SDK, and the login ticket is used to indicate that the access control software toolkit has successfully authorized the login through the second application; the login ticket includes at least one of the following: a second open identifier, a first encryption ticket, and a second decryption ticket.

[0215] In an embodiment of the present application, a data access request of a first application sent by an access control SDK is received, and the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control SDK; the access control SDK and the first application are both authorized to log in through the second application; in response to the data access request, the requested business data is obtained based on the first open identifier; the business data is returned to the access control SDK so that the access control software toolkit desensitizes the business data to obtain response data, and the access control software toolkit returns the response data to the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control SDK, which avoids the first application directly obtaining the business data from the server corresponding to the second application, and can effectively ensure the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of being directly returned to the first application. The first application cannot use the business data for other purposes, which further improves the security of the business data.

[0216] Next, the data processing device provided in the embodiment of the present application is described.

[0217] See also Fig.10 , Fig.10 is a schematic diagram of a data processing device provided by an exemplary embodiment of the present application, wherein the data processing device may be provided with an access control software toolkit. The data processing device may be a computer program (including program code) in a computer device, for example, the data processing device may be an application software in a computer device; the data processing device may be used to execute Figure 3 , Figure 4 as well as Figure 7 Some or all of the steps in the method embodiment shown. Fig.10 , the data processing device comprises the following units:

[0218] A receiving unit 1001 is used to receive a data access request sent by a first application, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through an access control software toolkit; both the access control software toolkit and the first application are authorized to log in through the second application;

[0219] The processing unit 1002 is used to obtain the requested business data from the server corresponding to the second application program through the access control software toolkit in response to the data access request;

[0220] The processing unit 1002 is also used to perform desensitization processing on the business data, obtain response data, and return the response data to the first application.

[0221] The processing unit 1002 is further configured to:

[0222] The data access request is authenticated using a second open identifier; the second open identifier is obtained during the process of the access control software toolkit performing authorized login via the second application program;

[0223] If the data access request is successfully authenticated, executing the step of obtaining the requested business data from the server corresponding to the second application program through the access control software toolkit in response to the data access request;

[0224] The authentication process is used to verify whether the authorization object identified by the first open identifier and the authorization object identified by the second open identifier are the same object; if they are the same object, the data access request authentication is successful.

[0225] The processing unit 1002 is further configured to:

[0226] Based on the preset access control rules, access control processing is performed on data access requests;

[0227] Among them, the access control rules include at least one of the following: frequency rules, time rules, and permission rules; the frequency rules are used to stipulate that the frequency of the first application sending data access requests must be less than the frequency threshold; the time rules are used to stipulate that the time when the first application sends data access requests must be within a preset time period; the permission rules are used to stipulate that the authorized object identified by the first open identifier must have the authority to access the requested business data.

[0228] The processing unit 1002 may be specifically configured to:

[0229] In response to the data access request, encrypt the data access request using the first encryption ticket to obtain an encrypted data access request;

[0230] Sending an encrypted data access request to the server, so that the server uses the first decryption ticket corresponding to the first encryption ticket to decrypt the encrypted data access request and obtain the business data, and uses the second encryption ticket to encrypt the business data to obtain the encrypted business data;

[0231] Receive the encrypted business data returned by the server, and use the second decryption ticket corresponding to the second encryption ticket to decrypt the encrypted business data to obtain the business data;

[0232] The first encryption ticket and the second decryption ticket are obtained during the process of the access control software toolkit performing authorized login through the second application program.

[0233] The structure of the access control software toolkit includes an interaction layer and a cross-platform layer;

[0234] The interaction layer is used to perform interface interaction with the first application and to provide an application programming interface for the first application;

[0235] The cross-platform layer is used to provide an interactive interface to the interactive layer and provide various processing logics for the access control software toolkit; the cross-platform layer is introduced into the engineering file of the access control software toolkit in the form of a static library;

[0236] The access control software toolkit provides access control services for the first application program in a dynamic library manner.

[0237] The cross-platform layer includes at least one interface processing thread and at least one input and output thread; the processing unit 1002 can be specifically used for:

[0238] Render the business data through the interface processing thread in the access control software toolkit to generate interface display data;

[0239] The interface display data is determined as the response data.

[0240] The process of the access control software toolkit performing authorized login through the second application program includes:

[0241] Receiving a data access authorization code transmitted by the first application; the data access authorization code is obtained by the first application during the process of authorized login through the second application, and is transmitted to the access control software toolkit by calling an application programming interface provided by the access control software toolkit;

[0242] Based on the data access authorization code, a login request is initiated to the server, where the login request includes the data access authorization code;

[0243] A login ticket is received from the server based on the data access authorization code; the login ticket is used to indicate that the access control software toolkit has successfully authorized the login through the second application; the login ticket includes at least one of the following: a second open identifier, a first encryption ticket, and a second decryption ticket.

[0244] Wherein, after the access control software toolkit successfully logs in through the second application program through authorization, a direct communication connection is established with the server;

[0245] The business data is transmitted in an independent communication channel formed between the access control software toolkit and the server based on a direct communication connection between the access control software toolkit and the server.

[0246] In an embodiment of the present application, a data access request sent by a first application is received, and the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through an access control software toolkit; the access control software toolkit and the first application are both authorized to log in through the second application; then in response to the data access request, the requested business data is obtained from the server corresponding to the second application through the access control software toolkit; the business data is desensitized to obtain response data, and the response data is returned to the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control software toolkit, which avoids the first application directly obtaining business data from the server corresponding to the second application, and can effectively ensure the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of directly returning the business data to the first application. The first application cannot use the business data for other purposes, which further improves the security of the business data.

[0247] See also Fig.11 , Fig.11 is a structural diagram of a data processing device provided by another exemplary embodiment of the present application, in which a first application program is running. The data processing device may be a computer program (including program code) in a computer device, for example, the data processing device may be an application software in a computer device; the data processing device may be used to execute Figure 3 , Figure 4 as well as Figure 8 Some or all of the steps in the method embodiment shown. Fig.11 , the data processing device comprises the following units:

[0248] A sending unit 1101 is used to send a data access request of a first application to an access control software toolkit, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application;

[0249] The receiving unit 1102 is used to receive response data returned by the access control software toolkit, where the response data is obtained by the access control software toolkit in response to the data access request, obtaining the requested business data from the server corresponding to the second application, and performing desensitization processing on the business data;

[0250] The processing unit 1103 is configured to display the response data in the first application.

[0251] The process of the first application program performing authorized login through the second application program includes:

[0252] Calling the application programming interface provided by the authorization login software toolkit, initiating an authorization login request to the server through the second application, causing the server to respond to the authorization login request, and generating a first open identifier, an authorization code, and a data access authorization code based on the login account of the second application;

[0253] The application programming interface provided by the authorization login software toolkit is called, and the first open identification, authorization code and data access authorization code returned by the server are received through the second application.

[0254] The processing unit 1103 is further configured to:

[0255] Determine, based on the business requirements of the first application, the data type of the business data that the first application needs to access from the second application;

[0256] If the business data to be accessed is sensitive data, a data access request is generated based on the first open identifier, and a step of sending the data access request of the first application to the access control software toolkit is performed;

[0257] Among them, sensitive type data includes at least one of the following: data with an importance greater than an importance threshold, and data with a privacy level higher than a privacy threshold.

[0258] The processing unit 1103 is further configured to:

[0259] If the business data to be accessed is non-sensitive data, the required business data is obtained from the server based on the authorization code;

[0260] The non-sensitive type includes at least one of the following: data whose importance is less than or equal to an importance threshold, and data whose privacy is less than or equal to a privacy threshold.

[0261] The access control software toolkit and the authorization login software toolkit are two independent software toolkits; or, the access control software toolkit and the authorization login software toolkit are the same software toolkit;

[0262] The first application supports one or more of an access control software toolkit and an authorization login software toolkit.

[0263] In an embodiment of the present application, a first application sends a data access request of the first application to an access control software toolkit, and the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control software toolkit; the access control software toolkit and the first application both log in through the second application for authorization; receive response data returned by the access control software toolkit, the response data is obtained by the access control software toolkit in response to the data access request, obtaining the requested business data from the server corresponding to the second application, and desensitizing the business data; and display the response data in the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control software toolkit, which avoids the first application directly obtaining the business data from the server corresponding to the second application, and can effectively ensure the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of directly returning the business data to the first application, and the first application cannot use the business data for other purposes, which further improves the security of the business data.

[0264] See also Fig.12 , Fig.12 : is a structural diagram of a data processing device provided by another exemplary embodiment of the present application. The data processing device may be a computer program (including program code) in a computer device, for example, the data processing device may be an application software in a computer device; the data processing device may be used to execute Figure 3 , Figure 4 as well as Fig. 9 Some or all of the steps in the method embodiment shown. Fig.12 , the data processing device comprises the following units:

[0265] The receiving unit 1201 is used to receive a data access request of a first application program sent by an access control software toolkit, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application program through the access control software toolkit; the access control software toolkit and the first application program both perform authorized login through the second application program;

[0266] The processing unit 1202 is configured to obtain the requested business data based on the first open identifier in response to the data access request;

[0267] The returning unit 1203 is used to return the business data to the access control software toolkit, so that the access control software toolkit performs desensitization processing on the business data to obtain response data, and the access control software toolkit returns the response data to the first application.

[0268] In an embodiment of the present application, a data access request of a first application sent by an access control SDK is received, and the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control SDK; the access control SDK and the first application are both authorized to log in through the second application; in response to the data access request, the requested business data is obtained based on the first open identifier; the business data is returned to the access control SDK so that the access control software toolkit desensitizes the business data to obtain response data, and the access control software toolkit returns the response data to the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control SDK, which avoids the first application directly obtaining the business data from the server corresponding to the second application, and can effectively ensure the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of being directly returned to the first application. The first application cannot use the business data for other purposes, which further improves the security of the business data.

[0269] Next, the computer device provided in the embodiment of the present application is described.

[0270] Furthermore, the present application embodiment also provides a schematic diagram of the structure of a computer device. The schematic diagram of the structure of the computer device can be found in Fig.13 The computer device may include: a processor 1301, an input device 1302, an output device 1303 and a memory 1304. The processor 1301, the input device 1302, the output device 1303 and the memory 1304 are connected via a bus. The memory 1304 is used to store a computer program, the computer program includes program instructions, and the processor 1301 is used to execute the program instructions stored in the memory 1304.

[0271] In one embodiment, an access control SDK is provided in the computer device. In this embodiment, the processor 1301 performs the following operations by running the program instructions in the memory 1304:

[0272] Receive a data access request sent by a first application, the data access request carrying a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through an access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application;

[0273] In response to the data access request, obtaining the requested business data from the server corresponding to the second application program through the access control software toolkit;

[0274] The business data is desensitized to obtain response data, and the response data is returned to the first application.

[0275] The processor 1301 may further execute the following steps:

[0276] The data access request is authenticated using a second open identifier; the second open identifier is obtained during the process of the access control software toolkit performing authorized login via the second application program;

[0277] If the data access request is successfully authenticated, executing the step of obtaining the requested business data from the server corresponding to the second application program through the access control software toolkit in response to the data access request;

[0278] The authentication process is used to verify whether the authorization object identified by the first open identifier and the authorization object identified by the second open identifier are the same object; if they are the same object, the data access request authentication is successful.

[0279] The processor 1301 may further execute the following steps:

[0280] Based on the preset access control rules, access control processing is performed on data access requests;

[0281] Among them, the access control rules include at least one of the following: frequency rules, time rules, and permission rules; the frequency rules are used to stipulate that the frequency of the first application sending data access requests must be less than the frequency threshold; the time rules are used to stipulate that the time when the first application sends data access requests must be within a preset time period; the permission rules are used to stipulate that the authorized object identified by the first open identifier must have the authority to access the requested business data.

[0282] When the processor 1301 obtains the requested service data from the server corresponding to the second application program through the access control software toolkit in response to the data access request, the processor 1301 may specifically perform the following steps:

[0283] In response to the data access request, encrypt the data access request using the first encryption ticket to obtain an encrypted data access request;

[0284] Sending an encrypted data access request to the server, so that the server uses the first decryption ticket corresponding to the first encryption ticket to decrypt the encrypted data access request and obtain the business data, and uses the second encryption ticket to encrypt the business data to obtain the encrypted business data;

[0285] Receive the encrypted business data returned by the server, and use the second decryption ticket corresponding to the second encryption ticket to decrypt the encrypted business data to obtain the business data;

[0286] The first encryption ticket and the second decryption ticket are obtained during the process of the access control software toolkit performing authorized login through the second application program.

[0287] Among them, the structure of the access control software toolkit includes an interactive layer and a cross-platform layer; among them, the interactive layer is used to interact with the first application and to provide an application programming interface for the first application; the cross-platform layer is used to provide an interactive interface to the interactive layer and provide various processing logics for the access control software toolkit; the cross-platform layer is introduced into the engineering file of the access control software toolkit in the form of a static library; the access control software toolkit provides access control services for the first application in the form of a dynamic library.

[0288] The cross-platform layer includes at least one interface processing thread and at least one input and output thread. When the processor 1301 performs desensitization processing on the business data and obtains the response data, it can specifically perform the following steps:

[0289] Render the business data through the interface processing thread in the access control software toolkit to generate interface display data;

[0290] The interface display data is determined as the response data.

[0291] The process of the access control software toolkit performing authorized login through the second application program includes:

[0292] Receive a data access authorization code transmitted by the first application; the data access authorization code is obtained by the first application during the process of authorized login through the second application, and is transmitted to the access control software toolkit by calling an application programming interface provided by the access control software toolkit;

[0293] Based on the data access authorization code, a login request is initiated to the server, where the login request includes the data access authorization code;

[0294] A login ticket is received from the server based on the data access authorization code; the login ticket is used to indicate that the access control software toolkit has successfully authorized the login through the second application; the login ticket includes at least one of the following: a second open identifier, a first encryption ticket, and a second decryption ticket.

[0295] Wherein, after the access control software toolkit successfully logs in through the second application program through authorization, a direct communication connection is established with the server;

[0296] The business data is transmitted in an independent communication channel formed between the access control software toolkit and the server based on a direct communication connection between the access control software toolkit and the server.

[0297] In an embodiment of the present application, a data access request sent by a first application is received, and the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through an access control software toolkit; the access control software toolkit and the first application are both authorized to log in through the second application; then in response to the data access request, the requested business data is obtained from the server corresponding to the second application through the access control software toolkit; the business data is desensitized to obtain response data, and the response data is returned to the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control software toolkit, which avoids the first application directly obtaining business data from the server corresponding to the second application, and can effectively ensure the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of directly returning the business data to the first application. The first application cannot use the business data for other purposes, which further improves the security of the business data.

[0298] In another embodiment, the computer device may be the above-mentioned terminal device, in which the first application program is running. In this embodiment, the processor 1301 performs the following operations by running the program instructions in the memory 1304:

[0299] Sending a data access request of the first application to the access control software toolkit, wherein the data access request carries the first open identifier; the data access request is used to request access to business data related to the first open identifier in the second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application;

[0300] Receiving response data returned by the access control software toolkit, where the response data is obtained by the access control software toolkit in response to the data access request, obtaining the requested business data from the server corresponding to the second application, and performing desensitization processing on the business data;

[0301] The response data is displayed in the first application.

[0302] The process of the first application program performing authorized login through the second application program includes:

[0303] Calling the application programming interface provided by the authorization login software toolkit, initiating an authorization login request to the server through the second application, causing the server to respond to the authorization login request, and generating a first open identifier, an authorization code, and a data access authorization code based on the login account of the second application;

[0304] The application programming interface provided by the authorization login software toolkit is called, and the first open identification, authorization code and data access authorization code returned by the server are received through the second application.

[0305] The processor 1301 further performs the following steps:

[0306] Determine, based on the business requirements of the first application, the data type of the business data that the first application needs to access from the second application;

[0307] If the business data to be accessed is sensitive data, a data access request is generated based on the first open identifier, and a step of sending the data access request of the first application to the access control software toolkit is performed;

[0308] Among them, sensitive type data includes at least one of the following: data with an importance greater than an importance threshold, and data with a privacy level higher than a privacy threshold.

[0309] The processor 1301 further performs the following steps:

[0310] If the business data to be accessed is non-sensitive data, the required business data is obtained from the server based on the authorization code;

[0311] The non-sensitive type includes at least one of the following: data whose importance is less than or equal to an importance threshold, and data whose privacy is less than or equal to a privacy threshold.

[0312] The access control software toolkit and the authorization login software toolkit are two independent software toolkits; or, the access control software toolkit and the authorization login software toolkit are the same software toolkit;

[0313] The first application supports one or more of an access control software toolkit and an authorization login software toolkit.

[0314] In an embodiment of the present application, a first application sends a data access request of the first application to an access control software toolkit, and the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control software toolkit; the access control software toolkit and the first application both log in through the second application for authorization; receive response data returned by the access control software toolkit, the response data is obtained by the access control software toolkit in response to the data access request, obtaining the requested business data from the server corresponding to the second application, and desensitizing the business data; and display the response data in the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control software toolkit, which avoids the first application directly obtaining the business data from the server corresponding to the second application, and can effectively ensure the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of directly returning the business data to the first application, and the first application cannot use the business data for other purposes, which further improves the security of the business data.

[0315] In another embodiment, the computer device may be a server corresponding to the second application program. In this embodiment, the processor 1301 executes the following operations by running the program instructions in the memory 1304:

[0316] Receive a data access request of a first application sent by an access control software toolkit, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application;

[0317] In response to the data access request, obtaining the requested business data based on the first open identifier;

[0318] The business data is returned to the access control software toolkit so that the access control software toolkit performs desensitization processing on the business data to obtain response data, and the access control software toolkit returns the response data to the first application.

[0319] In an embodiment of the present application, a data access request of a first application sent by an access control SDK is received, and the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control SDK; the access control SDK and the first application are both authorized to log in through the second application; in response to the data access request, the requested business data is obtained based on the first open identifier; the business data is returned to the access control SDK so that the access control software toolkit desensitizes the business data to obtain response data, and the access control software toolkit returns the response data to the first application. It can be seen that the business data can be obtained from the server corresponding to the second application through the access control SDK, which avoids the first application directly obtaining the business data from the server corresponding to the second application, and can effectively ensure the security of the business data of the first application. In addition, after obtaining the business data, the business data will be desensitized instead of being directly returned to the first application. The first application cannot use the business data for other purposes, which further improves the security of the business data.

[0320] In addition, it should be pointed out here that: the embodiment of the present application also provides a computer-readable storage medium, and the computer-readable storage medium stores a computer program, and the computer program includes program instructions. When the processor executes the above program instructions, it can execute the above Figure 3 , Figure 4 , Figure 7-Figure 9 The method in the corresponding embodiment, therefore, will not be repeated here. For technical details not disclosed in the computer-readable storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application. As an example, the program instructions can be deployed on a computer device, or executed on multiple computer devices located in one location, or, executed on multiple computer devices distributed in multiple locations and interconnected by a communication network.

[0321] According to one aspect of the present application, a computer program product is provided, the computer program product comprising a computer program, the computer program being stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device can perform the above Figure 3 , Figure 4 , Figure 7-Figure 9 The method in the corresponding embodiment will therefore not be described in detail here.

[0322] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0323] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A data processing method, characterized in that: include: Receiving a data access request sent by a first application, wherein the data access request carries a first open identifier; The data access request is used to request access to the business data related to the first open identifier in the second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application; In response to the data access request, obtaining the requested business data from the server corresponding to the second application program through the access control software toolkit; The business data is desensitized to obtain response data, and the response data is returned to the first application.

2. The method according to claim 1, characterized in that The method further comprises: Using a second open identifier to authenticate the data access request; the second open identifier is obtained during the process of the access control software toolkit performing authorized login through the second application program; If the data access request is successfully authenticated, executing the step of obtaining the requested business data from the server corresponding to the second application program through the access control software toolkit in response to the data access request; The authentication process is used to verify whether the authorization object identified by the first open identifier and the authorization object identified by the second open identifier are the same object; if they are the same object, the data access request authentication is successful.

3. The method according to claim 1, characterized in that The method further comprises: Based on preset access control rules, perform access control processing on the data access request; Among them, the access control rules include at least one of the following: frequency rules, time rules, and permission rules; the frequency rules are used to stipulate that the frequency of the first application sending data access requests must be less than the frequency threshold; the time rules are used to stipulate that the time when the first application sends data access requests must be within a preset time period; the permission rules are used to stipulate that the authorized object identified by the first open identifier must have the authority to access the requested business data.

4. The method according to claim 1, characterized in that The step of obtaining the requested business data from the server corresponding to the second application program through the access control software toolkit in response to the data access request includes: In response to the data access request, encrypt the data access request using a first encryption ticket to obtain an encrypted data access request; Sending an encrypted data access request to the server, so that the server uses a first decryption ticket corresponding to the first encryption ticket to decrypt the encrypted data access request and obtain business data, and uses a second encryption ticket to encrypt the business data to obtain encrypted business data; receiving the encrypted business data returned by the server, and decrypting the encrypted business data using a second decryption ticket corresponding to the second encryption ticket to obtain the business data; The first encryption ticket and the second decryption ticket are obtained during the process of the access control software toolkit performing authorized login through the second application.

5. The method according to claim 1, characterized in that The structure of the access control software toolkit includes an interactive layer and a cross-platform layer; wherein, The interaction layer is used to perform interface interaction with the first application and to provide an application programming interface for the first application; The cross-platform layer is used to provide an interactive interface to the interactive layer and provide various processing logics for the access control software toolkit; the cross-platform layer is introduced into the engineering file of the access control software toolkit in a static library manner; The access control software toolkit provides access control services for the first application in a dynamic library manner.

6. The method according to claim 5, characterized in that The cross-platform layer includes at least one interface processing thread and at least one input and output thread; the desensitizing the business data to obtain response data includes: Rendering the business data through the interface processing thread in the access control software toolkit to generate interface display data; The interface display data is determined as response data.

7. The method according to claim 1, characterized in that The process of the access control software toolkit performing authorized login through the second application program includes: receiving a data access authorization code transmitted by the first application; the data access authorization code is obtained by the first application during the process of authorized login through the second application, and is transmitted to the access control software toolkit by calling an application programming interface provided by the access control software toolkit; Based on the data access authorization code, initiating a login request to the server, wherein the login request includes the data access authorization code; Receive a login ticket returned by the server based on the data access authorization code; the login ticket is used to indicate that the access control software toolkit has successfully authorized the login through the second application; the login ticket includes at least one of the following: a second open identifier, a first encryption ticket, and a second decryption ticket.

8. The method according to claim 7, characterized in that After the access control software toolkit successfully logs in through the second application program through authorization, a direct communication connection is established with the server; The business data is transmitted in an independent communication channel formed between the access control software toolkit and the server based on a direct communication connection between the access control software toolkit and the server.

9. A data processing method, characterized in that: The method comprises: Sending a data access request of a first application to an access control software toolkit, wherein the data access request carries a first open identifier; the data access request is used to request access to business data related to the first open identifier in a second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application; Receiving response data returned by the access control software toolkit, wherein the response data is obtained by the access control software toolkit in response to the data access request, obtaining the requested business data from the server corresponding to the second application, and performing desensitization processing on the business data; The response data is displayed in the first application.

10. The method according to claim 9, characterized in that The process of the first application program performing authorized login through the second application program includes: Calling an application programming interface provided by an authorization login software toolkit, initiating an authorization login request to the server through the second application, causing the server to respond to the authorization login request, and generating a first open identifier, an authorization code, and a data access authorization code based on a login account of the second application; The application programming interface provided by the authorization login software toolkit is called, and the first open identifier, authorization code and data access authorization code returned by the server are received through the second application.

11. The method according to claim 10, characterized in that The method further comprises: Based on the business requirements of the first application, determine the data type of business data that the first application needs to access from the second application; If the business data to be accessed is sensitive data, a data access request is generated based on the first open identifier, and a step of sending a data access request of the first application to the access control software toolkit is performed; The sensitive type of data includes at least one of the following: data with an importance greater than an importance threshold, and data with a privacy level higher than a privacy threshold.

12. The method according to claim 11, characterized in that The method further comprises: If the business data to be accessed is non-sensitive data, obtaining the required business data from the server based on the authorization code; The non-sensitive type includes at least one of the following: data whose importance is less than or equal to an importance threshold, and data whose privacy is lower than or equal to a privacy threshold.

13. The method according to claim 10, characterized in that The access control software toolkit and the authorization login software toolkit are two independent software toolkits; or, the access control software toolkit and the authorization login software toolkit are the same software toolkit; The first application supports access to one or more of the access control software toolkit and the authorization login software toolkit.

14. A data processing method, characterized in that: include: Receiving a data access request of a first application program sent by an access control software toolkit, wherein the data access request carries a first open identifier; The data access request is used to request access to the business data related to the first open identifier in the second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application; In response to the data access request, obtaining the requested business data based on the first open identifier; The business data is returned to the access control software toolkit so that the access control software toolkit desensitizes the business data to obtain response data, and the access control software toolkit returns the response data to the first application.

15. A data processing device, characterized in that: include: A receiving unit, configured to receive a data access request sent by a first application, wherein the data access request carries a first open identifier; The data access request is used to request access to the business data related to the first open identifier in the second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application; a processing unit, configured to obtain the requested business data from the server corresponding to the second application program through the access control software toolkit in response to the data access request; The processing unit is further used to perform desensitization processing on the business data, obtain response data, and return the response data to the first application.

16. A data processing device, characterized in that: include: A sending unit, configured to send a data access request of a first application to an access control software toolkit, wherein the data access request carries a first open identifier; The data access request is used to request access to the business data related to the first open identifier in the second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application; a receiving unit, configured to receive response data returned by the access control software toolkit, wherein the response data is obtained by the access control software toolkit in response to the data access request, obtaining the requested business data from the server corresponding to the second application, and performing desensitization processing on the business data; A processing unit is used to display the response data in the first application.

17. A data processing device, characterized in that: include: A receiving unit, configured to receive a data access request of a first application program sent by an access control software toolkit, wherein the data access request carries a first open identifier; The data access request is used to request access to the business data related to the first open identifier in the second application through the access control software toolkit; the access control software toolkit and the first application both perform authorized login through the second application; a processing unit, configured to obtain the requested business data based on the first open identifier in response to the data access request; A returning unit is used to return the business data to the access control software toolkit, so that the access control software toolkit desensitizes the business data to obtain response data, and the access control software toolkit returns the response data to the first application.

18. A computer device, characterized in that: include: a processor suitable for executing a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the data processing method according to any one of claims 1 to 8 is executed, or the data processing method according to any one of claims 9 to 13 is executed, or the data processing method according to claim 14 is executed.

19. A computer-readable storage medium, characterized in that: The computer storage medium stores a computer program. When the computer program is executed by a processor, it executes the data processing method according to any one of claims 1 to 8, or the data processing method according to any one of claims 9 to 13, or the data processing method according to claim 14.

20. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the data processing method according to any one of claims 1 to 8, or implements the data processing method according to any one of claims 9 to 13, or implements the data processing method according to claim 14.

Images