URL (Uniform Resource Locator) identity permission verification and vertical unauthorized defense system and method

Abstract

The invention discloses a URL identity permission verification and vertical unauthorized defense system and method, and relates to the technical field of network security, and the system comprises a management end and a controller Agent; the management end is deployed in a Web project form, provides creation user information, manages user permission configuration, registers an application and configures application role permission information; an administrator configures menu item access permissions for different roles through a role-based access control model, introduces a function item management configuration function, and allows setting of independent URL access permissions for buttons or links in a specific page; the controller Agent is deployed as a plug-in program package of the application program; when a user accesses a business application registered at a management end through a browser, the controller Agent requests a menu to which the URL belongs and the management end to filter and intercept the authority according to application role menu information of the current user, and related control over the authority is achieved. According to the invention, the access authority of the user can be accurately controlled and dynamically verified, and the security of the system is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a URL identity authority verification and vertical over-authorization defense system and method. Background Art

[0002] In the modern network environment, with the development of cloud computing, big data, Internet of Things (IoT) and artificial intelligence (AI) technologies, the challenges facing network security are increasing. Attackers use sophisticated methods and technologies to carry out malicious behaviors such as data theft, service disruption and identity impersonation. In network security protection, access control is a core component that determines who can access which resources in the network. An effective access control strategy can minimize unauthorized access and prevent data leakage and service abuse. Summary of the invention

[0003] In view of the needs and shortcomings of current technological development, the present invention provides a URL identity permission verification and vertical unauthorized protection system and method, which can effectively prevent unauthorized users from directly modifying URLs to access restricted areas through refined URL access permission control and dynamic permission verification.

[0004] In the first aspect, the present invention provides a URL identity authority verification and vertical unauthorized defense system, and the technical solutions adopted to solve the above technical problems are as follows:

[0005] A URL identity permission verification and vertical unauthorized defense system includes a management end and a controller Agent, wherein:

[0006] The management end is deployed in the form of a Web project, and specifically implements the following functions and operations: 1) The administrator creates user information and manages user permission configuration through the management end Web interface, and then the management end automatically generates the corresponding user account information in the Web project; 2) The administrator registers the business application that needs to be controlled through the management end Web interface and configures the role permission information of the business application. Then, the management end automatically generates the corresponding business application information and role permission policy information in the Web project; 3) The administrator adopts a role-based access control model on the management end, and configures access rights to specified menu items for different roles in combination with the created user information and permission configuration; at the same time, the administrator introduces the function of function item management configuration in the role-based access control model, which allows the administrator to set independent URL access rights for buttons or links in specific pages of the registered business application that need to control access rights, and define its ownership information and corresponding access rights for each URL;

[0007] The controller agent is deployed in the form of an application plug-in package, that is, the controller agent runs as an independent software package together with the target application, or exists as a plug-in / extension of the target application; when a user wants to access a business application that has been registered on the management side, an access request is sent to the business application through a browser. The controller agent filters and intercepts permissions based on the business application role menu information of the current accessing user, the menu to which the request URL belongs, and the management side to implement relevant permission control.

[0008] Optionally, the administrator creates user information and manages user permission configuration through the management end web interface. During this process, the administrator also defines more fine-grained access permission policies through the management end web interface, including: specifying access roles or permissions for certain resources, and setting access time periods for certain operations; then, the management end automatically generates corresponding user account information in the Web project and stores it in the database or persistent storage system for subsequent user authentication and authorization operations;

[0009] The administrator registers the business applications that need to be controlled and configures the role permission information of the business applications through the management web interface. During this process, the administrator also browses, searches and modifies the business application information and role permission policies through the management web interface. The management automatically records all operation logs related to the business application information registration and role permission configuration. Subsequently, the management automatically generates the corresponding business application information and role permission policy information in the Web project. This information is stored in the database or persistent storage system in the form of a data structure for use in subsequent identity authentication and authorization processes.

[0010] Optionally, when the management end is started, the management end first stores the menu, role and function item related data in the cache middleware;

[0011] When the controller agent is started for the first time, it first obtains the application code of the business application currently mounted with the controller agent and the role information of the currently logged-in user, and uses this as the query key value to match in the cache middleware to obtain the data information of all function items configured in the current business application, and converts the matched data information into MAP format and saves it in the server memory;

[0012] Based on the data update frequency configured by the controller Agent, when the data update time is reached, the server memory automatically pulls data from the cache middleware and updates the stored data.

[0013] Further optionally, the controller Agent involved is implemented based on the filter component, and the filter component is set to have the highest priority;

[0014] When a user wants to access a business application that has been registered on the management side, an access request is sent to the business application through a browser. The request contains the current user's identification information and the URL of the function or resource that the user wants to access. After the business application receives the access request, its mounted controller Agent first obtains the current user's identification information based on the filter component, and queries the menu information of the business application role to which the current user belongs to determine whether the current user has the right to access the requested function or resource. It then parses the URL requested by the current user and determines the menu item to which the URL belongs to ensure that the current user can only access the functions or resources under the specified menu item within his or her authority. Finally, the current user's request is released or intercepted.

[0015] Optionally, after the filter component involved releases the current user's request, when the user requests a URL to enter the business application, the controller Agent first determines whether the URL is a menu-level URL or a button-level function item URL:

[0016] a) If it is a menu-level URL, the configuration information in the business application role permissions is directly used to perform menu-level permission filtering. If there is permission configuration, the request is released; otherwise, the request is intercepted and the user is responded to as not having permission to access;

[0017] b) If it is determined to be a button-level function item URL, the URL is first searched and matched directly in the function item information in the server memory. b1) If the function item URL information is found, it is further determined which menu the function item belongs to and the source system of the function item URL. After obtaining the menu to which the function item belongs, it is determined whether the menu has access rights. If there is no access right, it is directly intercepted, otherwise the request is released. b2) If the URL is not found and matched in the server memory, it is determined that the function item URL is an illegal request, or the URL is not maintained in the function item management on the management side. At this time, the request is directly intercepted.

[0018] In the second aspect, the present invention provides a URL identity authority verification and vertical unauthorized defense method, and the technical solution adopted to solve the above technical problems is as follows:

[0019] A URL identity authority verification and vertical overreach defense method includes the following implementation steps:

[0020] S1. Deploy the management end in the form of a Web project and deploy the controller Agent in the form of an application plug-in package;

[0021] S2. The administrator performs the following permission configuration and function implementation on the management side: Create user information and manage user permission configuration through the management side Web interface, and then the management side automatically generates the corresponding user account information in the Web project; Register the business application that needs to be controlled through the management side Web interface and configure the role permission information of the business application, and then the management side automatically generates the corresponding business application information and role permission policy information in the Web project; Use the role-based access control model on the management side, and configure the access rights to the specified menu items for different roles in combination with the created user information and permission configuration; At the same time, introduce the function item management configuration function in the role-based access control model, which allows the administrator to set independent URL access rights for buttons or links in specific pages of the registered business application that need to control access rights, and define its ownership information and corresponding access rights for each URL;

[0022] S3. Based on the permission configuration and function implementation performed by the management end, when a user wants to access a business application that has been registered on the management end, an access request is sent to the business application through a browser. The controller Agent filters and intercepts permissions based on the business application role menu information of the current accessing user, the menu to which the request URL belongs, and the management end to achieve relevant control of permissions.

[0023] Optionally, execute step S2 to create user information and manage user permission configuration through the management end Web interface. In this process, a more fine-grained access permission policy is also defined through the management end Web interface, including: specifying access roles or permissions for certain resources, and setting access time periods for certain operations; then, the management end automatically generates corresponding user account information in the Web project and stores it in a database or a persistent storage system for subsequent user authentication and authorization operations;

[0024] Register the business applications that need to be controlled and configure the role permission information of the business applications through the management side web interface. In this process, browse, search and modify the business application information and role permission policies through the management side web interface. The management side automatically records all operation logs related to the business application information registration and role permission configuration. Subsequently, the management side automatically generates the corresponding business application information and role permission policy information in the Web project. This information is stored in the database or persistent storage system in the form of a data structure for use in subsequent identity authentication and authorization processes.

[0025] Optionally, when the management end is started, the management end first stores the menu, role and function item related data in the cache middleware;

[0026] When the controller agent is started for the first time, it first obtains the application code of the business application currently mounted with the controller agent and the role information of the currently logged-in user, and uses this as the query key value to match in the cache middleware to obtain the data information of all function items configured in the current business application, and converts the matched data information into MAP format and saves it in the server memory;

[0027] Based on the data update frequency configured by the controller Agent, when the data update time is reached, the server memory automatically pulls data from the cache middleware and updates the stored data.

[0028] Further optionally, the controller Agent deployed in step S1 is implemented based on the filter component, and the filter component is set to have the highest priority;

[0029] Execute step S3. When the user wants to access a business application that has been registered on the management side, an access request is sent to the business application through the browser. The request contains the identification information of the current user and the URL of the function or resource that the user wants to access. After the business application receives the access request, its mounted controller Agent first obtains the identification information of the current user based on the filter component, and queries the menu information of the business application role to which the current user belongs to determine whether the current user has the right to access the function or resource requested by the user. Then, the URL requested by the current user is parsed to determine the menu item to which the URL belongs to ensure that the current user can only access the functions or resources under the specified menu item within the scope of his authority. Finally, the request of the current user is released or intercepted.

[0030] Optionally, after the filter component involved releases the current user's request, when the user requests a URL to enter the business application, the controller Agent first determines whether the URL is a menu-level URL or a button-level function item URL:

[0031] a) If it is a menu-level URL, the configuration information in the business application role permissions is directly used to perform menu-level permission filtering. If there is permission configuration, the request is released; otherwise, the request is intercepted and the user is responded to as not having permission to access;

[0032] b) If it is determined to be a button-level function item URL, the URL is first searched and matched directly in the function item information in the server memory. b1) If the function item URL information is found, it is further determined which menu the function item belongs to and the source system of the function item URL. After obtaining the menu to which the function item belongs, it is determined whether the menu has access rights. If there is no access right, it is directly intercepted, otherwise the request is released. b2) If the URL is not found and matched in the server memory, it is determined that the function item URL is an illegal request, or the URL is not maintained in the function item management on the management side. At this time, the request is directly intercepted.

[0033] The URL identity authority verification and vertical overreaching defense system and method of the present invention have the following beneficial effects compared with the prior art:

[0034] 1. The present invention can accurately control the user's access rights and dynamically verify the rights according to the URL of the system that the user accesses, thereby improving the security of the system and effectively preventing the security threat of unauthorized users accessing restricted areas by directly modifying the URL;

[0035] 2. The present invention solves the vertical unauthorized access problem existing in the role-based permission control scheme by adding the management of the request URL based on the function item; during deployment, it is deployed in the form of an application plug-in package, without intrusion into the original application system, and the original application system does not need to be modified, thereby solving the difficulty of deployment and integration; when using the management end to configure the role data, application data, menu data, and function item data, a Web page visual guided configuration filling method is provided, thereby reducing the difficulty of user configuration and use; the concept of data cache is introduced, and the user's permission-related data is stored in the cache middleware, which greatly improves the speed of application acquisition and processing of data and improves the response time of the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Attached Figure 1 It is a schematic diagram of the implementation process of the present invention. DETAILED DESCRIPTION

[0037] In order to make the technical solution, the technical problem solved and the technical effect of the present invention more clearly understood, the technical solution of the present invention is clearly and completely described below in conjunction with specific embodiments.

[0038] Embodiment 1:

[0039] Reference Figure 1 ,This embodiment proposes a URL identity authority verification and vertical ,unauthorized defense system, including two parts: a management end and a controller Agent.

[0040] (I) The management end is deployed in the form of a Web project, and specifically implements the following functions and operations:

[0041] 1) The administrator creates user information and manages user permission configuration through the management end web interface. The management end then automatically generates corresponding user account information in the web project and stores it in the database or persistent storage system for subsequent user authentication and authorization operations;

[0042] Administrators can also define more fine-grained access permission policies through the management web interface, including: specifying access roles or permissions for certain resources, and setting access time periods for certain operations; then, the management automatically generates the corresponding access permission policies in the web project, and this information is stored in the form of a data structure in a database or persistent storage system for subsequent user authentication and authorization operations.

[0043] 2) The administrator registers the business application to be controlled and configures the role permission information of the business application through the management end web interface. Then, the management end automatically generates the corresponding business application information and role permission policy information in the web project. This information is stored in the database or persistent storage system in the form of a data structure for subsequent identity authentication and authorization processes.

[0044] Administrators can also browse, search, and modify business application information and role permission policies through the management web interface. The management automatically records all operation logs related to business application information registration and role permission configuration, and stores them in the database or persistent storage system.

[0045] 3) The administrator adopts a role-based access control model on the management side, and configures access rights to specified menu items for different roles in combination with the created user information and permission configuration; at the same time, the administrator introduces the function of function item management configuration in the role-based access control model, which allows the administrator to set independent URL access rights for buttons or links in specific pages of the registered business application that need to control access rights, and define the ownership information and corresponding access rights for each URL.

[0046] URL is the abbreviation of Uniform Resource Locator. It is a complete string containing address information, used to identify and locate resources on the Internet. It provides a specific path and method to access resources such as web pages and files.

[0047] (ii) The controller agent is deployed in the form of an application plug-in package, that is, the controller agent is an independent software package that runs together with the target application, or exists as a plug-in / extension of the target application. The target application refers to the business application that needs to integrate the controller agent to implement permission control and filtering functions.

[0048] In this step, the controller Agent involved is implemented based on the filter component, and the filter component is set to have the highest priority.

[0049] Based on the system of this embodiment, when the management end is started, the management end first stores the menu, role and function item related data in the cache middleware. When the controller agent is started for the first time, the application code of the business application currently mounted with the controller agent and the role information of the currently logged-in user are first obtained, and this is used as the query KEY value to match in the cache middleware to obtain all the function item data information configured in the current business application, and the matched data information is converted into MAP format and saved in the server memory. Based on the data update frequency configured by the controller agent, when the data update time is reached, the server memory automatically pulls data from the cache middleware and updates the stored data.

[0050] Specifically, when a user wants to access a business application that has been registered on the management side, he sends an access request to the business application through a browser. The request contains the current user's identification information and the URL of the function or resource that the user wants to access. After the business application receives the access request, its mounted controller Agent first obtains the current user's identification information based on the filter component, and queries the menu information of the business application role to which the current user belongs to determine whether the current user has the right to access the requested function or resource. It then parses the URL requested by the current user and determines the menu item to which the URL belongs to ensure that the current user can only access the functions or resources under the specified menu item within his authority. Finally, the current user's request is released or intercepted.

[0051] After the filter component releases the current user's request, when the user requests a URL to enter the business application, the controller Agent first determines whether the URL is a menu-level URL or a button-level function item URL:

[0052] a) If it is a menu-level URL, the configuration information in the business application role permissions is directly used to perform menu-level permission filtering. If there is permission configuration, the request is released; otherwise, the request is intercepted and the user is responded to as not having permission to access;

[0053] b) If it is determined to be a button-level function item URL, the URL is first searched and matched directly in the function item information in the server memory. b1) If the function item URL information is found, it is further determined which menu the function item belongs to and the source system of the function item URL. After obtaining the menu to which the function item belongs, it is determined whether the menu has access rights. If there is no access right, it is directly intercepted, otherwise the request is released. b2) If the URL is not found and matched in the server memory, it is determined that the function item URL is an illegal request, or the URL is not maintained in the function item management on the management side. At this time, the request is directly intercepted.

[0054] Embodiment 2:

[0055] Reference Figure 1 This embodiment proposes a URL identity authority verification and vertical unauthorized defense method, which includes the following implementation steps:

[0056] S1. Deploy the management terminal in the form of a Web project;

[0057] The controller agent is deployed in the form of an application plug-in package, that is, the controller agent is a separate software package that runs together with the target application, or exists as a plug-in / extension of the target application. The target application refers to the business application that needs to integrate the controller agent to implement permission control and filtering functions.

[0058] In this step, the controller Agent involved is implemented based on the filter component, and the filter component is set to have the highest priority.

[0059] S2. The administrator performs the following permission configuration and function implementation on the management side: create user information and manage user permission configuration through the management side web interface, and then the management side automatically generates the corresponding user account information in the Web project; register the business application that needs to be controlled and configure the role permission information of the business application through the management side web interface, and then the management side automatically generates the corresponding business application information and role permission policy information in the Web project; adopt a role-based access control model on the management side, and configure access rights to specified menu items for different roles in combination with the created user information and permission configuration; at the same time, introduce the function item management configuration function in the role-based access control model, which allows the administrator to set independent URL access rights for buttons or links on specific pages of the registered business application that need to control access rights, and define the ownership information and corresponding access rights for each URL.

[0060] Execute step S2, the administrator creates user information and manages user permission configuration through the management end web interface. In this process, the administrator also defines more fine-grained access permission policies through the management end web interface, including: specifying access roles or permissions for certain resources, and setting access time periods for certain operations; then, the management end automatically generates corresponding user account information in the web project and stores it in a database or persistent storage system for subsequent user authentication and authorization operations;

[0061] The administrator registers the business applications that need to be controlled and configures the role permission information of the business applications through the management web interface. During this process, the administrator also browses, searches and modifies the business application information and role permission policies through the management web interface. The management automatically records all operation logs related to the business application information registration and role permission configuration. Subsequently, the management automatically generates the corresponding business application information and role permission policy information in the Web project. This information is stored in the database or persistent storage system in the form of a data structure for use in subsequent identity authentication and authorization processes.

[0062] It should be added that when the management end is started, the management end first stores the menu, role and function item related data in the cache middleware; when the controller agent is started for the first time, it first obtains the application code of the business application currently mounted with the controller agent and the role information of the currently logged-in user, and uses this as the query KEY value to match in the cache middleware to obtain all the function item data information configured in the current business application, and converts the matched data information into MAP format and saves it in the server memory; based on the data update frequency configured by the controller agent, when the data update time is reached, the server memory automatically pulls data from the cache middleware and updates the stored data.

[0063] S3. Based on the permission configuration and function implementation performed by the management end, when a user wants to access a business application that has been registered on the management end, an access request is sent to the business application through a browser. The controller Agent filters and intercepts permissions based on the business application role menu information of the current accessing user, the menu to which the request URL belongs, and the management end to achieve relevant control of permissions.

[0064] Specifically, based on the permission configuration and function implementation performed by the management end, when a user wants to access a business application that has been registered on the management end, an access request is sent to the business application through a browser. The request contains the identification information of the current user and the URL of the function or resource that the user wants to access. After the business application receives the access request, its mounted controller Agent first obtains the identification information of the current user based on the filter component, and queries the menu information of the business application role to which the current user belongs to determine whether the current user has the right to access the function or resource requested by the user. It then parses the URL requested by the current user and determines the menu item to which the URL belongs, to ensure that the current user can only access the functions or resources under the specified menu item within the scope of his authority, and finally releases or intercepts the current user's request.

[0065] Furthermore, after the filter component releases the current user's request, when the user requests a URL to enter the business application, the controller Agent first determines whether the URL is a menu-level URL or a button-level function item URL:

[0066] a) If it is a menu-level URL, the configuration information in the business application role permissions is directly used to perform menu-level permission filtering. If there is permission configuration, the request is released; otherwise, the request is intercepted and the user is responded to as not having permission to access;

[0067] b) If it is determined to be a button-level function item URL, the URL is first searched and matched directly in the function item information in the server memory. b1) If the function item URL information is found and matched, it is further determined which menu the function item belongs to and the source system of the function item URL. After obtaining the menu to which the function item belongs, it is determined whether the menu has access rights. If there is no access right, it is directly intercepted, otherwise the request is released. b2) If the URL is not found and matched in the server memory, it is determined that the function item URL is an illegal request, or the URL is not maintained in the function item management on the management side. At this time, the request is directly intercepted.

[0068] In summary, the URL identity permission verification and vertical unauthorized access defense system and method of the present invention can accurately control the user's access rights according to the URL of the system accessed by the user, as well as dynamic permission verification, thereby improving the security of the system and effectively preventing unauthorized users from directly modifying the URL to access restricted areas. Security threats.

[0069] The above specific examples are used to explain the principles and implementation methods of the present invention in detail. These examples are only used to help understand the core technical content of the present invention. Based on the above specific embodiments of the present invention, any improvements and modifications made by technicians in this technical field without departing from the principles of the present invention should fall within the scope of patent protection of the present invention.

Claims

1. A URL identity authority verification and vertical unauthorized defense system, characterized in that: The system includes two parts: management terminal and controller Agent, where: The management end is deployed in the form of a Web project, and specifically implements the following functions and operations: 1) The administrator creates user information and manages user permission configuration through the management end Web interface, and then the management end automatically generates the corresponding user account information in the Web project; 2) The administrator registers the business application that needs to be controlled through the management end Web interface and configures the role permission information of the business application. Then, the management end automatically generates the corresponding business application information and role permission policy information in the Web project; 3) The administrator adopts a role-based access control model on the management end, and configures access rights to specified menu items for different roles in combination with the created user information and permission configuration; at the same time, the administrator introduces the function of function item management configuration in the role-based access control model, which allows the administrator to set independent URL access rights for buttons or links in specific pages of the registered business application that need to control access rights, and define its ownership information and corresponding access rights for each URL; The controller agent is deployed in the form of an application plug-in package; when a user wants to access a business application that has been registered on the management side, he sends an access request to the business application through the browser. The controller agent filters and intercepts permissions based on the business application role menu information of the current accessing user, the menu to which the request URL belongs, and the management side to achieve relevant control of permissions.

2. According to claim 1, a URL identity authority verification and vertical unauthorized defense system is characterized in that: Administrators create user information and manage user permission configuration through the management end web interface. In this process, administrators also define more fine-grained access permission policies through the management end web interface, including: specifying access roles or permissions for certain resources, and setting access time periods for certain operations. Subsequently, the management end automatically generates corresponding user account information in the web project and stores it in the database or persistent storage system for subsequent user authentication and authorization operations. The administrator registers the business applications that need to be controlled and configures the role permission information of the business applications through the management web interface. During this process, the administrator also browses, searches and modifies the business application information and role permission policies through the management web interface. The management automatically records all operation logs related to the business application information registration and role permission configuration. Subsequently, the management automatically generates the corresponding business application information and role permission policy information in the Web project. This information is stored in the database or persistent storage system in the form of a data structure for use in subsequent identity authentication and authorization processes.

3. According to claim 1, a URL identity authority verification and vertical unauthorized defense system is characterized in that: When the management end is started, the management end first stores the menu, role and function item related data in the cache middleware; When the controller agent is started for the first time, it first obtains the application code of the business application currently mounted with the controller agent and the role information of the currently logged-in user, and uses this as the query key value to match in the cache middleware to obtain the data information of all function items configured in the current business application, and converts the matched data information into MAP format and saves it in the server memory; Based on the data update frequency configured by the controller Agent, when the data update time is reached, the server memory automatically pulls data from the cache middleware and updates the stored data.

4. A URL identity authority verification and vertical overreaching defense system according to claim 3, characterized in that: The controller agent is implemented based on the filter component, and the filter component is set to have the highest priority; When a user wants to access a business application that has been registered on the management side, an access request is sent to the business application through a browser. The request contains the current user's identification information and the URL of the function or resource that the user wants to access. After the business application receives the access request, its mounted controller Agent first obtains the current user's identification information based on the filter component, and queries the menu information of the business application role to which the current user belongs to determine whether the current user has the right to access the requested function or resource. It then parses the URL requested by the current user and determines the menu item to which the URL belongs to ensure that the current user can only access the functions or resources under the specified menu item within his or her authority. Finally, the current user's request is released or intercepted.

5. A URL identity authority verification and vertical overreaching defense system according to claim 4, characterized in that: After the filter component releases the current user's request, when the user requests a URL to enter the business application, the controller Agent first determines whether the URL is a menu-level URL or a button-level function item URL: a) If it is a menu-level URL, the configuration information in the business application role permissions is directly used to perform menu-level permission filtering. If there is permission configuration, the request is released; otherwise, the request is intercepted and the user is responded to as not having permission to access; b) If it is determined to be a button-level function item URL, the URL is first searched and matched directly in the function item information in the server memory. b1) If the function item URL information is found, it is further determined which menu the function item belongs to and the source system of the function item URL. After obtaining the menu to which the function item belongs, it is determined whether the menu has access rights. If there is no access right, it is directly intercepted, otherwise the request is released. b2) If the URL is not found and matched in the server memory, it is determined that the function item URL is an illegal request, or the URL is not maintained in the function item management on the management side. At this time, the request is directly intercepted.

6. A URL identity authority verification and vertical overreach defense method, characterized in that: It includes the following implementation steps: S1. Deploy the management end in the form of a Web project and deploy the controller Agent in the form of an application plug-in package; S2. The administrator performs the following permission configuration and function implementation on the management end: create user information and manage user permission configuration through the management end Web interface, and then the management end automatically generates the corresponding user account information in the Web project; register the business application to be controlled through the management end Web interface and configure the role permission information of the business application, and then the management end automatically generates the corresponding business application information and role permission policy information in the Web project; A role-based access control model is adopted on the management side, and the access rights to the specified menu items are configured for different roles in combination with the created user information and permission configuration. At the same time, the function item management configuration function is introduced in the role-based access control model. This function allows the administrator to set independent URL access rights for the buttons or links in the specific pages of the registered business application that need to control access rights, and define the ownership information and corresponding access rights for each URL. S3. Based on the permission configuration and function implementation performed by the management end, when a user wants to access a business application that has been registered on the management end, an access request is sent to the business application through a browser. The controller Agent filters and intercepts permissions based on the business application role menu information of the current accessing user, the menu to which the request URL belongs, and the management end to achieve relevant control of permissions.

7. A URL identity authority verification and vertical overreaching defense method according to claim 6, characterized in that: Execute step S2, create user information and manage user permission configuration through the management end web interface. In this process, more fine-grained access permission policies are also defined through the management end web interface, including: specifying access roles or permissions for certain resources, and setting access time periods for certain operations; then, the management end automatically generates corresponding user account information in the web project and stores it in a database or persistent storage system for subsequent user authentication and authorization operations; Register the business applications that need to be controlled and configure the role permission information of the business applications through the management side web interface. In this process, browse, search and modify the business application information and role permission policies through the management side web interface. The management side automatically records all operation logs related to the business application information registration and role permission configuration. Subsequently, the management side automatically generates the corresponding business application information and role permission policy information in the Web project. This information is stored in the database or persistent storage system in the form of a data structure for use in subsequent identity authentication and authorization processes.

8. A URL identity authority verification and vertical overreaching defense method according to claim 6, characterized in that: When the management end is started, the management end first stores the menu, role and function item related data in the cache middleware; When the controller agent is started for the first time, it first obtains the application code of the business application currently mounted with the controller agent and the role information of the currently logged-in user, and uses this as the query key value to match in the cache middleware to obtain the data information of all function items configured in the current business application, and converts the matched data information into MAP format and saves it in the server memory; Based on the data update frequency configured by the controller Agent, when the data update time is reached, the server memory automatically pulls data from the cache middleware and updates the stored data.

9. A URL identity authority verification and vertical overreaching defense method according to claim 8, characterized in that: The controller Agent deployed in step S1 is implemented based on the filter component, and the filter component is set to have the highest priority; Execute step S3. When the user wants to access a business application that has been registered on the management side, an access request is sent to the business application through the browser. The request contains the identification information of the current user and the URL of the function or resource that the user wants to access. After the business application receives the access request, its mounted controller Agent first obtains the identification information of the current user based on the filter component, and queries the menu information of the business application role to which the current user belongs to determine whether the current user has the right to access the function or resource requested by the user. Then, the URL requested by the current user is parsed to determine the menu item to which the URL belongs to ensure that the current user can only access the functions or resources under the specified menu item within the scope of his authority. Finally, the request of the current user is released or intercepted.

10. A URL identity authority verification and vertical overreaching defense method according to claim 9, characterized in that: After the filter component releases the current user's request, when the user requests a URL to enter the business application, the controller Agent first determines whether the URL is a menu-level URL or a button-level function item URL: a) If it is a menu-level URL, the configuration information in the business application role permissions is directly used to perform menu-level permission filtering. If there is permission configuration, the request is released; otherwise, the request is intercepted and the user is responded to as not having permission to access; b) If it is determined to be a button-level function item URL, the URL is first searched and matched directly in the function item information in the server memory. b1) If the function item URL information is found, it is further determined which menu the function item belongs to and the source system of the function item URL. After obtaining the menu to which the function item belongs, it is determined whether the menu has access rights. If there is no access right, it is directly intercepted, otherwise the request is released. b2) If the URL is not found and matched in the server memory, it is determined that the function item URL is an illegal request, or the URL is not maintained in the function item management on the management side. At this time, the request is directly intercepted.

Images