Authentication method, device, system, equipment, medium and product

Abstract

The embodiment of the invention provides an authentication method, device and system, equipment, a medium and a product. The method comprises the steps of performing resource classification based on a data type and a resource access type of each resource in a lower engine layer to obtain a data type and a resource access type to which each resource belongs; analyzing the access request to be authenticated, and determining a target data category and a target resource access category corresponding to a target resource to be accessed by the access request; determining a target resource to be accessed by the access request based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and the target resource access category; and determining a target authentication strategy corresponding to the access request according to a mapping relationship between a pre-configured resource and an authentication strategy and a target resource to be accessed by the access request, and authenticating the access request to be authenticated based on the target authentication strategy. According to the embodiment of the invention, unified authentication of the access request is realized through the authentication engine layer.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of authority authentication, and in particular, to an authentication method, apparatus, system, device, medium and product. Background Art

[0002] At present, vehicle intelligence has become increasingly popular among automobile companies. Vehicle intelligence relies on a large amount of data transmitted from sensors on the vehicle. In this context, it is necessary for automobile companies to establish their own big data platforms. The big data platforms of automobile companies integrate a variety of data, including business data, transaction data, user data, logs, historical data, and other types of data, which are gradually imported into the big data platform for analysis and prediction. As the types of imported data increase and the amount of data increases, the data involved in the big data platform becomes more sensitive, and data security becomes particularly important.

[0003] Therefore, it is necessary to manage the authentication policy of the big data platform through the authentication platform to improve the security of the data in the big data platform. The authentication platform needs to independently manage the authentication policies corresponding to each data in the big data platform, which disperses the authority management energy of the authentication platform, resulting in reduced authentication efficiency, and the authentication policies corresponding to each data in the big data platform cannot be interoperable. When the authentication platform cannot effectively match the authentication policies of each data in the big data platform with the access request, it may also lead to reduced authentication accuracy, increase the risk of data leakage in the big data platform, and reduce the security of the big data platform. How to build a unified authentication system has become an urgent problem to be solved. Summary of the invention

[0004] In view of this, embodiments of the present application provide an authentication method, apparatus, system, device, medium and product to achieve unified authentication of access requests.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] According to a first aspect of an embodiment of the present application, an authentication method is provided, which is applied to an authentication engine layer, and the method includes:

[0007] Classify resources based on the data type of each resource in the lower engine layer to obtain the data category to which each resource belongs; classify resources based on the resource access type of each resource in the lower engine layer to obtain the resource access category to which each resource belongs;

[0008] Parse the access request to be authenticated, determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request; and determine the target resource to be accessed by the access request based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and the target resource access category;

[0009] According to the mapping relationship between the pre-configured resources and the authentication policies, and the target resource to be accessed by the access request, the target authentication policy corresponding to the access request is determined, and the access request to be authenticated is authenticated based on the target authentication policy.

[0010] According to a second aspect of an embodiment of the present application, an authentication device is provided, which is applied to an authentication engine layer, and the device includes:

[0011] The classification module is used to classify resources based on the data type of each resource in the lower engine layer to obtain the data category to which each resource belongs; classify resources based on the resource access type of each resource in the lower engine layer to obtain the resource access category to which each resource belongs;

[0012] A parsing module, used to parse the access request to be authenticated, determine the target data category and the target resource access category corresponding to the target resource to be accessed by the access request; and determine the target resource to be accessed by the access request based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and the target resource access category;

[0013] The authentication module is used to determine the target authentication policy corresponding to the access request according to the mapping relationship between the pre-configured resources and the authentication policy, and the target resource to be accessed by the access request, and authenticate the access request to be authenticated based on the target authentication policy.

[0014] According to a third aspect of an embodiment of the present application, an authentication system is provided, including:

[0015] The authority management center is used to configure authentication policies for each resource based on the authority configuration requirements of each resource in the lower engine layer, and store the mapping relationship between each resource and the authentication policy;

[0016] The authentication engine layer is used to classify resources based on the data type of each resource in the lower engine layer to obtain the data category to which each resource belongs; classify resources based on the resource access type of each resource in the lower engine layer to obtain the resource access category to which each resource belongs; parse the access request to be authenticated to determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request; and determine the target resource to be accessed by the access request based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and the target resource access category; determine the target authentication policy corresponding to the access request based on the mapping relationship between the pre-configured resources and the authentication policy, and the target resource to be accessed by the access request, and authenticate the access request to be authenticated based on the target authentication policy.

[0017] According to a fourth aspect of an embodiment of the present application, there is provided an electronic device, including:

[0018] A memory for storing executable instructions;

[0019] The processor is used to implement the authentication method as described in the first aspect above when executing the executable instructions stored in the memory.

[0020] According to a fifth aspect of an embodiment of the present application, a computer storage medium is provided, storing executable instructions for implementing the authentication method as described in the first aspect above when executed by a processor.

[0021] According to a sixth aspect of an embodiment of the present application, a computer program product is provided, comprising a computer program or instructions, which, when executed by a processor, implements the authentication method as described in the first aspect above.

[0022] In an embodiment of the present application, resource classification is performed based on the data type of each resource in the lower engine layer to obtain the data category to which each resource belongs; resource classification is performed based on the resource access type of each resource in the lower engine layer to obtain the resource access category to which each resource belongs; the access request to be authenticated is parsed to determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request; and based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and the target resource access category, the target resource to be accessed by the access request is determined; based on the mapping relationship between the pre-configured resources and the authentication policy, and the target resource to be accessed by the access request, the target authentication policy corresponding to the access request is determined, and the access request to be authenticated is authenticated based on the target authentication policy.

[0023] In the embodiment of the present application, unified authentication of access requests is achieved through the authentication engine layer. On the one hand, unified authentication through the authentication engine layer reduces the complexity of the authentication logic, thereby improving the authentication efficiency; on the other hand, in the present application, only the authentication engine layer needs to be updated and maintained, reducing the development and operation and maintenance costs of the authentication platform.

[0024] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0026] Figure 1 A schematic diagram of the implementation flow of the authentication method applicable to the embodiment of the present application;

[0027] Figure 2 A schematic diagram of the structure of an authentication device applicable to an embodiment of the present application;

[0028] Figure 3 A schematic diagram of the structure of an authentication system applicable to an embodiment of the present application Figure 1 ;

[0029] Figure 4 A schematic diagram of the structure of an authentication system applicable to an embodiment of the present application Figure 2 ;

[0030] Figure 5 A schematic diagram of a hardware entity of an electronic device applicable to an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0032] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms of "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in the embodiments of the present application refers to and includes any or all possible combinations of one or more associated listed items.

[0033] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0034] It should also be pointed out that the terms "first\second\third" involved in the embodiments of the present application are only used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0035] In addition, the term "and / or" in the embodiments of the present application is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0036] To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0037] The specific implementation of the embodiment of the present application is described below in conjunction with the accompanying drawings of the embodiment of the present application.

[0038] See also Figure 1 , Figure 1 The following is a schematic diagram of the implementation process of the authentication method applicable to the embodiment of the present application. The authentication method of the embodiment of the present application is applied to the authentication engine layer and includes the following steps:

[0039] Step S101: classify resources based on the data type of each resource in the lower engine layer to obtain the data category to which each resource belongs; classify resources based on the resource access type of each resource in the lower engine layer to obtain the resource access category to which each resource belongs.

[0040] Specifically, the data types in the embodiments of the present application may include data types without hierarchical relationships and data types with hierarchical relationships, wherein the data models without hierarchical relationships include path classes, queue classes, methods and functions, etc., and the data models with hierarchical relationships include catalogs (Catalog), schemas (Schema), tables (Table), columns (Column), etc.

[0041] The resource access types in the embodiments of the present application may include read, write, execute, copy, download, delete, update, delete, use, etc.

[0042] Exemplarily, taking the data types of the resources of the lower-level engine layer including path class, queue class, directory, and table as an example, the resources of the lower-level engine layer can be classified according to the data type to determine the data category to which the resources of the lower-level engine layer belong, that is, determine whether the resources of the lower-level engine layer belong to the data category of the path class, the data category of the queue class, the data category of the directory, or the data category of the table.

[0043] Taking the resource access types of each resource in the lower-level engine layer including reading, writing, downloading, and deleting as an example, the resources of the lower-level engine layer can be classified according to the resource access type, so as to determine the resource access category to which each resource of the lower-level engine layer belongs, that is, to determine whether each resource of the lower-level engine layer belongs to the resource access category of reading, the resource access category of writing, the resource access category of downloading, or the resource access category of deleting.

[0044] Step S102, parse the access request to be authenticated, determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request; and determine the target resource to be accessed by the access request based on the data category of each resource, the resource access category of each resource, the target data category and the target resource access category.

[0045] Specifically, a corresponding parsing method may be determined according to the request type of the access request, so as to parse the access request to be authenticated according to the parsing method.

[0046] Exemplarily, after receiving the access request to be authenticated sent by the upper layer application, the access request to be authenticated is parsed according to the parsing method corresponding to the access request, and the target data category and target resource access category corresponding to the target resource to be accessed by the access request are determined according to the parsed access request. The target resource to be accessed by the access request is determined based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and target resource access category corresponding to the target resource to be accessed by the access request.

[0047] Optionally, in some of the embodiments, a target resource set corresponding to the target data category and the target resource access category in the lower engine layer can be determined based on the data category to which each resource belongs and the resource access category to which each resource belongs; and the target resource corresponding to the access request can be determined from each resource in the target resource set.

[0048] Specifically, after determining the data category to which each resource belongs and the resource access category to which each resource belongs, the resources corresponding to the target data category and the resources corresponding to the target resource access category in the lower engine layer can be determined. In the embodiment of the present application, a resource set consisting of resources corresponding to both the target data category and the target resource access category is used as the target resource set.

[0049] Exemplarily, taking the case where the target data category corresponding to the target resource to be accessed by the access request is table and the target resource access category is read, a resource set consisting of resources whose data category is table and resource access category is read in the lower engine layer can be determined, namely, the target resource set.

[0050] Next, the target resource corresponding to the access request can be determined from the resources of the target resource set. For example, the target resource corresponding to the access request can be determined by parsing the URL (Uniform Resource Locator) of the access request, or the target resource mapped by the access request can be determined by a routing mechanism, that is, the target resource corresponding to the access request. The target resource to be accessed by the access request can also be determined by other means, and the embodiments of the present application do not impose any special restrictions on this. In the process of determining the target resource corresponding to the access request from the resources of the target resource set, the resources of the target resource set can be searched or traversed to determine the target resource corresponding to the access request.

[0051] In the embodiment of the present application, a target resource set corresponding to the target data category and the target resource access category is first determined, and then the target resource corresponding to the access request is determined from each resource in the target resource set. Compared with determining the target resource from all resources in the lower engine layer, determining the target resource set first reduces the number of resources that need to be searched, thereby determining the efficiency of the target resource.

[0052] Step S103: According to the mapping relationship between the pre-configured resources and the authentication policies and the target resource to be accessed by the access request, determine the target authentication policy corresponding to the access request, and authenticate the access request to be authenticated based on the target authentication policy.

[0053] Specifically, the authentication strategy refers to the authority identification measures. The authentication strategy may include the identification measures for the access rights and operation rights of each resource of the lower engine layer. It may also include the identification measures for the access duration of each resource of the lower engine layer, the types of operations that can be performed, and other permissions.

[0054] Exemplarily, the authentication engine layer is pre-configured with a mapping relationship between each resource and the authentication policy, and the authentication policy corresponding to the target resource to be accessed by the access request, that is, the target authentication policy corresponding to the access request, can be determined according to the mapping relationship between each resource and the authentication policy. The access request to be authenticated is authenticated based on the target authentication policy to determine whether the access request can access the target resource, whether the target resource can be operated, or the length of time the target resource can be accessed, etc.

[0055] In the embodiment of the present application, unified authentication of access requests is achieved through the authentication engine layer. On the one hand, unified authentication through the authentication engine layer reduces the complexity of the authentication logic, thereby improving the authentication efficiency; on the other hand, in the present application, only the authentication engine layer needs to be updated and maintained, reducing the development and operation and maintenance costs of the authentication platform.

[0056] Optionally, in some of the embodiments, the request type of the access request to be authenticated can be determined, and based on the correspondence between the pre-set request type and the resolution method, the target resolution method corresponding to the access request to be authenticated can be determined; the access request to be authenticated is resolved using the target resolution method to determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request.

[0057] Specifically, the request type is the data type corresponding to the request, for example, it may be a Sql type or a Jar package type, etc. The authentication engine layer pre-caches various parsing methods corresponding to different request types.

[0058] Exemplarily, the request type of the access request to be authenticated can be determined first, and the target resolution method corresponding to the access request to be authenticated can be determined according to the correspondence between the pre-set request type and the resolution method. After the access request to be authenticated is resolved using the target resolution method, the target data category and the target resource access category corresponding to the target resource to be accessed by the access request can be mapped.

[0059] Optionally, in some of the embodiments, if the request type of the access request to be authenticated is of Sql type, then the target parsing method corresponding to the access request to be authenticated is determined to be a syntax tree parsing method; the syntax tree parsing method can be used to parse the Sql type access request to determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request.

[0060] Optionally, in some of the embodiments, if the request type of the access request to be authenticated is a Jar package type, then the target parsing method corresponding to the access request to be authenticated is determined to be a bytecode enhanced parsing method; the bytecode enhanced parsing method can be used to parse the access request of the Jar package type to determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request.

[0061] Using an incorrect parsing method to parse the access request may result in data loss or deformation in the access request. In the embodiment of the present application, using a parsing method corresponding to the request type to parse the access request can more accurately parse and process the access request.

[0062] Optionally, in some embodiments, the authentication engine layer includes a policy update plug-in, and the mapping relationship is stored in the rights management center. The mapping relationship can be obtained from the rights management center through the policy update plug-in according to a preset period; the mapping relationship stored in the authentication engine layer is updated using the mapping relationship obtained from the rights management center.

[0063] Specifically, the rights management center in the embodiment of the present application is used to configure authentication policies for each resource based on the rights configuration requirements of each resource in the lower engine layer, and store the mapping relationship between each resource and the authentication policy. The policy update plug-in of the authentication engine layer is used to obtain the mapping relationship between each resource and the authentication policy from the rights management center, and use the mapping relationship obtained from the rights management center to update the mapping relationship stored in the authentication engine layer. The preset period can be once a day or once a month. The specific period can be set according to the actual situation, and the embodiment of the present application does not impose specific restrictions on this.

[0064] Exemplarily, the policy update plug-in can obtain the current mapping relationship from the authority management center regularly according to a preset period, and use the newer mapping relationship obtained from the authority management center to update the mapping relationship stored in the authentication engine layer. It should be noted that when the policy update plug-in obtains the mapping relationship, it can also obtain the authentication policy stored in the authority management center, so as to use the newer authentication policy obtained from the authority management center to update the authentication policy stored in the authentication engine layer.

[0065] In an embodiment of the present application, the authentication policies and mapping relationships stored in the authority management center may be optimized and updated. The policy update plug-in synchronizes the newer authentication policies and mapping relationships in the authority management center to the authentication engine layer according to a preset period, thereby preventing the authentication engine layer from authenticating access requests based on the authentication policies and mapping relationships before the update, thereby improving the authentication accuracy of the authentication engine layer.

[0066] Optionally, in some of the embodiments, the lower engine layer includes multiple request response engines. If the access request authentication is passed, the target request response engine of the access request can be determined from the multiple request response engines; the access request is forwarded to the target request response engine to obtain the access resources corresponding to the access request through the target request response engine.

[0067] Specifically, the request response engine in the embodiment of the present application is used to process the received access request to obtain the access resource corresponding to the access request, or to perform the operation corresponding to the access request.

[0068] Exemplarily, if the access request authentication is passed, the target request response engine corresponding to the access request can be determined from multiple request response engines, and the access request can be routed and forwarded to the target request response engine to obtain the access resources corresponding to the access request or perform the operation corresponding to the access request through the target request response engine.

[0069] In an embodiment of the present application, the authenticated access request is forwarded to the corresponding target request response engine for processing, which can avoid the authenticated access request being matched to the wrong request response engine and obtaining the resources in the wrong request response engine, thereby improving the security of data in the lower engine layer.

[0070] See also Figure 2 , Figure 2 The following is a schematic diagram of the structure of an authentication device applicable to an embodiment of the present application. The authentication device of this embodiment includes the following modules:

[0071] The classification module 201 is used to classify resources based on the data type of each resource in the lower engine layer to obtain the data category to which each resource belongs; classify resources based on the resource access type of each resource in the lower engine layer to obtain the resource access category to which each resource belongs;

[0072] The parsing module 202 is used to parse the access request to be authenticated, determine the target data category and the target resource access category corresponding to the target resource to be accessed by the access request; and determine the target resource to be accessed by the access request based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and the target resource access category;

[0073] The authentication module 203 is used to determine the target authentication policy corresponding to the access request according to the mapping relationship between the pre-configured resources and the authentication policies and the target resource to be accessed by the access request, and authenticate the access request to be authenticated based on the target authentication policy.

[0074] Optionally, in some of the embodiments, the parsing module 202 is specifically used to: determine the request type of the access request to be authenticated, and determine the target parsing method corresponding to the access request to be authenticated based on the correspondence between the pre-set request type and the parsing method; and parse the access request to be authenticated using the target parsing method to determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request.

[0075] Optionally, in some of the embodiments, if the request type of the access request to be authenticated is of Sql type, then the target parsing method corresponding to the access request to be authenticated is determined to be a syntax tree parsing method; the parsing module 202 is specifically used to: use the syntax tree parsing method to parse the Sql type access request to determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request.

[0076] Optionally, in some of the embodiments, if the request type of the access request to be authenticated is a Jar package type, then the target parsing method corresponding to the access request to be authenticated is determined to be a bytecode enhanced parsing method; the parsing module 202 is specifically used to: adopt the bytecode enhanced parsing method to parse the access request of the Jar package type to determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request.

[0077] Optionally, in some of the embodiments, the parsing module 202 is specifically used to: determine a target resource set corresponding to the target data category and the target resource access category in the lower engine layer according to the data category to which each resource belongs and the resource access category to which each resource belongs; and determine the target resource corresponding to the access request from each resource in the target resource set.

[0078] Optionally, in some embodiments, the authentication engine layer includes a policy update plug-in, the mapping relationship is stored in the authority management center, and the authentication module 203 is specifically used to: obtain the mapping relationship from the authority management center through the policy update plug-in according to a preset period; and use the mapping relationship obtained from the authority management center to update the mapping relationship stored in the authentication engine layer.

[0079] Optionally, in some of the embodiments, the lower engine layer includes multiple request response engines. If the access request authentication is passed, the authentication module 203 is specifically used to: determine the target request response engine corresponding to the access request from the multiple request response engines; forward the access request to the target request response engine to obtain the access resource corresponding to the access request through the target request response engine.

[0080] The authentication device of this embodiment is used to implement the corresponding authentication method in the above-mentioned embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here. In addition, the functional implementation of each module in the authentication device of this embodiment can refer to the description of the corresponding part in the above-mentioned method embodiment, which will not be described in detail here.

[0081] See also Figure 3 , Figure 3 A schematic diagram of the structure of an authentication system applicable to an embodiment of the present application Figure 1 The authentication system of the embodiment of the present application includes a rights management center and an authentication engine layer.

[0082] Among them, the authority management center is used to configure authentication policies for each resource based on the authority configuration requirements of each resource in the lower engine layer, and store the mapping relationship between each resource and the authentication policy.

[0083] The authentication engine layer is used to classify resources based on the data types of each resource in the lower engine layer to obtain the data category to which each resource belongs; classify resources based on the resource access types of each resource in the lower engine layer to obtain the resource access category to which each resource belongs; parse the access request to be authenticated to determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request; and determine the target resource to be accessed by the access request based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and the target resource access category; determine the target authentication policy corresponding to the access request based on the mapping relationship between the pre-configured resources and the authentication policy, and the target resource to be accessed by the access request, and authenticate the access request to be authenticated based on the target authentication policy. And forward the authenticated access request to the lower engine layer.

[0084] See also Figure 3 The authentication engine layer also includes a policy update plug-in, which is used to obtain a mapping relationship from a rights management center according to a preset period; and to update the mapping relationship stored in the authentication engine layer using the mapping relationship obtained from the rights management center.

[0085] Optionally, in some of the embodiments, the authentication engine layer also includes a parsing and verification center, which is used to classify the access requests sent by the upper-layer application into two types of request: Sql type and Jar package type, and then perform script parsing on the Sql type access request through the Code executor. Specifically, the SQL statement, Script script and URL in the Sql type access request can be parsed by the Code executor to perform syntax tree parsing to determine the target data model and target resource access model corresponding to the Sql type access request. The Jar package type access request is bytecode enhanced by the Jar executor. Specifically, the Apache Spark system and Apache Flink system in the Jar executor can be used to perform bytecode enhancement on the Jar package type access request to determine the target data model and target resource access model corresponding to the Jar package type access request.

[0086] See also Figure 4 When the upper-layer application sends an access request to the authentication engine layer, it can send the access request to the engine client in the authentication engine layer through the access method of the Software Development Kit (SDK), REST API (Representational State Transfer API) or JDBC (Java Database Connectivity).

[0087] Taking sending an access request to the engine client through the access method of SDK as an example, in some embodiments, after receiving the access request, the engine client can determine whether the request type corresponding to the access request is Sql type or Jar package type through the request type check plug-in, so that the code parser can determine the parsing method according to the request type corresponding to the access request. The SQL statement, Script script and URL in the Sql type access request can be parsed by syntax tree, and the Args parameter in the Jar package type access request can be enhanced by bytecode, etc.

[0088] Optionally, in some of the embodiments, the engine client may include a resource model, and the resource model is used to store and manage authentication policies in the authentication engine layer and mapping relationships between each authentication policy and resources.

[0089] Optionally, in some of the embodiments, the authentication policies and mapping relationships stored in the authentication engine layer can be updated by using the authentication policies and mapping relationships obtained from the authority management center through a policy update plug-in to achieve authentication policy synchronization between the authority management center and the authentication engine layer.

[0090] After completing the authentication, the engine client may submit the authenticated access request to the lower engine layer, so that the access request may be processed by the target request response engine corresponding to the access request in the lower engine layer.

[0091] Depend on Figure 4 It can be seen that no matter the access request is sent to the engine client through the SDK, REST API or JDBC access method, the process of processing the access request in the engine client is the same. Therefore, the process of processing the access request in the engine client when the access request is sent to the engine client through the REST API and JDBC access methods will not be described here.

[0092] An embodiment of the present application provides a computer program, including a computer-readable code. When the computer-readable code is run in a computer device, a processor in the computer device executes some or all of the steps for implementing the above method.

[0093] The embodiment of the present application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and when the computer program is read and executed by a computer, some or all of the steps in the above method are implemented. The computer program product can be implemented specifically by hardware, software or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium, and in other embodiments, the computer program product is specifically embodied as a software product, such as an SDK, etc.

[0094] It should be noted here that the description of the various embodiments above tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. The description of the above computer program and computer program product embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the computer program and computer program product embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0095] Figure 5 A schematic diagram of a hardware entity of an electronic device applicable to an embodiment of the present application is shown in FIG. Figure 5 As shown, the hardware entity of the electronic device 500 includes: a processor 501 and a memory 502, wherein the memory 502 stores a computer program that can be run on the processor 501, and the processor 501 implements the steps in the method of any of the above embodiments when executing the program.

[0096] The memory 502 stores computer programs that can be run on the processor. The memory 502 is configured to store instructions and applications executable by the processor 501. It can also cache data to be processed or processed by the processor 501 and various modules in the electronic device 500 (for example, image data, audio data, voice communication data, and video communication data). This can be achieved through flash memory (FLASH) or random access memory (Random Access Memory, RAM).

[0097] When the processor 501 executes the program, the steps of any of the above authentication methods are implemented. The processor 501 generally controls the overall operation of the electronic device 500.

[0098] An embodiment of the present application provides a computer storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the steps of the authentication method of any of the above embodiments.

[0099] It should be noted here that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0100] The processor may be at least one of an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a Central Processing Unit (CPU), a controller, a microcontroller, and a microprocessor. It is understandable that the electronic device that implements the functions of the processor may also be other, and the embodiments of the present application are not specifically limited.

[0101] The computer storage medium / memory may be a read-only memory (ROM), a programmable read-only memory (PROM), or a Only Memory, PROM), Erasable Programmable Read-Only Memory (Erasable Programmable Only Memory, EPROM), Electrically Erasable Programmable Read-Only Memory (Electrically Erasable Programmable Only Memory, EEPROM), Ferromagnetic Random Access Memory (FRAM), Flash Memory, Magnetic Surface Storage, Optical Disk, or Compact Disc Read Only Memory (CD-ROM) Only Memory, It may also be various terminals including one or any combination of the above memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0102] It should be understood that "one embodiment" or "an embodiment" or "some embodiments" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in one embodiment" or "in some embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments. The above description of each embodiment tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. For the sake of brevity, this article will not repeat them.

[0103] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0104] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as: multiple modules or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or modules can be electrical, mechanical or other forms.

[0105] The modules described above as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules; they may be located in one place or distributed on multiple network units; some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0106] In addition, all functional modules in the embodiments of the present application may be integrated into one processing unit, or each module may be a separate unit, or two or more modules may be integrated into one unit; the above-mentioned integrated modules may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0107] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks or optical disks.

[0108] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling an electronic device to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0109] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0110] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0111] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0112] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An authentication method, characterized in that: Applied to the authentication engine layer, the method includes: Classify resources based on the data type of each resource in the lower engine layer to obtain the data category to which each resource belongs; classify resources based on the resource access type of each resource in the lower engine layer to obtain the resource access category to which each resource belongs; Parse the access request to be authenticated, determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request; and determine the target resource to be accessed by the access request based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and the target resource access category; According to the mapping relationship between the pre-configured resources and the authentication policies, and the target resource to be accessed by the access request, the target authentication policy corresponding to the access request is determined, and the access request to be authenticated is authenticated based on the target authentication policy.

2. The authentication method according to claim 1, characterized in that: The parsing of the access request to be authenticated and determining the target data category and the target resource access category corresponding to the target resource to be accessed by the access request include: Determine the request type of the access request to be authenticated, and determine the target resolution method corresponding to the access request to be authenticated according to the predetermined correspondence between the request type and the resolution method; The target parsing method is adopted to parse the access request to be authenticated to determine the target data category and the target resource access category corresponding to the target resource to be accessed by the access request.

3. The authentication method according to claim 2, characterized in that: If the request type of the access request to be authenticated is a Sql type, determining that the target parsing mode corresponding to the access request to be authenticated is a syntax tree parsing mode; The target parsing method is adopted to parse the access request to be authenticated to determine the target data category and the target resource access category corresponding to the target resource to be accessed by the access request, including: The access request of the SQL type is parsed by adopting a syntax tree parsing method to determine the target data category and the target resource access category corresponding to the target resource to be accessed by the access request.

4. The authentication method according to claim 2, characterized in that: If the request type of the access request to be authenticated is a Jar package type, determining that the target parsing mode corresponding to the access request to be authenticated is a bytecode enhanced parsing mode; The target parsing method is adopted to parse the access request to be authenticated to determine the target data category and the target resource access category corresponding to the target resource to be accessed by the access request, including: The bytecode enhanced parsing method is adopted to parse the access request of the Jar package type to determine the target data category and the target resource access category corresponding to the target resource to be accessed by the access request.

5. The authentication method according to claim 1, characterized in that: The determining the target resource to be accessed by the access request based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category, and the target resource access category includes: Determine a target resource set corresponding to the target data category and the target resource access category in the lower engine layer according to the data category to which each resource belongs and the resource access category to which each resource belongs; A target resource corresponding to the access request is determined from resources in the target resource set.

6. The authentication method according to claim 1, characterized in that: The authentication engine layer includes a policy update plug-in, the mapping relationship is stored in a rights management center, and the method further includes: According to a preset period, obtaining a mapping relationship from the rights management center through the policy update plug-in; The mapping relationship stored in the authentication engine layer is updated using the mapping relationship obtained from the authority management center.

7. The authentication method according to claim 1, characterized in that: The lower engine layer includes a plurality of request response engines. If the access request authentication is passed, the method further includes: Determining a target request response engine corresponding to the access request from the multiple request response engines; The access request is forwarded to the target request response engine to obtain the access resource corresponding to the access request through the target request response engine.

8. An authentication device, characterized in that: Applied to the authentication engine layer, the device comprises: The classification module is used to classify resources based on the data type of each resource in the lower engine layer to obtain the data category to which each resource belongs; classify resources based on the resource access type of each resource in the lower engine layer to obtain the resource access category to which each resource belongs; A parsing module, used to parse the access request to be authenticated, determine the target data category and the target resource access category corresponding to the target resource to be accessed by the access request; and determine the target resource to be accessed by the access request based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and the target resource access category; The authentication module is used to determine the target authentication policy corresponding to the access request according to the mapping relationship between the pre-configured resources and the authentication policy, and the target resource to be accessed by the access request, and authenticate the access request to be authenticated based on the target authentication policy.

9. An authentication system, characterized in that: include: The authority management center is used to configure authentication policies for each resource based on the authority configuration requirements of each resource in the lower engine layer, and store the mapping relationship between each resource and the authentication policy; The authentication engine layer is used to classify resources based on the data type of each resource in the lower engine layer to obtain the data category to which each resource belongs; classify resources based on the resource access type of each resource in the lower engine layer to obtain the resource access category to which each resource belongs; parse the access request to be authenticated to determine the target data category and target resource access category corresponding to the target resource to be accessed by the access request; And based on the data category to which each resource belongs, the resource access category to which each resource belongs, the target data category and the target resource access category, the target resource to be accessed by the access request is determined; according to the mapping relationship between the pre-configured resources and the authentication policy, and the target resource to be accessed by the access request, the target authentication policy corresponding to the access request is determined, and the access request to be authenticated is authenticated based on the target authentication policy.

10. The authentication system according to claim 9, characterized in that: The authentication engine layer also includes: The policy update plug-in is used to obtain the mapping relationship from the authority management center according to a preset period; and use the mapping relationship obtained from the authority management center to update the mapping relationship stored in the authentication engine layer.

11. An electronic device, characterized in that: include: A memory for storing executable instructions; A processor, configured to implement the authentication method according to any one of claims 1 to 7 when executing the executable instructions stored in the memory.

12. A computer-readable storage medium, characterized in that: Executable instructions are stored, which are used to implement the authentication method described in any one of claims 1 to 7 when executed by a processor.

13. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the authentication method according to any one of claims 1 to 7 is implemented.

Images