Resource access authority management method and device, storage medium and electronic equipment

Abstract

The invention provides a resource access authority management method and device, a storage medium and electronic equipment, and belongs to the technical field of computers. The resource access authority management method comprises the steps that a user access resource request and current user authority information are acquired, and the current user authority is determined from a preset authority storage database based on a user login request; on the basis of the current user permission information, checking whether a current user has a resource access permission corresponding to the user resource access request; determining a corresponding resource service node based on the user access resource request under the condition that the current user is determined to have the access resource permission corresponding to the user access resource request; and the resource service node responds to the user access resource request. Unified authority management is realized, authority authentication is unified to a platform layer, authentication link logic of each system is reduced, platform application unification is facilitated, and the integration capability of the platform is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a resource access permission management method, a resource access permission management device, a machine-readable storage medium and an electronic device. Background Art

[0002] In the process of software system construction, permission management and verification are widely used technologies. Permission management and verification need to be implemented in each system. In the process of implementation of each system, the implementation methods are not unified. In the process of software platform construction, it is necessary to consider the issues of permission management and verification. If permission management and verification cannot be implemented uniformly at the platform level, permission information will be scattered in various systems, permission logic will be inconsistent, and it will be difficult to maintain and manage. Implementing unified permission management and verification at the platform level is one of the key tasks that platform products need to consider.

[0003] The goals of permission management are divided into: resource definition, role definition, and permission definition. The combination of the three completes the permission setting in the software. The existing permission management and control implementation logic is placed in each subsystem. However, the implementation schemes in each subsystem are different. Users' function call requests to the system need to complete permission verification separately, and seamless compatibility cannot be achieved between various systems. After the subsystem is integrated into the platform, the issue of permission verification needs to be considered, which makes the software platform construction process complicated and the application scenario implementation difficult. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a resource access permission management method, a resource access permission management device, a machine-readable storage medium and an electronic device. The resource access permission management method realizes unified permission management, reduces the authentication link logic of each system, is conducive to unified platform application, and improves the platform integration capability.

[0005] In order to achieve the above-mentioned purpose, the first aspect of the present application provides a resource access rights management method, comprising: Obtaining a user's resource access request and current user authority information, wherein the current user authority is determined from a preset authority storage database based on the user's login request; Based on the current user authority information, verify whether the current user has the resource access authority corresponding to the user resource access request; In the case of determining that the current user has the resource access authority corresponding to the user resource access request, determining the corresponding resource service node based on the user resource access request; The resource service node responds to the user's request to access resources.

[0006] In the embodiment of the present application, the checking, based on the current user permission information, whether the current user has the resource access permission corresponding to the user resource access request includes: Determine the requesting user based on the token in the user's request to access the resource; Based on the requesting user, query the current user authority information to obtain a query result; Based on the query result, it is determined whether the current user has the resource access permission corresponding to the user resource access request.

[0007] In the embodiment of the present application, obtaining the current user authority information includes: Get user login request; Based on the user login request, current user authority information is determined from a preset authority storage database, and the current user authority information is loaded into a authority cache node.

[0008] In an embodiment of the present application, the authority cache node includes an authority cache master node and at least one authority cache slave node; The step of loading the current user authority information into the authority cache node includes: Loading the current user authority information to the authority cache master node; Based on a preset node synchronization mechanism, the current user authority information is synchronized to each authority cache slave node.

[0009] In the embodiment of the present application, obtaining a user access resource request includes: The application gateway obtains the user's request to access resources; The verifying, based on the current user authority information, whether the current user has the resource access authority corresponding to the user resource access request includes: The application gateway sends the user resource access request to the authority cache node; The permission cache node verifies, based on the current user permission information, whether the current user has the resource access permission corresponding to the user resource access request.

[0010] In the embodiment of the present application, determining the requesting user based on the token in the user's resource access request includes: Determine whether the token in the user's resource access request is valid; When it is determined that the token in the user's request to access the resource is valid, the requesting user is determined based on the token.

[0011] A second aspect of the present application provides a resource access permission management platform for implementing the above-mentioned resource access permission management method.

[0012] A third aspect of the present application provides a resource access permission management device, comprising: An acquisition module is used to acquire a user's resource access request and current user authority information, wherein the current user authority is determined from a preset authority storage database based on the user's login request; A verification module, used to verify whether the current user has the resource access authority corresponding to the user resource access request based on the current user authority information; A determination module, configured to determine a corresponding resource service node based on the user resource access request when it is determined that the current user has the resource access authority corresponding to the user resource access request; The response module is used for the resource service node to respond to the user's request for accessing resources.

[0013] A fourth aspect of the present application provides an electronic device, the electronic device comprising: at least one processor; a memory connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the above-mentioned resource access permission management method by executing the instructions stored in the memory.

[0014] A fifth aspect of the present application provides a machine-readable storage medium having instructions stored thereon, which, when executed by a processor, configures the processor to execute the above-mentioned resource access permission management method.

[0015] Through the above technical solution, by obtaining the user's access resource request and the current user's permission information, the current user's permission is determined from the preset permission storage database based on the user's login request; based on the current user's permission information, verify whether the current user has the access resource permission corresponding to the user's access resource request; in the case of determining that the current user has the access resource permission corresponding to the user's access resource request, determine the corresponding resource service node based on the user's access resource request; and the resource service node responds to the user's access resource request. By placing permission management and permission verification on the platform layer, the permissions and verification permissions are uniformly managed within the platform, and each subsystem within the platform does not need to consider permission issues. The function requests sent to the subsystem are all valid and legal requests, and a response can be directly provided. The problem of permission management and permission verification is solved at the subsystem level, and the platform's management and control capabilities are improved. Unified permission management is achieved, and permission authentication is unified to the platform layer, reducing the authentication link logic of each system, which is conducive to unified platform applications and improving the platform's integration capabilities. Especially for the application scenarios of microservice cloud platforms, trivial permission management logic can be separated from the development of each microservice, so that developers can focus on the development of the core business service capabilities of the microservice itself.

[0016] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings: Figure 1 A schematic diagram of a process flow of a resource access rights management method according to an embodiment of the present application is shown; Figure 2 The schematic diagram schematically shows the principle of the resource access permission management method according to the embodiment of the present application; Figure 3 A schematic diagram of a cluster deployment architecture according to an embodiment of the present application is shown; Figure 4 A schematic diagram of a logic flow chart for implementing resource access permission management according to an embodiment of the present application is shown; Figure 5 A diagram schematically shows a specific implementation relationship diagram of resource access permission management according to an embodiment of the present application; Figure 6 A schematic diagram of the overall system framework for resource access permission management according to an embodiment of the present application is shown; Figure 7A schematic diagram of the structure of a resource access permission management device according to an embodiment of the present application is shown; Figure 8 The internal structure diagram of a computer device according to an embodiment of the present application is schematically shown.

[0018] Description of Reference Numerals 410 - acquisition module; 420 - verification module; 430 - determination module; 440 - response module; A01 - processor; A02 - network interface; A03 - internal memory; A04 - display screen; A05 - input device; A06 - non-volatile storage medium; B01 - operating system; B02 - computer program. DETAILED DESCRIPTION

[0019] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0020] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back...), such directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0021] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0022] Please see Figure 1 and Figure 2 , Figure 1 The following is a schematic diagram showing a process flow of a method for managing resource access rights according to an embodiment of the present application. Figure 2The schematic diagram of the principle of the resource access permission management method according to the embodiment of the present application is schematically shown. This embodiment provides a resource access permission management method, which puts permission management and permission verification at the platform layer, uniformly manages permissions and verifies permissions within the platform, and each subsystem within the platform does not need to consider permission issues. Function requests sent to the subsystem are all valid and legal requests, and a response can be directly provided. The resource access permission management method includes the following steps: Step 210: Obtain the user's resource access request and current user authority information, where the current user authority is determined from a preset authority storage database based on the user's login request; In this embodiment, the above-mentioned user access resource request can be initiated by the user end through the logged-in user when the user needs to access the resource. The user end, as the end user of the platform, manages the platform and calls various functions in the platform through login and access. The above-mentioned user access resource request will carry a login token for request. The above-mentioned current user permission information can be obtained by caching all permission information of the currently logged-in user by triggering the permission cache node through the user login function when the user logs in. The above-mentioned preset permission storage database stores access rights for various resources, including resource access rights information corresponding to each user. The permission setting information includes user information, role information and permission information, which can be obtained by saving the permission setting information to the permission storage database through the user end permission management operation.

[0023] In some embodiments, obtaining current user authority information includes: First, get the user login request; Then, based on the user login request, the current user authority information is determined from a preset authority storage database, and the current user authority information is loaded into the authority cache node.

[0024] In this embodiment, the permission cache node may be triggered by the user login function to cache all permission information of the currently logged-in user, and the permission information of the current user may be loaded into the permission cache node through caching.

[0025] By loading the current user permission information into the permission cache node when the user logs in, it is convenient to uniformly manage the user's access resource permissions.

[0026] In some embodiments, the permission cache node includes a permission cache master node and at least one permission cache slave node; The step of loading the current user authority information into the authority cache node includes: First, the current user authority information is loaded into the authority cache master node; Then, based on a preset node synchronization mechanism, the current user authority information is synchronized to each authority cache slave node.

[0027] In this embodiment, the original permission information is stored in the permission storage database. When the user logs in to the system, the current user permission information is loaded into the permission cache master node, and the current user permission information is used in the form of cache data in the memory. After loading, the current user permission information of the permission cache master node will be synchronized to each permission cache slave node to cope with large concurrent requests and ensure that the current user permission information can be successfully loaded into the permission cache node.

[0028] For specific implementation, please refer to Figure 3 , Figure 3 The cluster deployment architecture diagram according to the embodiment of the present application is schematically shown. The overall software environment can be deployed in the form of a cluster. In order to improve the response performance, the number of nodes in the permission service slave node cluster can be appropriately increased. According to the concurrent performance response parameters of a single node, the single-node performance index of a certain server hardware configuration scale is evaluated, and the maximum concurrent access scale after the overall platform is launched is estimated. According to the performance index of a single node, a sufficient number of nodes are equipped.

[0029] In some embodiments, obtaining the user access resource request includes: obtaining the user access resource request by an application gateway.

[0030] In this embodiment, the logged-in user initiates a resource access request to the application gateway, and the application gateway determines whether permission verification is required. By obtaining the user's resource access request from the application gateway, identity authentication is facilitated, thereby facilitating resource access permission management.

[0031] Step 220: Based on the current user authority information, verify whether the current user has the resource access authority corresponding to the user resource access request; In this embodiment, the above verification is performed by identifying the user through the token carried in the user's resource access request, and then querying the permissions in the cache.

[0032] Please see Figure 4 , Figure 4 The following schematically shows a logical flow chart of resource access permission management implementation according to an embodiment of the present application. In some embodiments, the step of verifying whether the current user has the resource access permission corresponding to the user's resource access request based on the current user permission information includes: First, based on the token in the user's request to access the resource, the requesting user is determined; In this embodiment, the user end that has completed the login will carry the login token to make a request in the subsequent interaction with the platform permission management end, that is, the user access resource request contains a token. The above token is sent to the user end by the platform when the user logs in. The token can be a string of numbers. The token corresponds to the user role one by one, and the requesting user can be determined based on the token.

[0033] In some embodiments, the determining the requesting user based on the token in the user's request to access a resource includes: The first step is to determine whether the token in the user's resource access request is valid; In the second step, when it is determined that the token in the user's resource access request is valid, the requesting user is determined based on the token.

[0034] In this embodiment, it is possible to determine whether the token is valid, that is, to determine whether the token is legal. The above determination process can be implemented using existing technologies and will not be described in detail here. If the token is valid, the requesting user can be further determined. If the token is invalid, an invalid token response is returned.

[0035] By judging whether the token is valid, and only if the token is valid, determining the requesting user based on the token, efficiency can be improved and reliability can be guaranteed.

[0036] Then, based on the requesting user, query is performed in the current user authority information to obtain a query result; In this embodiment, after the requesting user is determined, it is possible to further query whether the resource access permission of the requesting user is included in the current user permission information, thereby obtaining a query result.

[0037] Finally, based on the query result, it is determined whether the current user has the resource access authority corresponding to the user resource access request.

[0038] In this embodiment, if the query result indicates that there is a corresponding resource access permission, it is determined that the current user has the resource access permission corresponding to the user resource access request; otherwise, it is determined that the current user does not have the resource access permission.

[0039] By identifying the requesting user through the token carried by the user request, and then querying the current user authority information in the cache, it is possible to quickly and accurately determine whether the user has the resource access authority corresponding to the resource access request.

[0040] In some embodiments, the verifying, based on the current user permission information, whether the current user has the resource access permission corresponding to the user resource access request includes: First, the application gateway sends the user resource access request to the authority cache node; Then, the permission cache node verifies whether the current user has the resource access permission corresponding to the user resource access request based on the current user permission information.

[0041] In this embodiment, after the application gateway determines that permission verification is required, it will forward the user's resource access request to the permission verification master node or the permission verification slave node. In this node, based on the current user permission information, it is verified whether the current user has the resource access permission corresponding to the user's resource access request, thereby ensuring unified permission management and control of resource access at the platform entrance.

[0042] Step 230: when it is determined that the current user has the resource access authority corresponding to the user resource access request, determine the corresponding resource service node based on the user resource access request; In this embodiment, if the resource address format to be accessed has the authority, the request is directed to the resource service node in the integrated platform, that is, it is released after the authority is determined. The platform includes service nodes of multiple resource types. When it is determined that the current user has the access resource authority corresponding to the user's resource access request, the service node of the corresponding resource type is determined according to the resource address accessed in the user's resource access request.

[0043] Step 240: The resource service node responds to the user's request to access resources.

[0044] In this embodiment, the specific resource service node responds to the user's resource access request and finally completes the request process. If the resource address format accessed does not have permission, an unauthorized response, such as an error message, will be returned to remind the user.

[0045] In the above implementation process, by obtaining the user's access resource request and the current user's permission information, the current user's permission is determined from the preset permission storage database based on the user's login request; based on the current user's permission information, verify whether the current user has the access resource permission corresponding to the user's access resource request; in the case of determining that the current user has the access resource permission corresponding to the user's access resource request, determine the corresponding resource service node based on the user's access resource request; and the resource service node responds to the user's access resource request. By placing permission management and permission verification on the platform layer, the platform uniformly manages permissions and verifies permissions, and each subsystem in the platform does not need to consider permission issues. Function requests sent to the subsystem are all valid and legal requests, and responses can be provided directly. The problem of permission management and permission verification is solved at the subsystem level, and the platform's management and control capabilities are improved. Unified permission management is achieved, and permission authentication is unified to the platform layer, reducing the authentication link logic of each system, which is conducive to unified platform applications and improving the platform's integration capabilities. Especially for the application scenarios of microservice cloud platforms, trivial permission management logic can be separated from the development of each microservice, so that developers can focus on the development of the core business service capabilities of the microservice itself.

[0046] It should be noted that the implementation of the above method can be based on any specific software development form. Here, one implementation method is used to introduce the method of the present invention. Figure 5 , Figure 5 The specific implementation relationship diagram of resource access rights management according to the embodiment of the present application is schematically shown. Among them, user role management is implemented using the Java framework Springboot, the database uses the PostgreSQL database, the permission cache uses the Java framework Springboot to implement the verification logic, and the data cache uses the redis product, which has the function of multi-node clustering and can realize automatic synchronization of multiple nodes through configuration; the permission verification token uses apisix, and the extension plug-in that comes with the apisix product can realize the identity authentication of the application gateway.

[0047] This embodiment provides a resource access permission management platform, which is used to implement the above-mentioned resource access permission management method.

[0048] In this embodiment, the resource access permission management platform includes a platform layer, an application layer, a data layer, and an integrated system layer. Through a layered design, the management of resources, roles, and permissions is achieved, and the purpose of resource access permission verification is uniformly achieved. Figure 6 , Figure 6The overall system framework diagram of resource access permission management according to an embodiment of the present application is schematically shown, including a platform layer, an application layer, a data layer and an integrated system layer, wherein: Platform layer: The platform layer implements a unified entry for permission management and permission verification. The platform layer defines a unified function call entry, at which the access to resources is uniformly controlled. It serves as a portal for the platform to provide services externally. Its main function is to act as an agent for permission control and specific access content. After completing the permission verification, it will be directed to the entity that actually provides the service and provide services externally.

[0049] Application layer: defines all functional contents of permission management and permission verification. In this layer, the functions are divided into two units: permission management and permission verification. The permission management unit manages the permissions of all roles, functions and data resources in the platform to achieve unified management of permissions in the platform; the permission verification unit implements permission verification for all functions and data access. The related functions include user login, logout and permission loading. In the user login stage, it is necessary to load all the permission information of the user in the platform. Only after the loading is completed can the permission verification of resource templates be performed. In the user logout stage, the corresponding permission resources of the user need to be released. The platform provides services to the outside in the following forms: function call, data access and interface request. The corresponding function permission verification, data permission verification and interface permission verification of the application layer are used. The loaded permission information is used to implement permission verification for resource access. If the permission conditions are met, the request is directed to the subsequent actual function or data implementation entity to provide the actual service. If there is no permission, an error message is returned.

[0050] Data layer: defines the platform permission database, and uniformly records the users, roles, and permissions within the entire platform. The data layer will collect resource information for all integrated systems within the platform through data collection services. Resource information includes two categories: functions and data.

[0051] Integration system layer: This layer defines all business systems integrated into the platform. In each system, the resource information (functions and data) within the system must be described at the data layer or through interfaces according to the platform's integration requirements.

[0052] In the above implementation process, by placing permission management and permission verification at the platform layer, the platform uniformly manages and verifies permissions. Each subsystem in the platform does not need to consider permission issues. Functional requests sent to the subsystem are valid and legal requests, and responses can be provided directly. The problem of permission management and permission verification is solved at the subsystem level, and the platform's management and control capabilities are improved. Unified permission management is achieved, and permission authentication is unified to the platform layer, which reduces the authentication link logic of each system, is conducive to unified platform applications, and improves the platform's integration capabilities. Especially for the application scenarios of microservice cloud platforms, the trivial permission management logic can be separated from the development of each microservice, allowing developers to focus on the development of the core business service capabilities of the microservice itself.

[0053] Please see Figure 7 , Figure 7 The schematic diagram of the structure of a resource access permission management device according to an embodiment of the present application is shown schematically. This embodiment provides a resource access permission management device, including an acquisition module 410, a verification module 420, a determination module 430 and a response module 440, wherein: The acquisition module 410 is used to acquire the user's resource access request and the current user's authority information, wherein the current user's authority is determined from a preset authority storage database based on the user's login request; A verification module 420, configured to verify whether the current user has the resource access authority corresponding to the user resource access request based on the current user authority information; A determination module 430 is used to determine a corresponding resource service node based on the user resource access request when it is determined that the current user has the resource access authority corresponding to the user resource access request; The response module 440 is configured to respond, by the resource service node, to the user's request for accessing resources.

[0054] The resource access permission management device includes a processor and a memory. The acquisition module 410, the verification module 420, the determination module 430 and the response module 440 are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions.

[0055] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and resource access rights are uniformly managed by adjusting kernel parameters.

[0056] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0057] An embodiment of the present invention provides a machine-readable storage medium on which a program is stored. When the program is executed by a processor, the resource access authority management method is implemented.

[0058] An embodiment of the present invention provides a processor, which is used to run a program, wherein the resource access permission management method is executed when the program is running.

[0059] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 8 As shown. The computer device includes a processor A01, a network interface A02, a display screen A04, an input device A05 and a memory (not shown in the figure) connected through a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A06. The non-volatile storage medium A06 stores an operating system B01 and a computer program B02. The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A06. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor A01, a resource access permission management method is implemented. The display screen A04 of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device A05 of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse, etc.

[0060] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0061] In one embodiment, the resource access permission management method and apparatus provided in the present application can be implemented in the form of a computer program. The computer program can be Figure 8 The memory of the computer device may store various program modules constituting the resource access permission management device, for example, Figure 7 The acquisition module 410, the verification module 420, the determination module 430 and the response module 440 are shown. The computer program composed of various program modules enables the processor to execute the steps of the resource access permission management method of each embodiment of the present application described in this specification.

[0062] Figure 8 The computer device shown can be Figure 7 The acquisition module 410 in the resource access permission management method and apparatus shown executes step 210. The computer device may execute step 220 through the verification module 420. The computer device may execute step 230 through the determination module 430. The computer device may execute step 240 through the response module 440.

[0063] An embodiment of the present application provides an electronic device, the electronic device comprising: at least one processor; a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, the at least one processor implements the above-mentioned resource access permission management method by executing the instructions stored in the memory, and the processor implements the following steps when executing the instructions: Obtaining a user's resource access request and current user authority information, wherein the current user authority is determined from a preset authority storage database based on the user's login request; Based on the current user authority information, verify whether the current user has the resource access authority corresponding to the user resource access request; In the case of determining that the current user has the resource access authority corresponding to the user resource access request, determining the corresponding resource service node based on the user resource access request; The resource service node responds to the user's request to access resources.

[0064] In one embodiment, the verifying, based on the current user permission information, whether the current user has the resource access permission corresponding to the user resource access request includes: Determine the requesting user based on the token in the user's request to access the resource; Based on the requesting user, query the current user authority information to obtain a query result; Based on the query result, it is determined whether the current user has the resource access permission corresponding to the user resource access request.

[0065] In one embodiment, obtaining the current user authority information includes: Get user login request; Based on the user login request, current user authority information is determined from a preset authority storage database, and the current user authority information is loaded into a authority cache node.

[0066] In one embodiment, the permission cache node includes a permission cache master node and at least one permission cache slave node; The step of loading the current user authority information into the authority cache node includes: Loading the current user authority information to the authority cache master node; Based on a preset node synchronization mechanism, the current user authority information is synchronized to each authority cache slave node.

[0067] In one embodiment, obtaining a user's request to access a resource includes: The application gateway obtains the user's request to access resources; The verifying, based on the current user authority information, whether the current user has the resource access authority corresponding to the user resource access request includes: The application gateway sends the user resource access request to the authority cache node; The permission cache node verifies, based on the current user permission information, whether the current user has the resource access permission corresponding to the user resource access request.

[0068] In one embodiment, determining the requesting user based on the token in the user's request to access a resource includes: Determine whether the token in the user's resource access request is valid; When it is determined that the token in the user's request to access the resource is valid, the requesting user is determined based on the token.

[0069] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0070] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0071] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0072] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0073] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0074] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0075] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0076] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0077] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for managing resource access rights, characterized in that: include: Obtaining a user's resource access request and current user authority information, wherein the current user authority is determined from a preset authority storage database based on the user's login request; Based on the current user authority information, verify whether the current user has the resource access authority corresponding to the user resource access request; In the case of determining that the current user has the resource access authority corresponding to the user resource access request, determining the corresponding resource service node based on the user resource access request; The resource service node responds to the user's request to access resources.

2. The resource access permission management method according to claim 1, characterized in that: The verifying, based on the current user authority information, whether the current user has the resource access authority corresponding to the user resource access request includes: Determine the requesting user based on the token in the user's request to access the resource; Based on the requesting user, query the current user authority information to obtain a query result; Based on the query result, it is determined whether the current user has the resource access permission corresponding to the user resource access request.

3. The resource access permission management method according to claim 1, characterized in that: Get the current user permission information, including: Get user login request; Based on the user login request, current user authority information is determined from a preset authority storage database, and the current user authority information is loaded into a authority cache node.

4. The resource access permission management method according to claim 3, characterized in that: The authority cache node includes an authority cache master node and at least one authority cache slave node; The step of loading the current user authority information into the authority cache node includes: Loading the current user authority information to the authority cache master node; Based on a preset node synchronization mechanism, the current user authority information is synchronized to each authority cache slave node.

5. The resource access permission management method according to claim 3, characterized in that: The obtaining of a user's request to access a resource comprises: The application gateway obtains the user's request to access resources; The verifying, based on the current user authority information, whether the current user has the resource access authority corresponding to the user resource access request includes: The application gateway sends the user resource access request to the authority cache node; The permission cache node verifies, based on the current user permission information, whether the current user has the resource access permission corresponding to the user resource access request.

6. The resource access permission management method according to claim 2, characterized in that: The determining the requesting user based on the token in the user's resource access request includes: Determine whether the token in the user's resource access request is valid; When it is determined that the token in the user's request to access the resource is valid, the requesting user is determined based on the token.

7. A resource access rights management platform, characterized in that: Used to implement the resource access permission management method described in any one of claims 1-6.

8. A resource access rights management device, characterized in that: include: An acquisition module is used to acquire a user's resource access request and current user authority information, wherein the current user authority is determined from a preset authority storage database based on the user's login request; A verification module, used to verify whether the current user has the resource access authority corresponding to the user resource access request based on the current user authority information; A determination module, configured to determine a corresponding resource service node based on the user resource access request when it is determined that the current user has the resource access authority corresponding to the user resource access request; The response module is used for the resource service node to respond to the user's request for accessing resources.

9. An electronic device, characterized in that: The electronic device includes: at least one processor; a memory connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the resource access permission management method according to any one of claims 1 to 6 by executing the instructions stored in the memory.

10. A machine-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor is configured to execute the resource access permission management method according to any one of claims 1 to 6.

Images