Unauthorized access control method and device, equipment and medium

Abstract

The invention discloses an unauthorized access control method and device, equipment and a medium, and the method comprises the following steps: receiving an API access request, the API access request comprising API information of a first API to be accessed and user information of a first user to access the first API; according to the initial API set and the API access request, judging whether the access of the first user to the first API belongs to authorized access or first unauthorized access; based on the authorized access of the first user to the first API, a data access request of the first user is received, and the data access request comprises data information of first data to be accessed; obtaining a first data type corresponding to the first API according to the user information of the first user and the data information of the first data; and according to the plug-in corresponding to the first data type, judging whether the access of the first user to the first data belongs to authorized access or second unauthorized access. According to the method, the operation of API background software and the data security can be effectively guaranteed by controlling the user to have the unauthorized access to the API and the corresponding data.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to an unauthorized access control method, device, equipment and medium. Background Art

[0002] Providing business capabilities to external applications (the applications mentioned here include WEB applications, mobile apps, applets, PC application software, etc.) based on API is a common technical means of outputting API background software capabilities. The software defines a series of APIs that implement different business functions. External applications access the corresponding APIs according to business needs. However, when APIs are accessed, they are also accompanied by various illegal accesses and brute force attacks. The vulnerabilities of the API itself are also easy to become attack points. For example, due to poor design of API access authentication, it is easy to be accessed without authorization.

[0003] Among them, unauthorized access includes vertical unauthorized access and horizontal unauthorized access. Vertical unauthorized access refers to an external application trying to obtain high-authorized access rights with a low-authorized identity. In simple terms, it means that an external application tries to access an API that it does not have access rights to. Horizontal unauthorized access refers to an external application trying to access other users' resources or data with equal or identical permissions. In simple terms, it means that an external application tries to access the data of other unauthorized users other than itself through the same API.

[0004] In the prior art, in vertical unauthorized access control, the key is to control which API access rights users of external applications have. Common technical solutions include: manually configuring the API URL method; selecting from the API list, or classifying the API first and selecting the configuration method of a specific category of API. The first method above is suitable for situations where the number of APIs provided by the API background software is small. The second method requires the selector to be very familiar with the functions of each API, otherwise it is easy to make a wrong choice. In horizontal unauthorized access control, the key is to control that users of external applications cannot access the data of other unauthorized users. The commonly used technical solution is to first implement the unauthorized access control logic in the implementation logic code of each API: check whether the user of the external application wants to access the data of other users, and then check whether the user has the authority to access the data of other specified users. This method can better control horizontal unauthorized access, but each API contains unauthorized access control logic, which causes the access control logic to spread uncontrollably and destroys the neatness of the API business logic code. Summary of the invention

[0005] The purpose of the present invention is to provide an unauthorized access control method, device, equipment and medium to solve the problem that the existing API access authentication is poorly designed, resulting in easy unauthorized access.

[0006] To solve the above technical problems, a technical solution adopted by the present invention is to provide an unauthorized access control method, which includes the following steps: receiving an API access request, the API access request including API information of a first API to be accessed, and user information of a first user who wants to access the first API, the API information including an API unique identifier, and the user information including a user unique identifier and a user role; judging whether the first user's access to the first API is authorized access or a first unauthorized access based on a preset initial API set and the API access request; receiving a data access request from the first user based on the first user's authorized access to the first API, the data access request including data information of a first data to be accessed; obtaining a first data type corresponding to the first API based on the user information of the first user and the data information of the first data; judging whether the first user's access to the first data is authorized access or a second unauthorized access based on a plug-in corresponding to the first data type.

[0007] In some embodiments, the method further comprises the step of: configuring the initial API set according to the type of the external application, the initial API set comprising a plurality of APIs accessible to users of the external application.

[0008] In some embodiments, the type of the external application includes a first application type, and configuring the initial API set based on the type of the external application includes the steps of: defining a function menu set, the function menu set including multiple function menus, the function menu including multiple APIs that a user can access through a page corresponding to the function menu; defining multiple user roles, and authorizing specific function menu permissions for each user role; and determining the initial API set accessible to users corresponding to each user role.

[0009] In some embodiments, the type of the external application includes a second application type, and configuring the initial API set according to the type of the external application includes the step of manually configuring the initial API set accessible to users of the external application.

[0010] In some embodiments, judging whether the access of the first user to the first API is authorized access or the first unauthorized access based on a preset initial API set and the API access request includes the steps of: determining, based on the user information of the first user, that the initial API set accessible to the first user is a first API set; judging whether the first API is included in the first API set; and if the first API is included in the first API set, judging that the access of the first user to the first API is authorized access.

[0011] In some embodiments, judging whether the access of the first user to the API is authorized access or the first unauthorized access based on a preset initial API set and the API access request includes the steps of: judging whether the external application is a legitimate application; if the external application is a legitimate application, determining that the initial API set is a second API set; judging whether the second API set includes the first API; if the second API set includes the first API, determining that the access of the first user to the first API is authorized access.

[0012] In some embodiments, the method further includes the steps of: designing multiple characteristic elements corresponding to API access, the multiple characteristic elements including the user ID for accessing the API, the user ID set to which the data to be accessed belongs, and the data type ID of the data to be accessed; defining a plug-in library, the plug-in library including multiple plug-ins, each of the plug-ins including a permission judgment function; defining a plug-in framework, the plug-in framework including the plug-in, and the plug-in is dynamically deployed to the plug-in framework in a plug-and-play manner, so that the plug-in implements the corresponding data access permission judgment through the permission judgment function.

[0013] The present invention also provides an unauthorized access control device, which includes: an API access receiving unit, used to receive an API access request, the API access request including API information of a first API to be accessed, and user information of a first user to access the first API, the API information including an API unique identifier, and the user information including a user unique identifier and a user role; a first judgment unit, used to determine whether the first user's access to the first API is authorized access or a first unauthorized access based on a preset initial API set and the API access request; a data access receiving unit, used to receive a data access request from the first user based on the first user's authorized access to the first API, the data access request including data information of the first data to be accessed; a data type acquisition unit, used to obtain a first data type corresponding to the first API based on the user information of the first user and the data information of the first data; a second judgment unit, used to determine whether the first user's access to the first data is authorized access or a second unauthorized access based on a plug-in corresponding to the first data type.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0015] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0016] The beneficial effects of the present invention are as follows: the present invention discloses an unauthorized access control method, device, equipment and medium, the method comprising the following steps: receiving an API access request, the API access request comprising API information of a first API to be accessed, and user information of a first user to be accessed, the API information comprising an API unique identifier, and the user information comprising a user unique identifier and a user role; judging whether the first user's access to the first API is authorized access or a first unauthorized access according to a preset initial API set and an API access request; based on the first user's authorized access to the first API, receiving a data access request from the first user, the data access request comprising data information of the first data to be accessed; obtaining a first data type corresponding to the first API according to the user information of the first user and the data information of the first data; judging whether the first user's access to the first data is authorized access or a second unauthorized access according to a plug-in corresponding to the first data type. The present invention controls the user's unauthorized access to the API and the corresponding data by controlling the first unauthorized access and the second unauthorized access, and can effectively protect the operation and data security of the API background software. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flow chart of an embodiment of an unauthorized access control method of the present invention; Figure 2 It is a specific flow chart of obtaining the corresponding initial API set in an embodiment of an unauthorized access control method of the present invention; Figure 3 It is a schematic diagram of the relationship between user roles, function menus and multiple APIs in an embodiment of an unauthorized access control method of the present invention; Figure 4 It is a specific flow chart of step S2 corresponding to an external application of the first application type in an embodiment of an unauthorized access control method of the present invention; Figure 5 It is a specific flow chart of step S2 corresponding to the external application of the second application type in an embodiment of an unauthorized access control method of the present invention; Figure 6 It is a flow chart of implementing the second unauthorized access control of the first user in an embodiment of an unauthorized access control method of the present invention; Figure 7 It is a structural block diagram of an embodiment of an unauthorized access control device of the present invention; Figure 8 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention; Fig. 9 It is a schematic block diagram of an embodiment of a computer-readable storage medium of the present invention. DETAILED DESCRIPTION

[0018] In order to facilitate the understanding of the present invention, the present invention is described in more detail below in conjunction with the accompanying drawings and specific embodiments. Preferred embodiments of the present invention are provided in the accompanying drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described in this specification. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present invention more thorough and comprehensive.

[0019] It should be noted that, unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used in this specification includes any and all combinations of one or more related listed items.

[0020] Unless otherwise defined, the technical terms or scientific terms used in this disclosure should be understood by people with ordinary skills in the field to which this disclosure belongs. The words "first", "second" and similar words used in this disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components.

[0021] like Figure 1 As shown, a method for controlling unauthorized access according to the present invention is shown, comprising the following steps: Step S1: receiving an API access request.

[0022] It should be noted that all API accesses involved in the present invention use the API gateway as a unified entrance. The API access request includes the API information of the first API to be accessed, and the user information of the first user to access the first API. The API information includes the API unique identifier, and the user information includes the user unique identifier and the user role. The user unique identifier is the user ID for accessing the API.

[0023] Before step S1, it is also necessary to create different types of external applications and configure an initial API set accessible to users of the external applications according to the type of the external applications. The initial API set includes multiple APIs that users can access through the corresponding external applications.

[0024] In this embodiment, the types of external applications include a first application type and a second application type. The external application of the first application type belongs to the same software system as the API background software, and the data of the two are stored in the same location. The external application of the first application type includes but is not limited to WEB application portals, APP applications, small program applications, desktop applications, etc. The external application of the second application type does not belong to the same software system as the API background software, and can be called a third-party application. Usually, the external application of the second application type has a small number of APIs that can be accessed by users through this type of external application. For third-party applications, taking Baidu as an example, Baidu can provide users with multiple APIs. For example, Baidu provides four APIs A, B, C, and D related to Baidu Map Services. If users use Baidu Map Services through the campus software platform of IoT Company, then the campus software platform is a third-party application relative to the API background software that provides Baidu Map Services.

[0025] Among them, for the external application of the first application type, a series of function menus are defined to configure multiple APIs that users can access through the pages corresponding to each function menu. Different user roles have different function menu access rights. According to the function menu access rights corresponding to the user role and the multiple APIs corresponding to the function menu, all APIs accessible to users of the corresponding user role are obtained, that is, the initial API set accessible to users of the corresponding user role is obtained.

[0026] Specifically, if Figure 2 As shown, for an external application of the first application type, obtaining an initial API set accessible to users of a corresponding user role includes the following sub-steps: Step S011: define a function menu set.

[0027] The function menu set includes a plurality of function menus corresponding to a plurality of pages of the external application, and each function menu includes a plurality of APIs that can be accessed by the user through the page corresponding to the function menu.

[0028] Step S012: define multiple user roles, and authorize specific function menu permissions for each user role.

[0029] Among them, after authorizing specific function menu permissions to each user role, the function menu accessible to users of each user role can be obtained.

[0030] Step S013: Determine the initial set of APIs accessible to users corresponding to each user role.

[0031] Among them, users with different user roles have different access rights on different pages. According to the multiple APIs corresponding to each function menu and the function menus accessible to users of each user role, the initial API set accessible to users corresponding to a specific user role can be determined.

[0032] It should be noted that different function menus may correspond to the same API, so each initial API set can actually be regarded as a union of multiple APIs corresponding to various function menus that users of corresponding user roles are authorized to access.

[0033] As an example, combining Figure 3 As shown, the function menu set can be expressed as [menu_a, menu_b, menu_c, ......], and each element in the function menu set corresponds to function menu a, function menu b, function menu c, and so on. Since each function menu corresponds to multiple APIs, the function menu set can be further expressed as {menu_a: [api_a, api_b, ......], menu_b: [api_a, api_c, api_d, ......], ......}; for menu_a: [api_a, api_b, ......], "api_a, api_b, ......" represents the API unique identifier of the multiple APIs corresponding to function menu a. If the user role userRoleA is authorized to have the function menu permission userRoleA: [menu_a, menu_b, ......], then the initial API set accessible to the user role userRoleA is the union of the multiple APIs corresponding to the function menus authorized by the user role userRoleA, and the result is: userRoleA: [api_a, api_b, api_c, api_d, ......]. Thus, an initial API set accessible to a specific user based on an external application of the first user type can be obtained, and by controlling the user to only access the initial API set, the user is prevented from accessing unauthorized APIs through the external application. Afterwards, in step S2, the first user can be assigned to a specific user role based on the user information of the first user obtained, thereby determining the initial API set accessible to the first user.

[0034] Among them, for external applications of the second application type, there is no need to distinguish user roles. All users can be authorized to access the initial API set through the external application by manually configuring the API, thereby preventing users from accessing unauthorized APIs through the external application.

[0035] Step S2: judging whether the first user's access to the first API is authorized access or the first unauthorized access according to the preset initial API set and the API access request.

[0036] It should be noted that the first unauthorized access refers to the user of an external application accessing an API for which he has no permission.

[0037] Among them, based on the API unique identifier of the first API in the API access request, it is determined whether there is an API with the same API unique identifier as the first API in the preset initial API set. If so, it is determined that the first user's access to the first API is authorized access, that is, the first user's access to the first API does not constitute the first unauthorized access, thereby achieving control of the first unauthorized access and preventing the first user from accessing an API to which he does not have access rights.

[0038] like Figure 4 As shown, for an external application of the first application type, step S2 includes the following sub-steps: Step S211: According to the user information of the first user, determine that the initial API set accessible to the first user is the first API set.

[0039] Step S212: Determine whether the first API set includes the first API. If the first API set includes the first API, proceed to step S213. If the first API set does not include the first API, proceed to step S214.

[0040] Step S213: Determine whether the first user's access to the first API is authorized.

[0041] Step S214: Determine whether the first user has no right to access the first API.

[0042] Specifically, first determine, based on the user role of the first user, that the initial API set accessible to the first user is the first API set, which is a set of all APIs accessible to the first user through corresponding external applications. Then, determine whether there is an API in the first API set that is identical to the API unique identifier of the first API; if there is an API in the first API set that is identical to the API unique identifier of the first API, it indicates that the first API set includes the first API, and it can be determined that the first user's access to the first API is authorized, and the corresponding API access request succeeds, and a prompt indicating a successful request is displayed on the user side. If there is no API in the first API set that is identical to the API unique identifier of the first API, it indicates that the first user is not authorized to access the first API, and the corresponding API access request fails, and a prompt indicating that the access is inaccessible is displayed on the user side.

[0043] like Figure 5 As shown, for the external application of the second application type, step S2 includes the following sub-steps: Step S221: Determine whether the external application is a legal application. If the external application is a legal application, proceed to step S222. If the external application is an illegal application, proceed to step S225.

[0044] Step S222: Determine that the initial API set is the second API set.

[0045] Step S223: Determine whether the second API set includes the first API. If the second API set includes the first API, proceed to step S224. If the second API set does not include the first API, proceed to step S225.

[0046] Step S224: Determine whether the first user's access to the first API is authorized.

[0047] Step S225: Determine whether the first user has no right to access the first API.

[0048] Specifically, for external applications of the second application type, first, it is necessary to determine whether the external application used by the first user is a legal application. After determining that the external application is a legal application, the initial API set that the first user can access through the external application is obtained as the second API set; the second API set is a set of all APIs that the first user can access through the corresponding external application. Then, determine whether there is an API in the second API set that is identical to the API unique identifier of the first API; if there is an API in the second API set that is identical to the API unique identifier of the first API, it means that the second API set includes the first API, and it can be determined that the first user has the right to access the first API, and the corresponding API access request is successful, and the user end prompts that the request is successful. If there is no API in the second API set that is identical to the API unique identifier of the first API, it means that the first user has no right to access the first API, and the corresponding API access request fails, and the user end prompts that it cannot be accessed.

[0049] The legitimate application refers to an external application of the second application type created by the application management module of the API background software. On the basis of determining that the external application is a legitimate application, the first unauthorized access control is achieved by controlling the external application to only access the APIs in the manually configured initial API set.

[0050] Step S3: Based on the first user's authorized access to the first API, a data access request from the first user is received.

[0051] It should be noted that after the first user successfully accesses the first API, a data access request is further made, and the data access request includes data information of the first data to be accessed. The first data is the data of a certain user that the first user may access in the first API, and the data information includes a unique data identifier, which is the user ID of the user to which the data belongs and the data type ID of the data.

[0052] In this embodiment, before the first user accesses data through the first API, it is necessary to clarify which users' data and types of data the first user has the right to access, that is, to control the second unauthorized access of the first user.

[0053] The second unauthorized access refers to a user of an external application accessing the data of other unauthorized users. Therefore, before step S1, it is necessary to implement the second unauthorized access control for all APIs. First, it is necessary to design multiple characteristic elements of the second unauthorized access control, which include: the user ID accessing the API, the user ID (set) to which the data to be accessed belongs, and the data type ID of the data to be accessed.

[0054] The second unauthorized access control logic is feasible only if one of the following conditions is met: Determine whether there is only one element in the user ID set to which the data to be accessed belongs and the element is the same as the user ID accessing the API, and the user accessing the API has the right to access the data of the corresponding data type ID; If there is at least one element in the user ID set to which the data to be accessed belongs that is different from the user ID to access the API, then this set is recorded as the user ID replacement set. All user IDs to which the data to be accessed in the user ID replacement set are traversed, and users accessing the API have access rights to the data of "user ID to which the data to be accessed belongs + data type ID of the data to be accessed".

[0055] like Figure 6As shown, for the second unauthorized access control of the first user, first, determine whether there is only the first user ID in the first ID set; if there is only the first user ID in the first ID set, the first user can access the corresponding data and record the first user ID; if there is not only the first user ID in the first ID set (no first user ID / including other user IDs except the first user ID), then replace the first ID set with the second ID set that does not contain the first user ID. Secondly, determine whether the first user has access rights to the data corresponding to the nth user ID in the second ID set; if the first user has access rights to the data corresponding to the nth user ID in the second ID set, it indicates that the first user can access the data corresponding to the nth user ID and record the nth user ID; if the first user does not have access rights to the data corresponding to the nth user ID in the second ID set, it indicates that the first user cannot access the data corresponding to the nth user ID. Then, determine whether all user IDs in the second ID set have been traversed; if not, set n=n+1, and return to the step of determining whether the first user has access rights to the data corresponding to the nth user ID in the second ID set; if all user IDs in the second ID set have been traversed, then obtain the user ID of the corresponding user for all data accessible by the first user.

[0056] It should be noted that the first user ID set is a set of user IDs corresponding to all data that the first user may access through the first API, and the first user ID set corresponds to the user ID set to which the data to be accessed belongs. If the first user has the access rights to the data of "user ID to which the data to be accessed belongs + data type ID of the data to be accessed", then the data to be accessed corresponding to all user IDs in the first user ID set (user ID set to which the data to be accessed belongs) can be accessed by the first user, and all recorded user IDs correspond to all user IDs in the first user ID set.

[0057] To ensure that the above solution is feasible, it is necessary to solve the problem of how to generate multiple feature element data and how to determine whether users accessing the API have access rights to the data of "user ID of the data to be accessed + data type ID of the data to be accessed".

[0058] First, design multiple characteristic elements corresponding to API access (accessing specific data through the corresponding API). Secondly, configure the corresponding plug-in used by each API. The plug-in contains a permission judgment function that can judge the data access permission, which enables the plug-in to implement the corresponding data access permission judgment through the corresponding permission judgment function.

[0059] In this embodiment, the multiple characteristic elements corresponding to the API access include the user ID accessing the API, the user ID (set) to which the data to be accessed belongs, and the data type ID of the data to be accessed. The user ID accessing the API is taken from the Header request parameter of the API. For the user ID set to which the data to be accessed belongs (including all user IDs to which the data to be accessed belongs), the API request body is a JSON structure. When defining the API, configure which nodes of the JSON structure the data corresponding to the user ID set to which the data to be accessed belongs is obtained. For example, the JSON structure is , the value of the user ID set to which the data to be accessed belongs is the node es and xs The corresponding node expression is: . The rule of the node expression is: the path node sequence from the root node of the JSON structure to this node. If the path node is a mapping type, the value is K_+ the KEY value of the mapping; if the path node is an array type, the value is A_+ the subscript of the array where the path node is located, and the starting value of the subscript is 0. For the data type ID of the data to be accessed, when defining the API, a mapping relationship between the APIURL (API website) and the data type ID of the data to be accessed is configured. Based on the API URL, the corresponding data type ID of the data to be accessed can be obtained.

[0060] Furthermore, a plug-in library is defined, which includes multiple plug-ins, and each plug-in includes a corresponding permission judgment function. Then, a plug-in framework is defined, which includes the plug-ins in the plug-in library. Among them, the permission judgment function is Judge(userId, DataUserId, dataTypeId), and Judge() contains the corresponding permission judgment logic. UserId, DataUserId and dataTypeId correspond to the user ID who accesses the API, the user ID of the data to be accessed, and the data type ID of the data to be accessed, respectively. The plug-in is dynamically deployed to the plug-in framework in a plug-and-play manner, and different plug-ins can implement different permission judgment logics in the corresponding permission judgment function.

[0061] Among them, since the business carried by the business software is determined, the category of the permission judgment logic is also determined, so a certain plug-in library can be defined first, and the plug-in library includes multiple plug-ins. These plug-ins can implement different permission judgment logics in the corresponding permission judgment function. For example, if it is determined that the user U2 to whom the data is to be accessed belongs to the user role UserRoleA, and the user U1 accessing the API has the access right to the data of the user U2 to whom the data is to be accessed, whose user role is UserRoleA and the corresponding data type is the second data type T2 (the corresponding data type ID is dataTypeId T2), then the user U1 accessing the API can access the data of the second data type T2 of user U2.

[0062] Based on this, users can use each API to access the data type of the corresponding data, use the corresponding plug-in, and according to the corresponding permission judgment function, determine whether the user accessing the corresponding API has the access permission to the data of "user ID of the data to be accessed + data type ID of the data to be accessed", that is, whether the user accessing the corresponding API has the permission to access the data of a certain user and a certain data type.

[0063] In this embodiment, after receiving the data access request of the first user, it is determined whether there is a user ID that is the same as the user ID of the user to which the first data belongs among the user IDs of the corresponding users of all the recorded data accessible to the first user; if there is a user ID that is the same as the user ID of the user to which the first data belongs, it indicates that the first user can access the first data, and the process goes to step S4; if there is no user ID that is the same as the user ID of the user to which the first data belongs, it indicates that the first user cannot access the first data, the corresponding data access request fails, and a prompt is given on the user side that it cannot be accessed.

[0064] Step S4: Obtain a first data type corresponding to the first API according to the user information of the first user and the data information of the first data.

[0065] It should be noted that when a user uses an API to access data, the API generally corresponds to one data type; when a user uses multiple APIs to access data, different APIs may correspond to the same data type or different types of data types.

[0066] In this embodiment, based on the API access request in step S1 and the data access request in step S3, the ID of the user accessing the first API is obtained as the first user ID (userId1), the user ID to which the first data is to be accessed is the first data user ID (DataUserId1), and the data type ID of the first data to be accessed is the first data type ID (DataTypeId1).

[0067] Among them, according to the user unique identifier of the first user (first user ID) and the data unique identifier of the first data (first data user ID and first data type ID), the first data type T1 corresponding to the first API is determined, so as to obtain the first plug-in corresponding to the first data type T1, and the first plug-in can be further used to determine whether the first user's access to the first data is authorized.

[0068] Step S5: judging, based on the plug-in corresponding to the first data type, whether the first user's access to the first data is authorized access or second unauthorized access.

[0069] It should be noted that when defining each API, you need to configure which plug-in to use for permission judgment for each API. Then, based on the access to the corresponding data in the API, you can call the permission judgment function in the corresponding plug-in to complete the data access permission judgment.

[0070] In this embodiment, a first plug-in in a plug-in library corresponding to a first API is called, and a permission determination function in the first plug-in is used to determine whether the first user has the right to access the first data.

[0071] Among them, when the first data is data of a second user and a first data type, if the first user has the right to access the data of the second user and the first data type, then it can be determined that the first user's access to the first data is authorized access; when the first data is data of a third user and a first data type, if the first user has no right to access the data of the third user and the first data type, then it can be determined that the first user's access to the first data is unauthorized access, that is, the second unauthorized access control is implemented for the first user.

[0072] In the above process, by controlling the second unauthorized access, the first user can be prevented from accessing the data of other unauthorized users.

[0073] In the present application, by controlling the first unauthorized access and the second unauthorized access, the user's unauthorized access to the API and corresponding data is controlled, which can effectively ensure the operation security and data security of the API background software.

[0074] Based on the same inventive concept, Figure 7 As shown, the present invention also provides an unauthorized access control device, the device comprising: The API access receiving unit 101 is used to receive an API access request, which includes API information of a first API to be accessed and user information of a first user to access the first API. The API information includes an API unique identifier, and the user information includes a user unique identifier and a user role.

[0075] The first determination unit 102 is used to determine whether the first user's access to the first API is authorized access or a first unauthorized access according to a preset initial API set and an API access request.

[0076] The data access receiving unit 103 is used to receive a data access request from a first user based on the first user's authorized access to the first API, where the data access request includes data information of first data to be accessed.

[0077] The data type acquisition unit 104 is used to obtain the first data type corresponding to the first API according to the user information of the first user and the data information of the first data.

[0078] The second judgment unit 105 is used to judge whether the first user's access to the first data is authorized access or second unauthorized access according to the plug-in corresponding to the first data type.

[0079] In the present application, other technical features in the above-mentioned unauthorized access control device are the same as the features disclosed in the above-mentioned method embodiment, and will not be repeated here.

[0080] Based on the same inventive concept, the present application also provides an electronic device, which includes a processor, a memory and a communication circuit, and the processor is connected to the memory and the communication circuit respectively; wherein the communication circuit is used for communication connection, the memory is used to store a computer program, and the processor is used to execute the computer program to implement the above method.

[0081] See also Figure 8 The electronic device described in the embodiment of the present application may specifically include a processor 210 and a memory 220. The memory 220 is coupled to the processor 210.

[0082] The processor 210 is used to control the operation of the electronic device. The processor 210 may also be referred to as a CPU (Central Processing Unit). The processor 210 may be an integrated circuit chip with signal processing capabilities. The processor 210 may also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The general-purpose processor may be a microprocessor or the processor 210 may also be any conventional processor, etc.

[0083] The memory 220 is used to store computer programs, and may be a RAM, a ROM, or other types of storage terminals. Specifically, the memory 220 may include one or more computer-readable storage media, which may be non-transitory or transient. The memory 220 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage terminals, flash memory storage terminals. In some embodiments, the non-transitory computer-readable storage medium in the memory 220 is used to store at least one program code.

[0084] The processor 210 is used to execute the computer program stored in the memory 220 to implement the methods described in the various method embodiments of the present application.

[0085] In some embodiments, the electronic device may further include: a peripheral terminal interface 230 and at least one peripheral terminal. The processor 210, the memory 220 and the peripheral terminal interface 230 may be connected via a bus or a signal line. Each peripheral terminal may be connected to the peripheral terminal interface 230 via a bus, a signal line or a circuit board. Specifically, the peripheral terminal includes: at least one of a radio frequency circuit 240, a display screen 250, an audio circuit 260 and a power supply 270.

[0086] The peripheral terminal interface 230 may be used to connect at least one peripheral terminal related to I / O (Input / output) to the processor 210 and the memory 220. In some embodiments, the processor 210, the memory 220, and the peripheral terminal interface 230 are integrated on the same chip or circuit board; in some other implementations, any one or two of the processor 210, the memory 220, and the peripheral terminal interface 230 may be implemented on a separate chip or circuit board, which is not limited in this embodiment.

[0087] The radio frequency circuit 240 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 240 communicates with the communication network and other IoT devices through electromagnetic signals, and the radio frequency circuit 240 is the communication circuit of the electronic device. The radio frequency circuit 240 converts the electrical signal into an electromagnetic signal for transmission, or converts the received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 240 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, an operator identity module card, and the like. The radio frequency circuit 240 can communicate with other terminals through at least one wireless communication protocol. The wireless communication protocol includes, but is not limited to: the World Wide Web, a metropolitan area network, an intranet, various generations of mobile communication networks (2G, 3G, 4G and 5G), a wireless local area network and / or a WiFi (Wireless Fidelity) network. In some embodiments, the radio frequency circuit 240 may also include circuits related to NFC (Near Field Communication), which is not limited in this application.

[0088] The display screen 250 is used to display the UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof. When the display screen 250 is a touch display screen, the display screen 250 also has the ability to collect touch signals on the surface or above the surface of the display screen 250. The touch signal can be input to the processor 210 as a control signal for processing. At this time, the display screen 250 can also be used to provide virtual buttons and / or virtual keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, the display screen 250 can be one, set on the front panel of the electronic device; in other embodiments, the display screen 250 can be at least two, respectively set on different surfaces of the electronic device or in a folding design; in other embodiments, the display screen 250 can be a flexible display screen, set on a curved surface or a folding surface of the electronic device. Even, the display screen 250 can also be set to a non-rectangular irregular shape, that is, a special-shaped screen. The display screen 250 can be made of materials such as LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode, organic light-emitting diode).

[0089] The audio circuit 260 may include a microphone and a speaker. The microphone is used to collect sound waves from the operator and the environment, and convert the sound waves into electrical signals and input them into the processor 210 for processing, or input them into the radio frequency circuit 240 to achieve voice communication. For the purpose of stereo acquisition or noise reduction, there may be multiple microphones, which are respectively arranged in different parts of the electronic device. The microphone may also be an array microphone or an omnidirectional acquisition microphone. The speaker is used to convert the electrical signal from the processor 210 or the radio frequency circuit 240 into sound waves. The speaker may be a traditional film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert the electrical signal into sound waves audible to humans, but also convert the electrical signal into sound waves inaudible to humans for purposes such as ranging. In some embodiments, the audio circuit 260 may also include a headphone jack.

[0090] The power supply 270 is used to power various components in the electronic device. The power supply 270 can be an alternating current, a direct current, a disposable battery, or a rechargeable battery. When the power supply 270 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery that is charged through a wired line, and a wireless rechargeable battery is a battery that is charged through a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0091] For a detailed description of the functions and execution processes of each functional module or component in the electronic device embodiment of the present application, reference can be made to the description in the above-mentioned method embodiments of the present application, which will not be repeated here.

[0092] In the several embodiments provided in the present application, it should be understood that the disclosed electronic devices and methods can be implemented in other ways. For example, the various embodiments of the electronic devices described above are only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0093] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0094] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0095] Based on the same inventive concept, the present application also provides a computer-readable storage medium storing a computer program, which can be executed by a processor to implement the above method.

[0096] See also Fig. 9 , if the above-mentioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium 300. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions / computer programs to enable an IoT device (which can be a personal computer, server, or network terminal, etc.) or a processor (processor) to execute all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks or optical disks, and electronic terminals such as computers, mobile phones, laptops, tablet computers, cameras, etc. having the above-mentioned storage media.

[0097] The description of the execution process of the program data in the computer-readable storage medium can refer to the description in the above-mentioned method embodiments of the present application, and will not be repeated here.

[0098] It can be seen that the present invention discloses an unauthorized access control method, device, equipment and medium, the method comprising the following steps: receiving an API access request, the API access request including API information of a first API to be accessed, and user information of a first user to be accessed, the API information including an API unique identifier, and the user information including a user unique identifier and a user role; judging whether the first user's access to the first API is authorized access or a first unauthorized access according to a preset initial API set and an API access request; based on the first user's authorized access to the first API, receiving a data access request from the first user, the data access request including data information of the first data to be accessed; obtaining a first data type corresponding to the first API according to the user information of the first user and the data information of the first data; judging whether the first user's access to the first data is authorized access or a second unauthorized access according to a plug-in corresponding to the first data type. The present invention controls the user's unauthorized access to the API and the corresponding data by controlling the first unauthorized access and the second unauthorized access, and can effectively protect the operation and data security of the API background software.

[0099] The above are only embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any equivalent structural transformations made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are included in the protection scope of the present invention.

Claims

1. An unauthorized access control method, characterized in that: The method comprises the following steps: Receive an API access request, the API access request including API information of a first API to be accessed and user information of a first user to access the first API, the API information including an API unique identifier, and the user information including a user unique identifier and a user role; According to a preset initial API set and the API access request, determining whether the first user's access to the first API is authorized access or a first unauthorized access; Based on the first user's authorized access to the first API, receiving a data access request from the first user, the data access request including data information of first data to be accessed; Obtaining a first data type corresponding to the first API according to the user information of the first user and the data information of the first data; According to the plug-in corresponding to the first data type, it is determined whether the first user's access to the first data is authorized access or second unauthorized access.

2. The unauthorized access control method according to claim 1, characterized in that: The method further comprises the steps of: The initial API set is configured according to the type of the external application, and includes a plurality of APIs accessible to users of the external application.

3. The unauthorized access control method according to claim 2, characterized in that: The type of the external application includes a first application type, and configuring the initial API set according to the type of the external application includes the steps of: Define a function menu set, the function menu set includes multiple function menus, and the function menu includes multiple APIs that a user can access through a page corresponding to the function menu; Define multiple user roles and authorize specific function menu permissions for each user role; An initial set of APIs accessible to users corresponding to each user role is determined.

4. The unauthorized access control method according to claim 2, characterized in that: The type of the external application includes a second application type, and configuring the initial API set according to the type of the external application includes the steps of: The initial set of APIs accessible to users of the external application is manually configured.

5. The unauthorized access control method according to claim 3, characterized in that: The step of judging, based on the preset initial API set and the API access request, whether the first user's access to the first API is authorized access or first unauthorized access, comprises the following steps: Determining, according to the user information of the first user, that the initial API set accessible to the first user is a first API set; Determine whether the first API set includes the first API; If the first API set includes the first API, it is determined that the first user's access to the first API is authorized.

6. The unauthorized access control method according to claim 4, characterized in that: The step of judging, based on the preset initial API set and the API access request, whether the first user's access to the API is authorized access or the first unauthorized access, comprises the following steps: Determining whether the external application is a legitimate application; If the external application is a legitimate application, determining that the initial API set is a second API set; Determine whether the second API set includes the first API; If the second API set includes the first API, it is determined that the first user's access to the first API is authorized.

7. The unauthorized access control method according to claim 1, characterized in that: The method further comprises the steps of: Designing multiple characteristic elements corresponding to API access, wherein the multiple characteristic elements include a user ID for accessing the API, a user ID set to which data to be accessed belongs, and a data type ID of the data to be accessed; Define a plug-in library, the plug-in library includes multiple plug-ins, each of which includes a permission judgment function; A plug-in framework is defined, the plug-in framework includes the plug-in, and the plug-in is dynamically deployed to the plug-in framework in a plug-and-play manner, so that the plug-in implements corresponding data access permission judgment through the permission judgment function.

8. An unauthorized access control device, characterized in that: The device comprises: An API access receiving unit, configured to receive an API access request, wherein the API access request includes API information of a first API to be accessed and user information of a first user to access the first API, wherein the API information includes an API unique identifier, and the user information includes a user unique identifier and a user role; A first judgment unit, configured to judge whether the first user's access to the first API is authorized access or a first unauthorized access according to a preset initial API set and the API access request; a data access receiving unit, configured to receive a data access request from the first user based on the first user's authorized access to the first API, wherein the data access request includes data information of first data to be accessed; a data type acquiring unit, configured to acquire a first data type corresponding to the first API according to the user information of the first user and the data information of the first data; The second judgment unit is used to judge whether the first user's access to the first data is authorized access or second unauthorized access according to the plug-in corresponding to the first data type.

9. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images