Park system visitor authority dynamic control method and device and medium

Abstract

The invention discloses a dynamic control method for visitor authority of a park system. The method comprises the following steps: sending a menu item selected to be accessed by a visitor to a visitor authentication micro-service; receiving a visitor authority two-dimensional code generated by the visitor authentication micro-service based on the selected menu item; a visitor code scanning login request generated when a visitor scans the visitor permission two-dimensional code is sent to the visitor authentication micro-service; if the analyzed permission does not exist in the RBAC permission table, receiving an updated visitor permission two-dimensional code to enable the visitor to scan the code again to log in; otherwise, the visitor can log in the park system; a visitor logs in the park access system, and after the visitor selects a service request, a corresponding visitor access service request is sent to the gateway; and the gateway judges whether the visitor has the authority to access the business request, and if yes, the visitor access business request is forwarded to the corresponding business micro-service. According to the invention, the visitor demand is subjected to dynamic permission conversion and real-time updating, so that the efficient and high-quality access of the visitor to the system can be realized.

Description

Technical Field

[0001] The present application relates to the technical field of visitor control in a park system, and more specifically, to a method, device and medium for dynamically controlling visitor rights in a park system. Background Art

[0002] In recent years, with the increasing demand for digital transformation and upgrading of cities, more and more park system products have emerged. Park system products usually cover most of the functions of park digital management, which can greatly improve the efficiency of daily operation and maintenance of the park and reduce the operation and maintenance costs of the park. As the application of park system products becomes more and more extensive and the scale becomes larger, the number of users accessing the system is also increasing. Specific park system resources can only be accessed by specific personnel. Visitors, as a special user group of the park system, should be able to quickly access the park system without login account information to meet their own personalized needs.

[0003] Due to the diversity of types of park system visitors, there are many personalized needs for accessing the park system. Visitors need to meet the characteristics of fast and efficient access when entering the park system, especially for park system products sold externally. Park system visitors hope to quickly understand the matching degree between park system products and their own needs in a shorter time. The traditional approach mainly includes: park system visitors contact the sales staff of the park system product manufacturer, and the sales staff obtains the basic information of the visitor and then contacts the park system administrator to add the basic information and corresponding permissions of the visitor in the park system. The visitor then enters the park system with the provided account and password. However, the authorization process is cumbersome, and the park system usually only displays some commonly used functions, and cannot display personalized functions according to customer needs, which may result in the loss of some potential customers. In addition, a large number of visitors will inevitably increase the operation and maintenance pressure of the park system administrator, delay the time period for visitors to enter the park system, and affect the visitor's experience.

[0004] The Chinese patent with publication number CN 109688120 A provides a dynamic permission management system based on an improved RBAC model and SpringSecurity framework. It optimizes and improves the RBAC model and merges the user group module and the role module. It can reduce the workload of the campus system administrator in managing campus visitor users to a certain extent, but it still cannot avoid the need for administrators to frequently intervene manually, resulting in the efficiency of visitor access to the campus system not being significantly improved.

[0005] Therefore, how to improve the efficiency and quality of visitors' access to the campus system is a technical problem that urgently needs to be solved. Summary of the invention

[0006] In response to at least one defect or improvement need in the prior art, the present application provides a method, device and medium for dynamically controlling visitor permissions in a campus system, which are used to at least improve the visitor's access efficiency and quality to the campus system.

[0007] To achieve the above objectives, in a first aspect, the present application provides a method for dynamically controlling visitor permissions in a park system, comprising:

[0008] Step 1: Send the function menu items selected by the visitor according to his / her needs to the visitor authentication microservice through the gateway;

[0009] Step 2: Receive the corresponding visitor permission QR code generated by the visitor authentication microservice based on the function menu item selected by the visitor to access;

[0010] Step 3: Send the visitor scan code login request generated after the visitor scans the visitor permission QR code to the visitor authentication microservice;

[0011] Step 4: If the parsed permission does not exist in the RBAC permission table, an updated visitor permission QR code is received so that the visitor can scan the code to log in again; otherwise, the visitor can log in to the park system this time; specifically, the visitor authentication microservice parses the visitor permission QR code and generates a visitor permission menu in combination with the RBAC permission table; if the parsed permission does not exist in the RBAC permission table, the visitor permission QR code is updated and returned to the visitor front end so that the visitor can scan the code to log in again; if the parsed permission exists in the RBAC permission table, the visitor can log in to the park system this time;

[0012] Step 5: The visitor logs in to the campus system and sends a corresponding visitor access service request to the gateway after selecting a service request; the gateway determines whether the visitor has the permission to access the service request through the visitor permission menu, and if so, forwards the visitor access service request to the corresponding service microservice.

[0013] Furthermore, the updating of the visitor permission QR code includes:

[0014] When parsing the visitor permission QR code, after converting the hexadecimal number into a binary number, if the value of the corresponding bit is 1, the current bit number is obtained;

[0015] The corresponding permission is searched in the RBAC permission table by the current bit number; if not found, the value is discarded and the visitor permission QR code is updated.

[0016] Furthermore, before step 1, the method further includes:

[0017] Step 01: Establish the visitor authentication microservice of the park system and configure a mapping relationship table between the visitor authentication microservice request resource path and permissions;

[0018] Step 02: Display all function menu items that visitors can access in the form of a list, and visitors can check the corresponding function menu items according to their needs;

[0019] Step 03: Obtain a visitor permission set based on all function menu items that the visitor can access through the RBAC model.

[0020] Furthermore, the visitor authentication microservice generates a corresponding visitor permission QR code based on the function menu item selected to be accessed, including:

[0021] The visitor authentication microservice generates the visitor permission QR code according to the visitor basic information and the visitor permission set; the visitor permission QR code includes the visitor basic information and a number converted from a binary string consisting of the visitor permission set; the correspondence between the bits of the binary string and the permissions is determined by the id field of the RBAC permission table in the RBAC model.

[0022] Furthermore, it also includes:

[0023] Storing the visitor's basic information in the redis cache database;

[0024] The visitor authentication microservice reads the visitor's basic information from the redis cache database for verification, and parses the visitor's permission QR code.

[0025] Furthermore, it also includes:

[0026] When the visitor exits the park system, the visitor's basic information is deleted from the redis cache database.

[0027] Furthermore, the step 5 also includes:

[0028] If you do not have permission to access the service request, you will receive a prompt message indicating that you do not have permission to access the request.

[0029] Furthermore, when other demands for accessing the park system are added, return to step 02.

[0030] In a second aspect, the present application provides an electronic device comprising at least one processing unit and at least one storage unit; wherein the storage unit stores a computer program, and when the computer program is executed by the processing unit, the processing unit is enabled to perform the steps of any of the control methods described above.

[0031] In a third aspect, the present application provides a storage medium storing a computer program executable by an access authentication device, wherein when the computer program runs on the access authentication device, the access authentication device is enabled to perform the steps of any of the aforementioned control methods.

[0032] In general, the above technical solutions conceived by the present application can achieve the following beneficial effects compared with the prior art:

[0033] (1) This application establishes a visitor permission QR code mechanism under the framework of microservices, automates dynamic permission conversion and real-time update of visitor requirements, thereby avoiding manual intervention, enabling visitors to access the campus system quickly and efficiently, improving visitor experience, and reducing the workload of campus system administrators.

[0034] (2) The present application optimizes the mechanism for generating permission binary strings, optimizing the traditional binary string with a fixed number of bits into a binary string with dynamically adjustable bits, without the need to additionally design a permission bit stream field. This can greatly save database overhead and reduce the consumption of the park system's memory when the number of permissions in the park system is large, and effectively avoid the occurrence of permission verification errors caused by dynamic modification of the number of permissions due to the fixed number of bits, thereby improving the stability of the park system.

[0035] (3) This application combines the temporary, random and time-sensitive characteristics of visitors to the park system, uses a redis cache database to store basic visitor information, and deletes the visitor's basic information after the visitor exits the park system, thereby reducing operations on the park system database and improving the security of the park system. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 A core flow chart of a method for dynamically controlling visitor rights in a park system provided in an embodiment of the present application;

[0038] Figure 2 The overall flow chart of visitor permission QR code generation, visitor login and visitor service access provided in the embodiment of the present application;

[0039] Figure 3 A block diagram of an electronic device provided in an embodiment of the present application that is suitable for implementing the control method described above. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. In addition, the technical features involved in each embodiment of the present application described below can be combined with each other as long as they do not conflict with each other.

[0041] The terms "including" or "having" and any variations thereof in the specification, claims or drawings of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0042] Terminology explanation:

[0043] 1. Microservices. The microservices architectural style is a way to develop a single application using a set of small services. Each service runs in its own process and communicates using a lightweight mechanism, usually an HTTP API. These services are built based on business capabilities and can be independently deployed through automated deployment mechanisms. These services are implemented in different programming languages, as well as different data storage technologies, and maintain minimal centralized management.

[0044] 2. RBAC. RBAC (Role-Based Access Control) implements access control to system resources by assigning permissions to roles and then assigning roles to users. A user has several roles, and each role has several permissions. In this way, a "user-role-permission" authorization model is constructed.

[0045] 3. Park system visitors. Park system visitors are users who are not regular users of the park system but temporarily access the park system due to specific needs. Park visitor types include visiting customers, suppliers and other outsiders of various parks (such as commercial and industrial parks) that use the park system, as well as potential customers when the park system is sold as a product.

[0046] As described in the background technology section of the specification, the authorization process of traditional technical means is cumbersome, and the park system usually only displays some commonly used functions, and cannot display personalized functions according to customer needs, which may result in the loss of some potential customers. In addition, a large number of visitors will inevitably increase the operation and maintenance pressure of the park system administrator, delay the time period for visitors to enter the park system, and affect the visitor's experience. In view of this, the present application proposes a method, device and medium for dynamic control of visitor permissions in the park system, which is used to at least improve the visitor's access efficiency and access quality to the park system.

[0047] refer to Figure 1 and Figure 2 An embodiment of the present application provides a method for dynamically controlling visitor permissions in a campus system. The control method may include the following steps.

[0048] Step 1: Establish a visitor authentication microservice for the campus system and configure a mapping table between the visitor authentication microservice request resource path and permissions.

[0049] Step 2: Display all function menu items accessible to park visitors in the form of a list, and visitors can check the corresponding function menu items according to their needs.

[0050] Step 3: Obtain the visitor permission set based on all function menu items that the visitor can access through the RBAC model.

[0051] Step 4: The visitor front-end sends the function menu items selected by the visitor to be accessed according to his / her needs to the visitor authentication microservice through the gateway, and then the visitor authentication microservice generates the corresponding visitor permission QR code based on the visitor's basic information and visitor permission set.

[0052] The visitor permission QR code includes the visitor's basic information and a number converted from a binary string consisting of the visitor permission set. The correspondence between the bits of the binary string and the permissions is determined by the id field of the RBAC permission table in the RBAC model (the id field is set to an integer increment), thereby effectively avoiding permission verification errors caused by dynamic modifications to the number of permissions due to a fixed number of bits.

[0053] The generated visitor permission QR code is then returned to the visitor front end, and the visitor's basic information is stored in the redis cache database.

[0054] The patent with publication number CN 111030828 A mentions the one-to-one correspondence between the use of a fixed-bit binary string and permissions. The permissions that a visitor has are a subset of all system permissions, and need to be dynamically adjusted according to the specific needs of the visitor. However, the use of a fixed-bit binary string will cause a certain degree of resource waste and is not suitable for visitor permission verification. Therefore, the present application has been improved on this basis, and is implemented by using a variable-bit binary string. The permission name of each bit is determined by the id field of the RBAC permission table read from the RBAC model (the field is designed as an int type, representing the permission sequence number, and gradually increases from 0). For example, the field of permission A is 8, the field of permission B is 6, and the field of permission C is 4. Assuming that the visitor has permissions A, B, and C at the same time, the corresponding binary string is 101010000 (the rightmost is the 0th bit), which is converted into hexadecimal 0x150, and the digital part "150" is taken as the permission status number. After being converted into a string "150", it is used to generate a visitor permission QR code.

[0055] Step 5: After the visitor scans the generated visitor permission QR code, he / she enters the campus system. The visitor authentication microservice parses the content of the visitor permission QR code and displays the menu items that the visitor is authorized to operate.

[0056] Specifically, the visitor scans the visitor permission QR code generated in step 4 (the result of the scan is a string of numbers, such as "150"), submits a login request, and the visitor authentication microservice reads the visitor's basic information from the redis cache database and verifies it, parses the visitor permission QR code (parses "150" into the corresponding visitor permission menu), and generates a visitor permission menu in combination with the RBAC permission table. If the parsed permission does not exist in the RBAC permission table, the visitor permission QR code is updated and returned to the visitor front end, and the visitor can scan the code again to log in. If it exists, the visitor can log in to the campus system this time.

[0057] More specifically, when parsing the visitor permission QR code, after converting the hexadecimal number into binary, if the value of the corresponding bit is 1, the current bit number is obtained, and the corresponding permission is searched in the RBAC permission table through the bit number. If it is not found, it means that the permission is deleted in the RBAC permission table, then the value is discarded, the visitor permission QR code is updated and returned to the visitor front end.

[0058] The present application optimizes the generation mechanism of the permission binary string, optimizes the traditional binary string with a fixed number of bits into a binary string with dynamically adjustable number of bits, and does not require the additional design of the permission bit stream field. This can greatly save database overhead and reduce the consumption of the park system memory when the number of permissions in the park system is large, and effectively avoids the occurrence of permission verification errors caused by dynamic modification of the number of permissions due to a fixed number of bits, thereby improving the stability of the park system.

[0059] Step 6. The visitor logs in to the campus system. After the visitor selects a service request, the visitor front-end sends the corresponding visitor access service request to the gateway. Then, the microservice gateway integrated with the spring-security framework verifies the interface permission of the interface request through the visitor permission menu. Requests that pass the verification are forwarded to the corresponding business microservice according to the routing rules. Requests that fail the verification return an error code (prompt information of unauthorized access request) to the visitor front-end.

[0060] Step 7: When a visitor logs into the park system again, scan the visitor permission QR code and verify the visitor's identity before entering the park system.

[0061] Step 8: When a visitor exits the campus system, the visitor's basic information is deleted from the redis cache database.

[0062] This application combines the temporary, random and time-sensitive characteristics of visitors to the park system, uses a redis cache database to store basic visitor information, and deletes the visitor's basic information after the visitor exits the park system, thereby reducing operations on the park system database and improving the security of the park system.

[0063] Step 9: When other access requirements are temporarily added, return to step 2.

[0064] This application establishes a visitor permission QR code mechanism under the framework of microservices, automates dynamic permission conversion and real-time updates of visitor requirements, thereby avoiding manual intervention, enabling visitors to access the park system quickly and efficiently, improving visitor experience, and reducing the workload of park system administrators.

[0065] Figure 3 A block diagram of an electronic device suitable for implementing the control method described above according to an embodiment of the present application is schematically shown. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0066] like Figure 3As shown, the electronic device 1000 described in this embodiment includes: a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage part 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), and the like. The processor 1001 may also include an onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the control method flow according to an embodiment of the present application.

[0067] In RAM 1003, various programs and data required for the operation of system 1000 are stored. Processor 1001, ROM 1002 and RAM 1003 are connected to each other through bus 1004. Processor 1001 performs various operations of the control method flow according to the embodiment of the present application by executing the program in ROM 1002 and / or RAM 1003. It should be noted that the program can also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 can also perform various operations of the control method flow according to the embodiment of the present application by executing the program stored in the one or more memories.

[0068] According to an embodiment of the present application, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to the bus 1004. The system 1000 may further include one or more of the following components connected to the I / O interface 1005: an input part 1006 including a keyboard, a mouse, etc.; an output part 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 1008 including a hard disk, etc.; and a communication part 1009 including a network interface card such as a LAN card, a modem, etc. The communication part 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed, so that the computer program read therefrom is installed into the storage part 1008 as needed.

[0069] The control method flow according to the embodiment of the present application can be implemented as a computer software program. For example, the embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the control method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the processor 1001, the above-mentioned functions defined in the system of the embodiment of the present application are executed. According to the embodiment of the present application, the system, equipment, device, module and / or unit described above can be implemented by a computer program module.

[0070] The embodiments of the present application also provide a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the steps of the control method according to the embodiments of the present application can be implemented.

[0071] According to an embodiment of the present application, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In an embodiment of the present application, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present application, the computer-readable storage medium may include one or more memories other than the ROM 1002 and / or RAM 1003 described above.

[0072] It should be noted that the functional modules in the various embodiments of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software functional modules. If the integrated modules are implemented in the form of software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product.

[0073] The flowchart and / or block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flowchart and / or block diagram can represent a part of a module, program segment or code, and a part of the above-mentioned module, program segment or code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0074] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of the present application may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present application. In particular, without departing from the spirit and teachings of the present application, the technical features described in the various embodiments and / or claims of the present application may be combined and / or combined in a variety of ways, and all of these combinations and / or combinations fall within the scope of the present application.

[0075] Although the present application has been shown and described with reference to specific exemplary embodiments of the present application, it should be understood by those skilled in the art that various changes in form and details may be made to the present application without departing from the spirit and scope of the present application as defined by the appended claims and their equivalents. Therefore, the scope of the present application should not be limited to the above-mentioned embodiments, but should be determined not only by the appended claims, but also by the equivalents of the appended claims.

Claims

1. A method for dynamically controlling visitor rights in a park system, characterized in that: include: Step 1: Send the function menu items selected by the visitor according to his / her needs to the visitor authentication microservice through the gateway; Step 2: Receive the corresponding visitor permission QR code generated by the visitor authentication microservice based on the function menu item selected by the visitor to access; Step 3: Send the visitor scan code login request generated after the visitor scans the visitor permission QR code to the visitor authentication microservice; Step 4: If the parsed permission does not exist in the RBAC permission table, an updated visitor permission QR code is received so that the visitor can scan the code and log in again; Otherwise, the visitor can log in to the park system this time; specifically, the visitor authentication microservice parses the visitor permission QR code and generates a visitor permission menu in combination with the RBAC permission table. If the parsed permission does not exist in the RBAC permission table, the visitor permission QR code is updated and returned to the visitor front end so that the visitor can scan the code to log in again; If the parsed permissions exist in the RBAC permission table, the visitor can log in to the campus system this time; Step 5: The visitor logs in to the campus system and sends a corresponding visitor access service request to the gateway after selecting a service request; the gateway determines whether the visitor has the permission to access the service request through the visitor permission menu, and if so, forwards the visitor access service request to the corresponding service microservice.

2. The control method according to claim 1, characterized in that: The QR code for updating visitor permissions includes: When parsing the visitor permission QR code, after converting the hexadecimal number into a binary number, if the value of the corresponding bit is 1, the current bit number is obtained; The corresponding permission is searched in the RBAC permission table by the current bit number; if not found, the value is discarded and the visitor permission QR code is updated.

3. The control method according to claim 1, characterized in that: Before step 1, the method further includes: Step 01: Establish the visitor authentication microservice of the park system and configure a mapping relationship table between the visitor authentication microservice request resource path and permissions; Step 02: Display all function menu items that visitors can access in the form of a list, and visitors can select the corresponding function menu item according to their needs; Step 03: Obtain a visitor permission set based on all function menu items that the visitor can access through the RBAC model.

4. The control method according to claim 3, characterized in that: The visitor authentication microservice generates the corresponding visitor permission QR code based on the function menu item selected by the visitor to access, including: The visitor authentication microservice generates the visitor permission QR code according to the visitor basic information and the visitor permission set; the visitor permission QR code includes the visitor basic information and a number converted from a binary string consisting of the visitor permission set; the correspondence between the bits of the binary string and the permissions is determined by the id field of the RBAC permission table in the RBAC model.

5. The control method according to claim 4, characterized in that: Also includes: Storing the visitor's basic information in the redis cache database; The visitor authentication microservice reads the visitor's basic information from the redis cache database for verification, and parses the visitor's permission QR code.

6. The control method according to claim 5, characterized in that: Also includes: When the visitor exits the park system, the visitor's basic information is deleted from the redis cache database.

7. The control method according to claim 1, characterized in that: The step 5 also includes: If you do not have permission to access the service request, you will receive a prompt message indicating that you do not have permission to access the request.

8. The control method according to claim 3, characterized in that: When other requirements for accessing the campus system are added, return to step 02.

9. An electronic device, characterized in that: It comprises at least one processing unit and at least one storage unit; wherein the storage unit stores a computer program, and when the computer program is executed by the processing unit, the processing unit is enabled to execute the steps of the control method described in any one of claims 1-8.

10. A storage medium, characterized in that: It stores a computer program executable by an access authentication device. When the computer program runs on the access authentication device, the access authentication device is enabled to execute the steps of the control method according to any one of claims 1 to 8.

Images