Distributed authentication and authority management method, device and equipment

Abstract

The invention relates to a distributed authentication and authority management method, device and equipment. Comprising the steps that when a user sends a data access request to a target application in a service system, the target application analyzes the data access request to obtain user information; judging whether authority information corresponding to the user information is cached in a shared memory of the service system or not; if not, acquiring permission information corresponding to the user information from an external permission management unit, and caching the permission information in the shared memory; if yes, acquiring permission information from the shared memory; and judging whether the user has the access permission of the target application or not according to the permission information, and if yes, processing the data access request. According to the embodiment of the invention, a set of authority management system can be shared among management systems or management micro-services in an enterprise, and the application access authority and the data access authority can be controlled only by deploying authentication services in each application.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of information security technology, and in particular to a distributed authentication and authority management method, device and equipment. Background Art

[0002] As the digitalization level of enterprises continues to improve, the number of management systems in enterprises is also increasing. There will be a large number of interface and data authentication operations between different systems or different services of the same system. However, the systems within the same enterprise have a high duplication rate, inconsistent user experience, and data integrity cannot be guaranteed. If a user performs an authorization operation, the authorization data needs to be configured in multiple systems separately, which is repetitive and easy to miss.

[0003] Currently, most commonly used authentication schemes are unified and centralized, which have the possibility of single point failure. In addition, in order to achieve complete authentication, it is necessary to add a step of accessing the authentication service in the call link, which reduces the performance of the request. If data permission control is to be further implemented, each system or microservice needs to be redeveloped to add data permission control separately.

[0004] How to reduce single point dependencies, improve request performance, and reduce development workload is a technical problem that needs to be solved urgently. Summary of the invention

[0005] To solve the problems existing in the prior art, the embodiments of this specification provide a distributed authentication and permission management method, apparatus and device, which integrate the authentication function into each application and configure the permission management unit address. When a user accesses an application, the application intercepts the user's access request and queries whether the user's permission information exists in the system shared memory. If not, the user's permission information is obtained from the permission management unit and stored in the shared memory. Then, it is verified whether the user has access rights based on the user's permission information. If so, the data access request is processed.

[0006] The specific technical solutions of the embodiments of this specification are as follows:

[0007] On the one hand, an embodiment of this specification provides a distributed authentication and rights management method for a service system, wherein a plurality of applications are deployed in the service system and executed by the applications, and the method includes:

[0008] When a user sends a data access request to a target application in the service system, the target application parses the data access request to obtain user information;

[0009] Determining whether permission information corresponding to the user information is cached in the shared memory of the service system;

[0010] If not, obtaining the permission information corresponding to the user information from an external permission management unit and caching the permission information in the shared memory; if yes, obtaining the permission information from the shared memory;

[0011] It is determined whether the user has access rights to the target application according to the permission information, and if so, the data access request is processed.

[0012] Further, the permission information includes application access permission information and data access permission information;

[0013] Determining whether the user has access rights to the target application according to the permission information, and if the user has access rights to the target application, processing the data access request further includes:

[0014] Determining whether the user has access rights to the target application according to the application access rights information;

[0015] If so, the data access permission information is concatenated with the first SQL statement in the data access request for accessing the database of the service system to obtain a second SQL statement and execute it, and the execution result of the second SQL statement is returned to the user.

[0016] Furthermore, the data access permission information includes target organization information corresponding to the user information;

[0017] The data access permission information is concatenated with the first SQL statement in the data access request for accessing the database in the service system to obtain the second SQL statement, which further includes:

[0018] The target organization information is concatenated with the first SQL statement to obtain the second SQL statement.

[0019] Furthermore, the first SQL statement includes a target table name and a target field name accessed by the data access request;

[0020] The target organization information is concatenated with the first SQL statement to obtain the second SQL statement further comprising:

[0021] The target organization information is concatenated with the target table name and the target field name in the first SQL statement to obtain the second SQL statement.

[0022] Furthermore, each piece of data in the database includes information of organizations with access rights;

[0023] The step of executing the second SQL statement includes:

[0024] Using the target table name, target field name and target organization information in the second SQL statement as indexes, querying from the database;

[0025] If data corresponding to the target table name, target field name and target organization information exists in the database, the data is used as a query result and returned to the user.

[0026] Furthermore, if the user information corresponds to multiple target organization information, the data access permission information is concatenated with the first SQL statement in the data access request for accessing the database in the service system to obtain the second SQL statement, which further includes:

[0027] Concatenate the plurality of target organization information with the first SQL statement to obtain the second SQL statement;

[0028] The step of executing the second SQL statement includes:

[0029] Using the target table name, target field name and multiple target organization information in the second SQL statement as indexes, querying from the database;

[0030] If data corresponding to the target table name, the target field name, and any one of the target organization information exists in the database, the data is used as a query result and returned to the user.

[0031] Furthermore, the permission information also includes a whitelist of application access permissions;

[0032] Determining whether the user has access rights to the target application according to the permission information, and if the user has access rights to the target application, processing the data access request further includes:

[0033] Determine whether the user information belongs to the application access permission whitelist, and if so, process the data access request.

[0034] Furthermore, the permission information also includes a data access permission whitelist;

[0035] Processing the data access request further includes:

[0036] Determine whether the user information belongs to the data access whitelist; if so, execute the first SQL statement and return the execution result of the first SQL statement to the user.

[0037] Furthermore, when the user sends a data access request to the target application in the service system, the method further includes:

[0038] According to a predetermined rule, it is determined whether the first SQL statement in the data access request for accessing the database of the service system is released. If it is released, the first SQL statement is directly executed and the execution result of the first SQL statement is returned to the user.

[0039] Furthermore, when the target application obtains the permission information corresponding to the user information from the permission management unit, the method further includes:

[0040] The permission management unit records the corresponding relationship between the target application and the user information;

[0041] When the permission information corresponding to the user information in the permission management unit is updated, the permission management unit sends a notification message to the target application corresponding to the user information, wherein the notification message includes the user information of the updated permission information;

[0042] After receiving the notification message, the target application deletes the permission information corresponding to the user information from the shared memory.

[0043] Furthermore, when the target application obtains the permission information from the shared memory, the method further includes:

[0044] An access timestamp corresponding to the permission information in the shared memory is updated so that an application that caches the permission information in the shared memory determines whether to delete the permission information cached in the shared memory according to the access timestamp.

[0045] Further, the application that caches the permission information in the shared memory determines whether to delete the permission information cached in the shared memory according to the access timestamp, including:

[0046] The application that caches the permission information into the shared memory obtains the access timestamp of the permission information cached into the shared memory according to a predetermined period, and determines whether the difference between the access timestamp and the current time exceeds a threshold. If so, the permission information is deleted from the shared memory.

[0047] On the other hand, the embodiment of this specification also provides a distributed authentication and authority management device, which is applied to a service system, wherein a plurality of applications are deployed in the service system, and the distributed authentication and authority management device is deployed in the application, wherein the device includes:

[0048] A user information parsing unit, configured to, when a user sends a data access request to a target application in the service system, cause the target application to parse the data access request and obtain user information;

[0049] a permission information acquisition unit, configured to determine whether the permission information corresponding to the user information is cached in the shared memory of the service system; when the permission information corresponding to the user information is not cached in the shared memory of the service system, acquire the permission information corresponding to the user information from an external permission management unit and cache the permission information in the shared memory; otherwise, acquire the permission information from the shared memory;

[0050] The access request processing unit is used to determine whether the user has access rights to the target application according to the permission information, and if so, process the data access request.

[0051] On the other hand, an embodiment of the present specification further provides a computer device, including a memory, a processor, and a computer program stored in the memory, and the processor implements the above method when executing the computer program.

[0052] On the other hand, an embodiment of the present specification further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0053] Finally, the embodiments of this specification also provide a computer program product, wherein the computer program product includes a computer program, and the computer program implements the above method when executed by a processor.

[0054] By utilizing the embodiments of this specification, management systems or management microservices within an enterprise can share a set of permission management systems. It is only necessary to deploy authentication services in each application to control application access rights and data access rights, and user permission management and authorization operations do not need to be switched between systems, which not only improves the access efficiency of the system but also ensures information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 The figure shows a flow chart of a distributed authentication and rights management method in an embodiment of this specification;

[0057] Figure 2The figure shows a flow chart of determining whether the user has the access right to the target application according to the permission information in an embodiment of the present specification, and if so, processing the data access request;

[0058] Figure 3 The figure is a schematic diagram of the process of executing the second SQL statement in the embodiment of this specification;

[0059] Figure 4 Shown is a schematic diagram of the process of updating the permission information in this manual;

[0060] Figure 5 The figure shows a schematic diagram of the structure of a distributed authentication and authority management device in an embodiment of this specification;

[0061] Figure 6 The figure is a schematic diagram of the structure of a computer device in an embodiment of the present specification.

[0062]

Description of the accompanying drawings

[0063] 501, user information parsing unit;

[0064] 502, authority information acquisition unit;

[0065] 503, access request processing unit;

[0066] 602. Computer equipment;

[0067] 604, processor;

[0068] 606. Memory;

[0069] 608, driving mechanism;

[0070] 610, input / output module;

[0071] 612. Input devices;

[0072] 614. Output devices;

[0073] 616. Presentation equipment;

[0074] 618. Graphical user interface;

[0075] 620, network interface;

[0076] 622, communication link;

[0077] 624. Communication bus. DETAILED DESCRIPTION

[0078] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the embodiments of this specification.

[0079] It should be noted that the terms "first", "second", etc. in the description and claims of the embodiments of this specification and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of this specification described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0080] It should be noted that the acquisition, storage, use, and processing of data in the technical solutions of the embodiments of this specification comply with the relevant provisions of national laws and regulations.

[0081] It should be noted that in the embodiments of this specification, certain software, components, models and other existing solutions in the industry may be mentioned, which should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0082] In view of the problems existing in the prior art, the embodiments of this specification provide a distributed authentication and authority management method, which is applied to a service system, in which a plurality of applications are deployed and executed by the applications.

[0083] Figure 1 The figure shows a flow chart of the distributed authentication and rights management method in the embodiment of this specification. The process of managing the rights of the user is described in this figure. The order of steps listed in the embodiment is only one way of executing the order of many steps and does not represent the only execution order. When the system or device product is executed in practice, it can be executed in the order of the method shown in the embodiment or the accompanying drawings or in parallel.

[0084] Specifically, as shown in FIG. 1 , the method may include:

[0085] Step 101: When a user sends a data access request to a target application in the service system, the target application parses the data access request to obtain user information;

[0086] Step 102: Determine whether permission information corresponding to the user information is cached in the shared memory of the service system;

[0087] Step 1021: If not, obtaining the permission information corresponding to the user information from an external permission management unit, and caching the permission information in the shared memory;

[0088] Step 1022: If yes, obtaining the permission information from the shared memory;

[0089] Step 103: Determine whether the user has access rights to the target application based on the permission information; if so, process the data access request.

[0090] By utilizing the embodiments of this specification, management systems or management microservices within an enterprise can share a set of permission management systems. It is only necessary to deploy authentication services in each application to control application access rights and data access rights, and user permission management and authorization operations do not need to be switched between systems, which not only improves the access efficiency of the system but also ensures information security.

[0091] In the embodiment of this specification, multiple applications are deployed in the service system, and the authentication SDK can be integrated into the application. Figure 1 The method shown. In the embodiment of this specification, the authentication SDK is integrated into the application. When the user sends a data access request to the target application, the authentication SDK in the target application intercepts the request and parses it to obtain the user information.

[0092] Multiple service systems can share the same external permission management unit, which stores the permission information of users under each service system. In order to avoid single point failure, in the embodiment of the present specification, when a user first accesses a service system, the authentication SDK in the application accessed by the user obtains the permission information corresponding to the user information from the external permission management unit, and then caches the permission information in the shared memory of the service system. Therefore, when other applications of the service system receive data access requests from the same user again, they no longer need to obtain the user's permission information from the external permission management unit, but can obtain the user's permission information from the shared memory, thereby reducing the impact of single point failures of the external permission management unit on the service system.

[0093] After the target application obtains the permission information, it determines whether the user has the access rights to the target application. If so, the data access request is processed. If not, it can provide feedback to the user that the user does not have the permission and stop processing the data access request.

[0094] In an embodiment of this specification, if a user has access rights to an application, but may not have access rights to certain data, for example, employees in different departments of an enterprise can access the application, but do not have access rights to data in other departments. In view of this situation, according to an embodiment of this specification, the permission information includes application access rights information and data access rights information;

[0095] It can be understood that the embodiments of this specification judge application access rights and data access rights separately, thereby improving flexibility.

[0096] In order to reduce the workload of development, such as Figure 2 As shown, judging whether the user has access rights to the target application according to the permission information, and if so, processing the data access request further includes:

[0097] Step 201: determining whether the user has access rights to the target application according to the application access rights information;

[0098] Step 202: If yes, concatenate the data access permission information with the first SQL statement in the data access request for accessing the database of the service system to obtain a second SQL statement and execute it, and return the execution result of the second SQL statement to the user.

[0099] In an embodiment of the present specification, application access permission information includes all application information with access permission corresponding to user information. The application information may be an application identifier. When determining whether a user has access permission to a target application, the application identifier of the target application may be searched in the application access permission information corresponding to the user information. If found, it indicates that the user has access permission to the target application. Otherwise, the user does not have access permission to the target application.

[0100] If the user has access rights to the target application, then the data access request will continue to be processed; if not, then the data access request will stop being processed.

[0101] In the embodiment of the present specification, the user's data access request includes a first SQL statement for accessing the database of the service system, which includes a target table name and a target field name. When the user has access rights to the target application, the embodiment of the present specification concatenates the user's data access rights information with the first SQL statement to obtain a second SQL statement, executes the second SQL statement to query from the database, and returns the execution result of the second SQL statement to the user.

[0102] Specifically, the data access permission information includes target organization information corresponding to the user information.

[0103] In this embodiment of the specification, the organization information may include the department information to which the user belongs.

[0104] The data access permission information is concatenated with the first SQL statement in the data access request for accessing the database in the service system to obtain the second SQL statement, which further includes:

[0105] The target organization information is concatenated with the first SQL statement to obtain the second SQL statement.

[0106] The first SQL statement includes the target table name and target field name accessed by the data access request;

[0107] The target organization information is concatenated with the first SQL statement to obtain the second SQL statement further comprising:

[0108] The target organization information is concatenated with the target table name and the target field name in the first SQL statement to obtain the second SQL statement.

[0109] It can be understood that the embodiment of this specification concatenates the department information to which the user belongs with the target table name and target field name in the first SQL statement to obtain the second SQL statement. In addition to the target table name and target field name, the second SQL statement also includes the department information to which the user belongs, which is equivalent to adding the department information to which the user belongs to the database query condition. Whether a department has access rights to database tables and / or fields is pre-configured, so that access rights to database tables and / or fields for personnel under the department can be controlled.

[0110] Specifically, the format of the database is improved in advance, and each data in the database includes the information of the organization with access rights;

[0111] like Figure 3 As shown, the step of executing the second SQL statement includes:

[0112] Step 301: using the target table name, target field name and target organization information in the second SQL statement as indexes to query from the database;

[0113] Step 302: If data corresponding to the target table name, target field name and target organization information exists in the database, the data is used as a query result and returned to the user.

[0114] It can be understood that after the target organization information is used as a query condition in the SQL statement, when the SQL statement is executed, the data corresponding to the target field name and the target organization information will be searched from the database table corresponding to the target table name of the database. If the data access permission is available, the data can be found. If the data access permission is not available, the data will not be found.

[0115] pass Figure 3 With the method shown, developers no longer need to add judgment codes for data access permission information, but can use the characteristics of the database itself to control data access permissions.

[0116] According to an embodiment of the present specification, if the user information corresponds to multiple target organization information, the data access permission information is concatenated with the first SQL statement in the data access request to access the database in the service system to obtain the second SQL statement, which further includes:

[0117] Concatenate the plurality of target organization information with the first SQL statement to obtain the second SQL statement;

[0118] The step of executing the second SQL statement includes:

[0119] Using the target table name, target field name and multiple target organization information in the second SQL statement as indexes, querying from the database;

[0120] If data corresponding to the target table name, the target field name, and any one of the target organization information exists in the database, the data is used as a query result and returned to the user.

[0121] It can be understood that when a user has access rights to data of multiple departments, the data access rights information includes multiple organization information corresponding to the user information. When splicing with the first SQL statement, the multiple organization information is used as the query condition of the SQL statement according to the grammatical structure of the selected SQL statement. When executing the second SQL statement, the data corresponding to the target field name and any one of the multiple target organization information is searched from the database table corresponding to the target table name of the database. If the user has data access rights, the data can be found. If the user does not have data access rights, the data cannot be found.

[0122] According to an embodiment of the present specification, in order to facilitate flexible configuration of permissions for users, the permission information also includes a whitelist of application access permissions;

[0123] Determining whether the user has access rights to the target application according to the permission information, and if the user has access rights to the target application, processing the data access request further includes:

[0124] Determine whether the user information belongs to the application access permission whitelist, and if so, process the data access request.

[0125] In the embodiment of the present specification, the user corresponding to the user information in the application access permission whitelist has the permission to access the application. If the user information belongs to the application access permission whitelist, there is no need to determine the application access permission information.

[0126] Furthermore, the permission information also includes a data access permission whitelist;

[0127] Processing the data access request further includes:

[0128] Determine whether the user information belongs to the data access whitelist; if so, execute the first SQL statement and return the execution result of the first SQL statement to the user.

[0129] In the embodiments of the present specification, the data access whitelist includes user information, or a correspondence between user information and a table name, indicating that the user has the authority to access data in a database table corresponding to the corresponding table name.

[0130] If the user information belongs to the data access whitelist, the first SQL statement is directly executed to query the data in the database to obtain the execution result of the first SQL statement.

[0131] In the embodiments of this specification, the permission information of users under each application is cached in the shared memory. The application that first receives a data access request from a user obtains the permission information of the user from the permission management unit and caches it in the shared memory. When other applications receive the data access request for their own applications again, the application reads the permission information of the user from the shared memory instead of obtaining it from the permission management unit again. After the permission information of the user is updated in the permission management unit, the permission information cached in the shared memory becomes invalid, and the permission information corresponding to the user needs to be deleted from the shared memory.

[0132] Because multiple applications can access data in the shared memory, in order to avoid management confusion of cache information in the shared memory, in the embodiment of this specification, only the application that caches permission information in the shared memory is allowed to maintain the permission information in the shared memory, and other applications only have read permission.

[0133] According to an embodiment of the present specification, in order to increase the flexibility of access permission control, the embodiment of the present specification can also execute a predetermined rule on the first SQL statement to determine whether to release. Specifically, when the user sends a data access request to the target application in the service system, the method further includes:

[0134] According to a predetermined rule, it is determined whether the first SQL statement in the data access request for accessing the database of the service system is released. If it is released, the first SQL statement is directly executed and the execution result of the first SQL statement is returned to the user.

[0135] In the embodiments of the present specification, for example, for administrators and other personnel who can access all data, developers can write predetermined rules based on the particularity of the first SQL statement of these personnel who can access all data. If the first SQL statement in the data access request is judged to be released according to the predetermined rules, the step of judging the permission information is no longer performed, and the first SQL statement is directly executed.

[0136] Specifically, Figure 4 As shown, when the target application obtains the permission information corresponding to the user information from the permission management unit, the method further includes:

[0137] Step 401: The permission management unit records the corresponding relationship between the target application and the user information;

[0138] Step 402: When the permission information corresponding to the user information in the permission management unit is updated, the permission management unit sends a notification message to the target application corresponding to the user information, wherein the notification message includes the user information of the updated permission information;

[0139] Step 403: After receiving the notification message, the target application deletes the permission information corresponding to the user information from the shared memory.

[0140] In the embodiment of this specification, the permission management unit records the correspondence between the application that obtains the permission information and the corresponding user information, and when the permission information is updated, notifies the corresponding application to delete the permission information corresponding to the user information from the shared memory of the service system. When the application or other applications in the service system receive a data access request from the user corresponding to the user information again, the application or other applications will re-acquire the permission information corresponding to the user information from the permission management unit.

[0141] According to an embodiment of the present specification, in order to avoid excessive permission information cached in the shared memory and affecting the operation of the service system, the embodiment of the present specification further provides a cache deletion mechanism. Specifically, when the target application obtains the permission information from the shared memory, the method further includes:

[0142] An access timestamp corresponding to the permission information in the shared memory is updated so that an application that caches the permission information in the shared memory determines whether to delete the permission information cached in the shared memory according to the access timestamp.

[0143] It can be understood that when an application obtains permission information from the shared memory, the access timestamp corresponding to the permission information will be updated. The application that caches the permission information in the shared memory will determine whether to delete the permission information cached in the shared memory based on the access timestamp.

[0144] Specifically, the application that caches the permission information in the shared memory determines whether to delete the permission information cached in the shared memory according to the access timestamp, including:

[0145] The application that caches the permission information into the shared memory obtains the access timestamp of the permission information cached into the shared memory according to a predetermined period, and determines whether the difference between the access timestamp and the current time exceeds a threshold. If so, the permission information is deleted from the shared memory.

[0146] It can be understood that the access timestamp can indicate the frequency of obtaining permission information, reflecting the frequency of the user corresponding to the permission information accessing the service system. If the frequency is low, the permission information of the user cached in the shared memory can be deleted, thereby freeing up the shared memory space.

[0147] Based on the same inventive concept, an embodiment of this specification also provides a distributed authentication and authority management device, which is applied to a service system. A plurality of applications are deployed in the service system, and the distributed authentication and authority management device is deployed in the applications.

[0148] like Figure 5 As shown, the device comprises:

[0149] A user information parsing unit 501, configured to, when a user sends a data access request to a target application in the service system, cause the target application to parse the data access request and obtain user information;

[0150] The permission information acquisition unit 502 is used to determine whether the permission information corresponding to the user information is cached in the shared memory of the service system; when the permission information corresponding to the user information is not cached in the shared memory of the service system, the permission information corresponding to the user information is acquired from an external permission management unit and cached in the shared memory; otherwise, the permission information is acquired from the shared memory;

[0151] The access request processing unit 503 is used to determine whether the user has access rights to the target application according to the permission information, and if so, process the data access request.

[0152] Further, the permission information includes application access permission information and data access permission information;

[0153] Determining whether the user has access rights to the target application according to the permission information, and if the user has access rights to the target application, processing the data access request further includes:

[0154] Determining whether the user has access rights to the target application according to the application access rights information;

[0155] If so, the data access permission information is concatenated with the first SQL statement in the data access request for accessing the database of the service system to obtain a second SQL statement and execute it, and the execution result of the second SQL statement is returned to the user.

[0156] Furthermore, the data access permission information includes target organization information corresponding to the user information;

[0157] The data access permission information is concatenated with the first SQL statement in the data access request for accessing the database in the service system to obtain the second SQL statement, which further includes:

[0158] The target organization information is concatenated with the first SQL statement to obtain the second SQL statement.

[0159] Furthermore, the first SQL statement includes a target table name and a target field name accessed by the data access request;

[0160] The target organization information is concatenated with the first SQL statement to obtain the second SQL statement further comprising:

[0161] The target organization information is concatenated with the target table name and the target field name in the first SQL statement to obtain the second SQL statement.

[0162] Furthermore, each piece of data in the database includes information of organizations with access rights;

[0163] The step of executing the second SQL statement includes:

[0164] Using the target table name, target field name and target organization information in the second SQL statement as indexes, querying from the database;

[0165] If data corresponding to the target table name, target field name and target organization information exists in the database, the data is used as a query result and returned to the user.

[0166] Furthermore, if the user information corresponds to multiple target organization information, the data access permission information is concatenated with the first SQL statement in the data access request for accessing the database in the service system to obtain the second SQL statement, which further includes:

[0167] Concatenate the plurality of target organization information with the first SQL statement to obtain the second SQL statement;

[0168] The step of executing the second SQL statement includes:

[0169] Using the target table name, target field name and multiple target organization information in the second SQL statement as indexes, querying from the database;

[0170] If data corresponding to the target table name, the target field name, and any one of the target organization information exists in the database, the data is used as a query result and returned to the user.

[0171] Furthermore, the permission information also includes a whitelist of application access permissions;

[0172] Determining whether the user has access rights to the target application according to the permission information, and if the user has access rights to the target application, processing the data access request further includes:

[0173] Determine whether the user information belongs to the application access permission whitelist, and if so, process the data access request.

[0174] Furthermore, the permission information also includes a data access permission whitelist;

[0175] Processing the data access request further includes:

[0176] Determine whether the user information belongs to the data access whitelist; if so, execute the first SQL statement and return the execution result of the first SQL statement to the user.

[0177] Furthermore, the device also includes a first SQL statement judgment unit, which is used to judge whether the first SQL statement for accessing the database of the service system in the data access request is released according to predetermined rules when the user sends a data access request to the target application in the service system. If it is released, the first SQL statement is directly executed and the execution result of the first SQL statement is returned to the user.

[0178] Further, when the target application obtains the permission information corresponding to the user information from the permission management unit, the permission management unit records the corresponding relationship between the target application and the user information;

[0179] When the permission information corresponding to the user information in the permission management unit is updated, the permission management unit sends a notification message to the target application corresponding to the user information, wherein the notification message includes the user information of the updated permission information;

[0180] After receiving the notification message, the target application deletes the permission information corresponding to the user information from the shared memory.

[0181] Furthermore, the device also includes a cache deletion unit, which is used to update the access timestamp corresponding to the permission information in the shared memory when the target application obtains the permission information from the shared memory, so that the application that caches the permission information in the shared memory can determine whether to delete the permission information cached in the shared memory based on the access timestamp.

[0182] Further, the application that caches the permission information in the shared memory determines whether to delete the permission information cached in the shared memory according to the access timestamp, including:

[0183] The application that caches the permission information into the shared memory obtains the access timestamp of the permission information cached into the shared memory according to a predetermined period, and determines whether the difference between the access timestamp and the current time exceeds a threshold. If so, the permission information is deleted from the shared memory.

[0184] Since the principle of solving the problem by the above device is similar to that of the above method, the implementation of the above system can refer to the implementation of the above method, and the repeated parts will not be repeated.

[0185] like Figure 6 The figure is a schematic diagram of the structure of the computer device in the embodiment of this specification. The method in the embodiment of this specification can be applied to the computer device in this embodiment.

[0186] The computer device 602 may include one or more processors 604, such as one or more central processing units (CPUs), each of which may implement one or more hardware threads. The computer device 602 may also include any memory 606 for storing any type of information such as code, settings, data, etc. Without limitation, for example, the memory 606 may include any one or more combinations of the following: any type of RAM, any type of ROM, a flash memory device, a hard disk, an optical disk, etc. More generally, any storage resource may use any technology to store information.

[0187] Further, any storage resource may provide volatile or non-volatile retention of information.

[0188] Further, any storage resource may represent a fixed or removable component of the computer device 602. In one case, when the processor 604 executes the associated instructions stored in any storage resource or combination of storage resources, the computer device 602 may perform any operation of the associated instructions. The computer device 602 also includes one or more drive mechanisms 608 for interacting with any storage resource, such as a hard disk drive system, an optical disk drive system, etc.

[0189] The computer device 602 may also include an input / output module 610 (I / O) for receiving various inputs (via input devices 612) and for providing various outputs (via output devices 614). A specific output mechanism may include a presentation device 616 and an associated graphical user interface (GUI) 618. In other embodiments, the input / output module 610 (I / O), input device 612, and output device 614 may not be included, and the computer device 602 may be used as a computer device in a network. The computer device 602 may also include one or more network interfaces 620 for exchanging data with other devices via one or more communication links 622. One or more communication buses 624 couple the components described above together.

[0190] The communication link 622 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 622 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0191] The embodiments of the present specification also provide a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0192] The embodiments of the present specification also provide a computer-readable instruction, wherein when a processor executes the instruction, the program therein causes the processor to execute the above method.

[0193] It should be understood that in the various embodiments of the present specification, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present specification.

[0194] It should also be understood that in the embodiments of this specification, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in the embodiments of this specification generally indicates that the associated objects before and after are in an "or" relationship.

[0195] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of this specification can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiments of this specification.

[0196] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0197] In the several embodiments provided in the embodiments of this specification, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

[0198] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this specification.

[0199] In addition, each functional unit in each embodiment of the present specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0200] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of this specification is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the embodiment of this specification. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0201] The embodiments of this specification use specific embodiments to illustrate the principles and implementation methods of the embodiments of this specification. The description of the above embodiments is only used to help understand the methods and core ideas of the embodiments of this specification. At the same time, for those skilled in the art, according to the ideas of the embodiments of this specification, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the embodiments of this specification.

Claims

1. A distributed authentication and rights management method, characterized in that: Applied to a service system, wherein a plurality of applications are deployed in the service system and executed by the applications, the method comprises: When a user sends a data access request to a target application in the service system, the target application parses the data access request to obtain user information; Determining whether permission information corresponding to the user information is cached in the shared memory of the service system; If not, obtaining the permission information corresponding to the user information from an external permission management unit and caching the permission information in the shared memory; if so, obtaining the permission information from the shared memory; It is determined whether the user has access rights to the target application according to the permission information, and if so, the data access request is processed.

2. The method according to claim 1, characterized in that The permission information includes application access permission information and data access permission information; Determining whether the user has access rights to the target application according to the permission information, and if the user has access rights to the target application, processing the data access request further includes: Determining whether the user has access rights to the target application according to the application access rights information; If so, the data access permission information is concatenated with the first SQL statement in the data access request for accessing the database of the service system to obtain a second SQL statement, execute the statement, and return the execution result of the second SQL statement to the user.

3. The method according to claim 2, characterized in that The data access permission information includes target organization information corresponding to the user information; The data access permission information is concatenated with the first SQL statement in the data access request for accessing the database in the service system to obtain the second SQL statement, which further includes: The target organization information is concatenated with the first SQL statement to obtain the second SQL statement.

4. The method according to claim 3, characterized in that The first SQL statement includes the target table name and target field name accessed by the data access request; The target organization information is concatenated with the first SQL statement to obtain the second SQL statement further comprising: The target organization information is concatenated with the target table name and the target field name in the first SQL statement to obtain the second SQL statement.

5. The method according to claim 4, characterized in that Each piece of data in the database includes information of organizations with access rights; The step of executing the second SQL statement includes: Using the target table name, target field name and target organization information in the second SQL statement as indexes, querying from the database; If data corresponding to the target table name, target field name and target organization information exists in the database, the data is used as a query result and returned to the user.

6. The method according to claim 4, characterized in that If the user information corresponds to multiple target organization information, the data access permission information is concatenated with the first SQL statement in the data access request to access the database in the service system to obtain the second SQL statement, which further includes: Concatenate the plurality of target organization information with the first SQL statement to obtain the second SQL statement; The step of executing the second SQL statement includes: Using the target table name, target field name and multiple target organization information in the second SQL statement as indexes, querying from the database; If data corresponding to the target table name, the target field name, and any one of the target organization information exists in the database, the data is used as a query result and returned to the user.

7. The method according to claim 2, characterized in that The permission information also includes a whitelist of application access permissions; Determining whether the user has access rights to the target application according to the permission information, and if the user has access rights to the target application, processing the data access request further includes: Determine whether the user information belongs to the application access permission whitelist, and if so, process the data access request.

8. The method according to claim 7, characterized in that The permission information also includes a whitelist of data access permissions; Processing the data access request further includes: Determine whether the user information belongs to the data access whitelist; if so, execute the first SQL statement and return the execution result of the first SQL statement to the user.

9. The method according to claim 1, characterized in that: When the user sends a data access request to the target application in the service system, the method further includes: According to a predetermined rule, it is determined whether the first SQL statement in the data access request for accessing the database of the service system is released. If it is released, the first SQL statement is directly executed and the execution result of the first SQL statement is returned to the user.

10. The method according to claim 1, characterized in that When the target application obtains the permission information corresponding to the user information from the permission management unit, the method further includes: The permission management unit records the corresponding relationship between the target application and the user information; When the permission information corresponding to the user information in the permission management unit is updated, the permission management unit sends a notification message to the target application corresponding to the user information, wherein the notification message includes the user information of the updated permission information; After receiving the notification message, the target application deletes the permission information corresponding to the user information from the shared memory.

11. The method according to claim 1, characterized in that: When the target application obtains the permission information from the shared memory, the method further includes: An access timestamp corresponding to the permission information in the shared memory is updated so that an application that caches the permission information in the shared memory determines whether to delete the permission information cached in the shared memory according to the access timestamp.

12. The method according to claim 11, characterized in that The application that caches the permission information into the shared memory determines whether to delete the permission information cached in the shared memory according to the access timestamp, including: The application that caches the permission information into the shared memory obtains the access timestamp of the permission information cached into the shared memory according to a predetermined period, and determines whether the difference between the access timestamp and the current time exceeds a threshold. If so, the permission information is deleted from the shared memory.

13. A distributed authentication and rights management device, characterized in that: Applied to a service system, wherein a plurality of applications are deployed in the service system, wherein the distributed authentication and authority management device is deployed in the application, and the device comprises: A user information parsing unit, configured to, when a user sends a data access request to a target application in the service system, cause the target application to parse the data access request and obtain user information; a permission information acquisition unit, configured to determine whether the permission information corresponding to the user information is cached in the shared memory of the service system; when the permission information corresponding to the user information is not cached in the shared memory of the service system, acquire the permission information corresponding to the user information from an external permission management unit and cache the permission information in the shared memory; otherwise, acquire the permission information from the shared memory; The access request processing unit is used to determine whether the user has access rights to the target application according to the permission information, and if so, process the data access request.

14. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 12 is implemented.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

16. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

Images