Business system fine-grained authorization method based on unified model

Abstract

The invention relates to a business system fine-grained authorization method based on a unified model, and the method comprises the steps: S1, obtaining the system type and fine-grained authorization parameters of a business system, and constructing an authorization platform containing a fine-grained authorization unified model interface; s2, establishing interaction between the service system and the authorization platform; s3, after an administrator of the service system logs in the service system, checking a fine-grained permission list related to the service system by utilizing the fine-grained authorization unified model interface and performing fine-grained authorization; and S4, uploading the configured fine-grained authority to the authorization platform for centralized management. According to the invention, the authorization workload of the unified authorization platform is greatly reduced, the fine-grained authority is configured by each service system, the accuracy of the fine-grained authorization of the service system is improved, and the method has a great application value in a scene that the unified authorization platform manages a large number of fine-grained access authorities of the service system.

Description

Technical Field

[0001] The present invention relates to the technical field of fine-grained authorization of business systems, and in particular to a fine-grained authorization method for business systems based on a unified model. Background Art

[0002] In enterprise-level office scenarios, administrators usually manage employee access authorization in the business systems under their jurisdiction to prevent data leakage caused by unauthorized access. With the continuous development of my country's informatization construction, the security risks formed by information sharing are increasing. The model of coarse-grained authorization independently through business systems is obviously unable to meet security requirements, and authorization management has gradually become unified and refined. A security personnel will replace several administrators of each business system to perform the most fine-grained unified authorization for employees, so that the function menus, services, and data presented to different employees in the same business system are different, so as to achieve the purpose of avoiding information out of control to the greatest extent. However, when there are dozens or hundreds of business systems in operation, it is impossible for security personnel to understand the functional details of each business system. There are problems such as the accuracy of the allocated fine-grained permissions and the significant increase in the workload of permission management, which affect the normal development of office business.

[0003] Therefore, it is necessary to design a mechanism and method for fine-grained authorization of business systems in combination with the existing trust infrastructure and business systems in office scenarios. Summary of the invention

[0004] In order to solve the technical problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a fine-grained authorization method for business systems based on a unified model. Based on the fine-grained authorization unified model provided by the authorization platform, each business system calls and implements its own fine-grained permission configuration, and finally aggregates it to the authorization platform for storage. It has the characteristics of simple model integration, high accuracy of fine-grained authorization, and centralized management of fine-grained permission decentralized configuration.

[0005] To achieve the above-mentioned object of the invention, the present invention provides a fine-grained authorization method for a business system based on a unified model, comprising the following steps:

[0006] Step S1: Obtain the system type and fine-grained authorization parameters of the business system, and build an authorization platform including a fine-grained authorization unified model interface;

[0007] Step S2: establishing interaction between the business system and the authorization platform;

[0008] Step S3: After logging into the business system, the administrator of the business system uses the fine-grained authorization unified model interface to view the fine-grained permission list related to the business system and perform fine-grained authorization;

[0009] Step S4: Upload the configured fine-grained permissions to the authorization platform for centralized management.

[0010] According to a technical solution of the present invention, the step S1 specifically includes:

[0011] Step S11: construct a main list interface of fine-grained permission information of the fine-grained authorization unified model interface, wherein the main list interface is used to display currently authorized fine-grained permissions;

[0012] Step S12: construct an object management window, wherein the object management window is at least used to complete object registration, object deletion, object editing, and to sort out the characteristics of each business system and summarize the object type;

[0013] Step S13: Design a fine-grained authorization window for subject-object association according to scenario requirements, wherein the fine-grained authorization window is used for at least identity authorization, role authorization, and attribute authorization.

[0014] According to a technical solution of the present invention, in step S2, Iframe cross-domain page communication technology is used to integrate the business system with the fine-grained authorization unified model interface through page sharing, which specifically includes:

[0015] Taking the front-end page of the business system as the parent page, an event triggering mechanism for opening the fine-grained authorization unified model interface is added;

[0016] Adding embedding code to the parent page, when the fine-grained authorization unified model interface opening event is triggered, obtaining the fine-grained authorization unified model interface from the authorization platform through Iframe reference;

[0017] According to a technical solution of the present invention, the embedded code presets the interaction parameters, specifically including:

[0018] The IP address and port number of the authorization platform;

[0019] The unique identity of the administrator currently logged in to the business system;

[0020] The IP address, name, and internal number of the business system;

[0021] The parent page adds code for closing the fine-grained authorization unified model interface.

[0022] According to a technical solution of the present invention, in step S3, the interaction process between the business system and the authorization platform includes:

[0023] The front end of the business system obtains current environment information from the back end;

[0024] The front end of the business system fills the information of the authorization platform and the environment information of the business system into the interaction parameters corresponding to the embedded code to complete the data encapsulation of the fine-grained authorization unified model interface request package;

[0025] The front end of the business system requests the fine-grained authorization unified model interface from the authorization platform;

[0026] After the authorization platform listens to the request message, it performs parameter parsing and generates the fine-grained authorization unified model interface;

[0027] The authorization platform returns the fine-grained authorization unified model interface to the front end of the business system;

[0028] The business system presents a unified model interface for fine-grained authorization, and performs exclusive information configuration operations such as object management and fine-grained authorization;

[0029] The fine-grained authorization unified model interface sends the latest exclusive information to the authorization platform;

[0030] The authorization platform saves the exclusive information for unified management, or is available for acquisition when the corresponding business system requests a fine-grained authorization unified model interface next time.

[0031] According to a technical solution of the present invention, after the authorization platform monitors the request message, it performs parameter parsing and generates the fine-grained authorization unified model interface, which specifically includes:

[0032] Resolve the identity of the administrator currently logged into the business system;

[0033] The identity and authority of the administrator are verified through the identity identifier, including at least whether the identity identifier is valid in the register and whether the administrator has the authority to request the fine-grained authorization unified model interface. If the verification is passed, the next step is entered; otherwise, the fine-grained authorization unified model interface is set to be empty.

[0034] Analyze the basic information of the business system;

[0035] Determine whether the business system has been registered as a coarse-grained object in the authorization platform based on the basic information. If it has been registered, proceed to the next step. Otherwise, set the fine-grained authorization unified model interface to be empty.

[0036] Obtain the exclusive information of the last effective configuration of the business system, including at least the object and fine-grained permissions;

[0037] According to the acquisition of exclusive information, confirm whether it is the first time to configure exclusive information for the business system. If it is the first configuration, initialize the fine-grained authorization unified model interface. Otherwise, after initializing the fine-grained authorization unified model interface, add the acquired exclusive information to the fine-grained authorization unified model interface to complete the generation of the fine-grained authorization unified model interface.

[0038] According to a technical solution of the present invention, the environmental information at least includes:

[0039] The unique identity of the currently logged-in administrator, the IP address, name, and internal number of the business system.

[0040] According to a technical solution of the present invention, the main list interface includes at least: subject identification, subject name, object identification, object name, object URL description;

[0041] The subject identifier represents the identity ID of the network entity that initiates the network resource access request;

[0042] The subject name represents the name of the network entity that initiates the network resource access request;

[0043] The object identifier represents the identity ID of the network resource accessed by the subject;

[0044] The object name represents the name of the network resource accessed by the subject;

[0045] The object URL represents the uniform resource locator of the network resource accessed by the subject, that is, the network path.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] The present invention proposes a fine-grained authorization method for business systems based on a unified model. In addition to performing fine-grained access authorization on business systems through an authorization platform that includes a fine-grained authorization unified model interface, the invention increases the ability to configure the fine-grained permissions of the business system itself. On the one hand, it greatly reduces the authorization workload of the unified authorization platform. On the other hand, it leaves the fine-grained permissions to each business system for configuration, thereby improving the accuracy of the fine-grained authorization of the business system. The invention has great application value in scenarios where a unified authorization platform manages fine-grained access permissions for a large number of business systems.

[0048] The present invention meets the fine-grained authorization management requirements of various business systems; while the authorization platform aggregates all authority information, the fine-grained authority information presented by different business systems is different, and the fine-grained authorization is limited within the influence range of each business system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0050] Figure 1 A flowchart schematically showing a fine-grained authorization method for a business system based on a unified model provided in an implementation case of the present invention;

[0051] Figure 2 A flowchart schematically showing the interaction between the business system and the authorization platform in an implementation case according to the present invention;

[0052] Figure 3 The flowchart schematically shows the generation of a fine-grained authorization unified model interface by an authorization platform in an implementation case of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] like Figures 1 to 3 As shown, a fine-grained authorization method for a business system based on a unified model of the present invention comprises the following steps:

[0055] Step S1: Obtain the system type and fine-grained authorization parameters of the business system, and build an authorization platform including a fine-grained authorization unified model interface;

[0056] Step S2: establishing interaction between the business system and the authorization platform;

[0057] Step S3: After logging into the business system, the administrator of the business system uses the fine-grained authorization unified model interface to view the fine-grained permission list related to the business system and perform fine-grained authorization;

[0058] Step S4: Upload the configured fine-grained permissions to the authorization platform for centralized management.

[0059] Taking the enterprise-level application scenario as an example, assume that the enterprise office network has an authorization platform (administrator is AP_M) that can authorize access to all business systems. The office network includes business systems such as the human resources system (administrator is RS_M) and the information service system administrator is MS_M. In the process of fine-grained authorization of business systems based on a unified model, the specific implementation of each stage is as follows:

[0060] 1. Implementation of unified model interface for fine-grained authorization

[0061] The authorization platform needs to first design and implement a unified model interface for fine-grained authorization, which can perform operations such as object resource management and fine-grained authorization. The implementation steps of this process are as follows:

[0062] (1) Developers design and implement the main interface of the fine-grained authorization unified model interface based on the existing interface style of the authorization platform, and display fine-grained permission information in the form of lists and detail windows, including user ID, name / account, business resource type, resource ID, resource name, resource URL description, etc. At the same time, event buttons such as resource management, fine-grained authorization, and permission query are laid out.

[0063] (2) Construct an object management window, namely, a resource management window. The resource management window provides functions such as resource registration, deletion, and editing. The resource registration interface needs to sort out all business system types and provide registration forms according to the characteristics of different types. For example, the fine-grained feature of the human resources system RS is the function menu resource, and the form attributes presented include resource name, access IP address, menu network path, etc. The fine-grained feature of the information service system MS is the application service, and the form attributes presented include resource name, service IP address, service port, service network path, etc.

[0064] (3) Assuming that the enterprise is positioned in a static permission access control mode, in the fine-grained authorization window, the association and binding functions between users and roles, and roles and object resources are planned. The user subject identities in the business system and the authorization platform should have the same identity information source or synchronization mechanism to ensure the consistency of the user subject identity information of the two.

[0065] (4) The developer sets parameters through code to enable the authorization platform to open the Iframe page sharing, completing the preparation work for providing a fine-grained authorization unified model interface to the business system.

[0066] 2. Business System Unified Model Interface Integration

[0067] The human resources system RS and the information service system MS and other business systems integrate the unified model interface of fine-grained authorization, so that administrators such as RS-M and MS-M can open the unified model interface of fine-grained authorization to perform fine-grained authorization operations after logging into their respective business systems. Taking the unified model interface of fine-grained authorization integrated with the human resources system RS as an example, the implementation steps of the process are as follows:

[0068] (1) The developer sets buttons and other event triggering methods on the front-end page of the human resources system RS to cross-domain call the Iframe of the fine-grained authorization unified model interface. The reference code is as follows.

[0069]

[0070]

[0071] (2) The developer adds an event to the front-end page of the human resources system RS and closes the Iframe of the fine-grained authorization unified model interface. The reference code is as follows.

[0072]

[0073] The Iframe cross-domain page communication technology is adopted to integrate the business system with the fine-grained authorization unified model interface through page sharing, and the interaction between the business system and the authorization platform is realized based on this technology.

[0074] 3. Interaction between business system and authorization platform

[0075] After the human resources system RS and information service system MS and other business systems integrate the fine-grained authorization unified model interface, there is an interaction process with the authorization platform during use. Take the human resources system using the fine-grained authorization unified model interface as an example. Figure 2 and Figure 3 As shown, the process implementation steps are as follows:

[0076] (1) The front end of the human resources system obtains relevant information of the business system, completes the openFrame() parameter setting, and requests the unified model interface of fine-grained authorization from the authorization platform.

[0077] (2) The authorization platform listens to the request message and performs parameter parsing.

[0078] (3) The authorization platform obtains RS_M's identity, verifies RS_M's identity through the user principal information or other identity management systems stored on the authorization platform, and determines whether RS_M has the authority to access the fine-grained authorization unified model interface. If the identity verification or authority determination fails, the fine-grained authorization unified model interface is set to empty and returned to the front end of the human resources system RS.

[0079] (4) The authorization platform obtains the basic information of the human resources system RS and determines whether the human resources system RS is registered through the business system object resource information saved by the authorization platform. If not registered, the fine-grained authorization unified model interface is set to empty and returned to the front end of the human resources system RS.

[0080] (5) The authorization platform queries the last configured effective object, fine-grained permissions and other proprietary information of the human resources system RS locally, generates a fine-grained authorization unified model interface and returns it to the front end of the human resources system RS.

[0081] (6) The front end of the human resources system RS presents a fine-grained authorization unified model interface. After RS_M performs the exclusive information configuration operation, the fine-grained authorization unified model interface sends the latest exclusive information to the authorization platform.

[0082] (7) Authorize the platform to store proprietary information.

[0083] After logging into the business system, the administrator of the business system uses the fine-grained authorization unified model interface to view the fine-grained permission list related to the business system and perform fine-grained authorization.

[0084] 4. Implementation of fine-grained authorization for business systems based on a unified model

[0085] With the human resources system RS and the information service system MS having completed ModelGUI integration, the implementation steps for fine-grained authorization of business systems based on a unified model are as follows:

[0086] (1) AP_M logs in to the authorization platform, registers the human resources system RS and the information service system MS as overall business system resources, and coarse-grainedly authorizes RS_M and MS_M to fully access the human resources system RS and the information service system MS respectively, while authorizing RS_M and MS_M to obtain the fine-grained authorization unified model interface.

[0087] (2) RS_M logs in to the human resources system RS, opens the fine-grained authorization unified model interface, adds functional menu resources such as job information, leave application, attendance details, and business approval to the human resources system RS, authorizes user1 as a common user role of the human resources system RS, and has access rights to the job information and leave application function menus, authorizes user2 as an advanced user role of the human resources system RS, and has access rights to the attendance details and business approval function menus, and RS_M saves and closes the fine-grained authorization unified model interface.

[0088] (3) MS_M logs in to the information service system MS, opens the fine-grained authorization unified model interface, adds application service resources such as the email service and self-service printing service of the information service system MS, authorizes user1 as a common user role of the information service system MS, and has access rights to the email service, authorizes user2 as an advanced user role of the information service system MS, and has access rights to the email service and self-service printing service, and MS_M saves and closes the fine-grained authorization unified model interface.

[0089] (4) AP_M checks the authorization platform and finds that user1 and user2 have been granted the permissions set in steps (2) and (3).

[0090] (5) RS_M opens the fine-grained authorization unified model interface in the human resources system RS again. It can view the human resources system RS function menu resources added in step (2) and the fine-grained authorization for user1 and user2. However, it cannot view the information service system MS application service resources added in step (3) and the fine-grained authorization for user1 and user2.

[0091] (6) MS_M opens the fine-grained authorization unified model interface in the information service system MS again, and can view the information service system MS application service resources added in step (3) and the fine-grained authorization for user1 and user2. However, it cannot view the human resources system RS function menu resources added in step (2) and the fine-grained authorization for user1 and user2.

[0092] The configured fine-grained permissions are uploaded to the authorization platform for centralized management.

[0093] Among them, the first, second and third parts are the development and implementation stages, and the fourth part is the application and implementation stage.

[0094] The present invention discloses a fine-grained authorization method for a business system based on a unified model, the method comprising: step S1, obtaining the system type and fine-grained authorization parameters of the business system, and constructing an authorization platform including a unified model interface for fine-grained authorization; step S2, establishing interaction between the business system and the authorization platform; step S3, after the administrator of the business system logs into the business system, using the unified model interface for fine-grained authorization to view the fine-grained permission list related to the business system and perform fine-grained authorization; step S4, uploading the configured fine-grained permission to the authorization platform for centralized management. The present invention, in addition to performing fine-grained access authorization on the business system through the authorization platform including the unified model interface for fine-grained authorization, increases the ability to configure its own fine-grained permission on the business system side, on the one hand greatly reducing the authorization workload of the unified authorization platform, on the other hand handing over the fine-grained permission to each business system for configuration, improving the accuracy of the fine-grained authorization of the business system, and having great application value in the scenario where the unified authorization platform manages a large number of fine-grained access rights of business systems.

[0095] The present invention meets the fine-grained authorization management requirements of various business systems; while the authorization platform aggregates all authority information, the fine-grained authority information presented by different business systems is different, and the fine-grained authorization is limited within the influence range of each business system.

[0096] In the present invention, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or terminal device including the element.

[0097] Finally, it should be noted that the above is a preferred embodiment of the present invention. It should be pointed out that although the preferred embodiment of the present invention has been described, for those skilled in the art, once the basic creative concept of the present invention is known, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be regarded as the protection scope of the present invention. Therefore, the attached claims are intended to be interpreted as including the preferred embodiment and all changes and modifications that fall within the scope of the embodiments of the present invention.

Claims

1. A fine-grained authorization method for a business system based on a unified model, characterized in that: The following steps are involved: Step S1: Obtain the system type and fine-grained authorization parameters of the business system, and build an authorization platform including a fine-grained authorization unified model interface; Step S2: establishing interaction between the business system and the authorization platform; Step S3: After logging into the business system, the administrator of the business system uses the fine-grained authorization unified model interface to view the fine-grained permission list related to the business system and perform fine-grained authorization; Step S4: Upload the configured fine-grained permissions to the authorization platform for centralized management.

2. The fine-grained authorization method for business systems based on a unified model according to claim 1 is characterized in that: The step S1 specifically includes: Step S11: construct a main list interface of fine-grained permission information of the fine-grained authorization unified model interface, wherein the main list interface is used to display currently authorized fine-grained permissions; Step S12: construct an object management window, wherein the object management window is at least used to complete object registration, object deletion, object editing, and to sort out the characteristics of each business system and summarize the object type; Step S13: Design a fine-grained authorization window for subject-object association according to scenario requirements, wherein the fine-grained authorization window is used for at least identity authorization, role authorization, and attribute authorization.

3. The fine-grained authorization method for business systems based on a unified model according to claim 2 is characterized in that: In the step S2, Iframe cross-domain page communication technology is used to integrate the business system with the fine-grained authorization unified model interface through page sharing, which specifically includes: Taking the front-end page of the business system as the parent page, an event triggering mechanism for opening the fine-grained authorization unified model interface is added; An embed code is added to the parent page, and when the fine-grained authorization unified model interface opening event is triggered, the fine-grained authorization unified model interface is obtained from the authorization platform through an Iframe reference.

4. The fine-grained authorization method for business systems based on a unified model according to claim 3 is characterized in that: The embedded code presets interaction parameters, specifically including: The IP address and port number of the authorization platform; The unique identity of the administrator currently logged in to the business system; The IP address, name, and internal number of the business system; The parent page adds code for closing the fine-grained authorization unified model interface.

5. The fine-grained authorization method for business systems based on a unified model according to claim 1, characterized in that: In step S3, the interaction process between the business system and the authorization platform includes: The front end of the business system obtains current environment information from the back end; The front end of the business system fills the information of the authorization platform and the environment information of the business system into the interaction parameters corresponding to the embedded code to complete the data encapsulation of the fine-grained authorization unified model interface request package; The front end of the business system requests the fine-grained authorization unified model interface from the authorization platform; After the authorization platform listens to the request message, it performs parameter parsing and generates the fine-grained authorization unified model interface; The authorization platform returns the fine-grained authorization unified model interface to the front end of the business system; The business system presents a unified model interface for fine-grained authorization, and performs exclusive information configuration operations such as object management and fine-grained authorization; The fine-grained authorization unified model interface sends the latest exclusive information to the authorization platform; The authorization platform saves the exclusive information for unified management, or is available for acquisition when the corresponding business system requests a fine-grained authorization unified model interface next time.

6. The unified model-based fine-grained authorization method for business systems according to claim 5, characterized in that: After the authorization platform receives the listening request message, it performs parameter parsing and generates the fine-grained authorization unified model interface, specifically including: Resolve the identity of the administrator currently logged into the business system; The identity and authority of the administrator are verified through the identity identifier, including at least whether the identity identifier is valid in the register and whether the administrator has the authority to request the fine-grained authorization unified model interface. If the verification is passed, the next step is entered; otherwise, the fine-grained authorization unified model interface is set to be empty. Analyze the basic information of the business system; Determine whether the business system has been registered as a coarse-grained object in the authorization platform based on the basic information. If it has been registered, proceed to the next step. Otherwise, set the fine-grained authorization unified model interface to be empty. Obtain the exclusive information of the last effective configuration of the business system, including at least the object and fine-grained permissions; According to the acquisition of exclusive information, confirm whether it is the first time to configure exclusive information for the business system. If it is the first configuration, initialize the fine-grained authorization unified model interface. Otherwise, after initializing the fine-grained authorization unified model interface, add the acquired exclusive information to the fine-grained authorization unified model interface to complete the generation of the fine-grained authorization unified model interface.

7. The fine-grained authorization method for business systems based on a unified model according to claim 1, characterized in that: The environmental information at least includes: The unique identity of the currently logged-in administrator, the IP address, name, and internal number of the business system.

8. The unified model-based fine-grained authorization method for business systems according to claim 2, characterized in that: The main list interface includes at least: subject identification, subject name, object identification, object name, object URL description; The subject identifier represents the identity ID of the network entity that initiates the network resource access request; The subject name represents the name of the network entity that initiates the network resource access request; The object identifier represents the identity ID of the network resource accessed by the subject; The object name represents the name of the network resource accessed by the subject; The object URL represents the uniform resource locator of the network resource accessed by the subject, that is, the network path.

Images