Authority authentication management system and method, electronic equipment and storage medium

Abstract

The invention discloses an authority authentication management system and method, electronic equipment and a storage medium, and the system comprises an authority management module which is used for storing and managing user authority information; and the authority authentication module is used for acquiring user request information, determining a user identity identifier according to the user request information, performing authority authentication according to the user identity identifier and the user authority information, and determining an authority authentication result. The method can achieve authority authentication and management, improves the stability and management efficiency of the system, guarantees the data safety, prevents data leakage, and can be widely applied to the technical field of authority authentication.

Description

Technical Field

[0001] The present application relates to the technical field of application authority authentication, and in particular to an authority authentication management system, method, electronic device and storage medium. Background Art

[0002] As the pace of digital construction accelerates, various application architectures emerge one after another, and distributed application development becomes more and more popular. In the era of big data, the sources of data become more and more extensive, and various types of data also grow explosively. Therefore, the requirements for data management and security are becoming higher and higher.

[0003] The existing distributed application system basically integrates multiple applications and permission management platforms, and manages the permissions of multiple applications through the permission management platform. However, there are problems such as complex integration and difficult management, as well as integrated data authentication risks and permission authentication risks. Among them, permission authentication risks will seriously affect data security and system stability, and may lead to the following adverse consequences:

[0004] 1) The storage and transmission of important data may face the risk of leakage or illegal access.

[0005] 2) Enabling permissions may allow specific users or systems to perform certain operations. If these operations are improper or used maliciously, the system may fail or be attacked, affecting the normal operation of the entire system. Summary of the invention

[0006] The main purpose of the embodiments of the present application is to propose an authority authentication management system, method, electronic device and storage medium, which can realize authority authentication and management, improve system stability and ensure data security.

[0007] On the one hand, an embodiment of the present application proposes a permission authentication management system, the system comprising:

[0008] The permission management module is used to store and manage user permission information;

[0009] The authority authentication module is used to obtain user request information, determine the user identity according to the user request information, perform authority authentication according to the user identity and the user authority information, and determine the authority authentication result.

[0010] In some embodiments, the rights management module includes a user management unit, a role management unit, and a rights allocation unit;

[0011] A role management unit, for determining a plurality of mutually exclusive roles for users in response to a role creation operation, and storing and managing the mutually exclusive roles for each user;

[0012] A user management unit, configured to generate a plurality of users in response to a user registration operation, determine a plurality of target mutually exclusive roles from the plurality of user mutually exclusive roles, and store and manage user identity information corresponding to each of the users and each of the target mutually exclusive roles;

[0013] The permission allocation unit is used to obtain integrated application permissions, respond to permission allocation operations, allocate permissions to each of the mutually exclusive user roles according to the integrated application permissions, determine the role permissions corresponding to each of the mutually exclusive user roles, and store and manage the role permissions corresponding to each of the mutually exclusive user roles.

[0014] In some embodiments, the rights management module further includes an application integration unit;

[0015] The application integration unit is used to connect and manage multiple system-related applications, obtain the application operation permissions corresponding to each of the system-related applications, integrate the application operation permissions, determine the integrated application permissions and store and manage them.

[0016] In some embodiments, the authority authentication module includes an authority acquisition unit and a request parsing unit;

[0017] The request parsing unit is used to parse the user request information and determine the user identity;

[0018] The permission acquisition unit is used to obtain the user identity information corresponding to each of the users, determine the target user information corresponding to the user identity identifier from the user identity information corresponding to each of the users, and obtain the target user permissions corresponding to the target user information, wherein the target user permissions include the role permissions corresponding to each of the target mutually exclusive roles corresponding to the target user information.

[0019] In some embodiments, the authority authentication module further includes an authority authentication unit;

[0020] The authority authentication unit is used to determine a target role from the multiple target mutually exclusive roles corresponding to the target user information in response to a role selection operation, and determine a target role authority corresponding to the target role from the target user authority.

[0021] In some embodiments, the system further comprises:

[0022] The application access module is used to call the target role permissions to access the application.

[0023] In some embodiments, the application access module includes a permission generation unit and a request forwarding unit;

[0024] The permission generation unit is used to determine a number of target access applications and a minimum permission set corresponding to each of the target access applications according to the target role permission, and generate an application access permission set according to each of the target access applications and the minimum permission set corresponding to each of the target access applications;

[0025] The request forwarding unit is used to call the application access permission set to perform application access on each of the target access applications.

[0026] On the other hand, an embodiment of the present application proposes a method for managing authority authentication, the method comprising the following steps:

[0027] Obtain user permission information and user request information;

[0028] Determining a user identity according to the user request information;

[0029] According to the user identity identifier and the user authority information, authority authentication is performed to determine the authority authentication result.

[0030] On the other hand, an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the aforementioned permission authentication management method when executing the computer program.

[0031] On the other hand, an embodiment of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned permission authentication management method.

[0032] The embodiments of the present application include at least the following beneficial effects: the present application provides a permission authentication management system, method, electronic device and storage medium, which stores and manages user permission information through a permission management module, obtains user request information through a permission authentication module, determines the user identity according to the user request information, performs permission authentication according to the user identity and user permission information, determines the permission authentication result, performs permission authentication, and determines the permission authentication result. The present application can realize permission authentication and management, improve the stability and management efficiency of the system, ensure data security, and prevent data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0035] Figure 1 It is a structural diagram of a permission authentication management system provided by an embodiment of the present application;

[0036] Figure 2 It is a structural diagram of the rights management module in the embodiment of the present application;

[0037] Figure 3 is a schematic diagram of role allocation in an embodiment of the present application;

[0038] Figure 4 It is a schematic diagram of authority allocation in an embodiment of the present application;

[0039] Figure 5 is a schematic diagram of establishing a multiple account system in an embodiment of the present application;

[0040] Figure 6 It is a schematic diagram of the structure of the permission authentication module in the embodiment of the present application;

[0041] Figure 7 is a schematic diagram of role selection in an embodiment of the present application;

[0042] Figure 8 is a schematic diagram of the structure of the application access module in an embodiment of the present application;

[0043] Fig. 9 It is a flowchart of a permission authentication management method provided by an embodiment of the present application;

[0044] Fig.10 It is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0046] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0047] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0048] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0049] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0050] Before describing the embodiments of the present application in detail, some nouns and terms involved in the embodiments of the present application are first described. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0051] 1) OAuth 2.0: It is an open standard authorization protocol used to authorize third-party applications to access the user's resources on another service provider without sharing the user's credentials (such as username and password). OAuth 2.0 is developed from the open authorization protocol, is incompatible with OAuth 1.0, and has a high degree of security and scalability. It is widely used in interface authentication of various open platforms. Compared with Oauth1.0, Oauth2.0 pays more attention to the simplicity of client developers, and provides special authentication processes for Web applications, desktop applications, mobile phones, and living room devices.

[0052] 2) API (Application Programming Interface): is a set of rules and protocols that define how software components interact with each other. Simply put, API is a medium for data transmission and interaction between different software systems. API allows a program to access the functions or data of another program by calling the interface provided by another program. For example, when you use the weather app on your phone, this app may obtain real-time weather data by calling the API provided by the meteorological department.

[0053] 3) Header: refers to the HTTP request header, which is part of the HTTP protocol and is used to pass additional information between the client and the server. These header fields use a key-value pair structure to manage related data in the form of keys and values. The keys and values ​​are in accordance with the standards in the RFC document and are not customized by the programmer.

[0054] 4) Application access interception: It refers to blocking or limiting access to specific applications or resources through technical means to protect system security and data privacy. This technical means is widely used in network security, enterprise management and personal privacy protection.

[0055] 5) Application access authentication: This refers to the process of verifying whether a user has the authority to access or operate data and functions in an application. Authentication usually involves identity verification to ensure that the user has the right to access specific resources.

[0056] 6) Application access circuit breaker: In a distributed system, when a service takes too long to respond or fails due to some reasons (such as network delay, insufficient resources, etc.), the access to the service is temporarily stopped through the circuit breaker mechanism to protect the stability and availability of the system. When the service returns to normal, the circuit breaker will be reopened to restore access to the service.

[0057] 7) Application access forwarding: refers to the process of forwarding a client's request from one resource to another, which usually occurs inside the server and is invisible to the client. During the forwarding process, the client's URL will not change because the forwarding is completed on the server side and no new requests and responses are created, so it is more efficient.

[0058] 8) Application access degradation: This refers to sacrificing some non-core functions or services to ensure the stability and availability of core functions when the system is under high load or abnormal conditions. The degradation strategy reduces or shuts down certain functions or services to avoid system crashes or performance degradation and ensure the normal operation of key businesses.

[0059] 9) HTTP (Hypertext Transfer Protocol): It is an application layer protocol used to transfer data between web browsers and web servers. It defines the rules for communication between clients and servers and usually runs on top of TCP / IP. HTTP is a simple request-response protocol where the client sends a request to the server and the server processes it and returns a response.

[0060] 10) Minimum privilege set: refers to the minimum privilege set required by each program and system user to perform operations. The principle of least privilege (PoLP) was first proposed by Saltzer and Schroeder. Its core idea is that each program and system user should have the minimum privilege set required to complete the task. This principle aims to protect data and functions and prevent errors or malicious behavior from damaging the system. The principle of least privilege requires that each module in the computing environment (such as a process, user or computer program) can only access the information or resources that are necessary at the moment.

[0061] 11) Nacos: Nacos (Dynamic Naming and Configuration Service) is a dynamic service discovery, configuration management and service management platform designed to help build cloud-native applications. Nacos supports dynamic service discovery, configuration management, service health monitoring and dynamic configuration services, and is particularly suitable for microservice architectures and cloud-native environments.

[0062] 12) Spring Framework is an open source Java enterprise application development framework initiated by Rod Johnson. It aims to solve the complexity of enterprise application development and simplify the development process by providing a lightweight container and a series of powerful features such as IOC (Inversion of Control) and AOP (Aspect-Oriented Programming).

[0063] 13) Spring Boot: It is an open source framework developed by the Pivotal team, which aims to simplify the initial construction and development process of Spring applications. It greatly reduces the cumbersome configuration requirements and improves development efficiency through automatic configuration and the concept of "convention over configuration".

[0064] 14) Spring Cloud: It is a microservice framework based on Spring Boot, which aims to simplify the development of distributed systems. It integrates multiple mature microservice components and provides a one-stop solution, including service discovery, configuration management, load balancing, circuit breakers and other functions.

[0065] As the pace of digital construction accelerates, various application architectures emerge one after another, and distributed application development becomes more and more popular. In the era of big data, the sources of data become more and more extensive, and various types of data also grow explosively. Therefore, the requirements for data management and security are becoming higher and higher.

[0066] The existing distributed application system basically integrates multiple applications and permission management platforms, and manages the permissions of multiple applications through the permission management platform. However, there are problems such as complex integration and difficult management, as well as integrated data authentication risks and permission authentication risks. Among them, permission authentication risks will seriously affect data security and system stability, and may lead to the following adverse consequences:

[0067] 1) The storage and transmission of important data may face the risk of leakage or illegal access.

[0068] 2) Enabling permissions may allow specific users or systems to perform certain operations. If these operations are improper or used maliciously, the system may fail or be attacked, affecting the normal operation of the entire system.

[0069] Based on this, the embodiments of the present application propose a permission authentication management system, method, electronic device and storage medium. By integrating the design of a permission authentication architecture for multiple applications, it comprehensively manages information such as multiple applications, multiple organizations and multiple users, adds dual authentication verification of organizational entities and business systems, satisfies different users' permission request access to multiple applications, and realizes decentralized and domain-based management of different organizations and applications. Through the logical separation of users and permissions, it simplifies the relationship between users and permissions, makes permission rules easier to expand and maintain, and improves the permission management effect.

[0070] Reference Figure 1 , Figure 1 This is an optional structural diagram of a permission authentication management system provided in an embodiment of the present application. The device may include:

[0071] The permission management module is used to store and manage user permission information;

[0072] The authority authentication module is used to obtain user request information, determine the user identity based on the user request information, perform authority authentication based on the user identity and user authority information, and determine the authority authentication result.

[0073] In some embodiments, the above-mentioned authority authentication management system takes authority authentication as the core of the base. The system architecture design meets the requirements of configurability and strong extensibility, is compatible with the authority adaptation of different frameworks, and can efficiently and quickly integrate multiple applications. The authority authentication management system uniformly manages user account management, user authorization, identity authentication, authority control and other behaviors. Each user has a unique identity and is granted different role permissions. Through the mapping between users, roles and permissions, the principle of least privilege, the principle of separation of responsibilities and the principle of data abstraction are met. That is, the role can be configured into the minimum permission set required to complete the task, or sensitive tasks can be completed together by calling mutually independent and exclusive roles. Role allocation can also be reflected through the abstraction of permissions.

[0074] Specifically, the permission authentication management system provides a unified API to connect with each application and subsystem. Based on the system account permission authentication and verification, it configures multiple security protections such as application access authentication, application access interception, application access circuit breaking and application access downgrade at the gateway layer to achieve decentralized and domain-based management of different organizations and applications. The permission authentication management system is based on the OAuth2.0 authorization network standard, simplifies cumbersome encryption algorithms, adapts to multiple login authentication modes, and meets multi-application permission authentication. The system divides multiple account systems, and the permissions enjoyed by different account systems in the platform are distinguished through role mapping.

[0075] In some embodiments, reference Figure 2 , Figure 2 is an optional structural diagram of a rights management module in an embodiment of the present application, wherein the rights management module includes a user management unit, a role management unit, a rights allocation unit and an application integration unit;

[0076] A role management unit, for determining a plurality of mutually exclusive roles for users in response to a role creation operation, and storing and managing the mutually exclusive roles for each user;

[0077] A user management unit, for generating multiple users in response to a user registration operation, determining a number of target mutually exclusive roles from multiple user mutually exclusive roles, and storing and managing user identity information and target mutually exclusive roles corresponding to each user;

[0078] A permission allocation unit, used to obtain integrated application permissions, respond to permission allocation operations, allocate permissions to mutually exclusive roles of each user according to the integrated application permissions, determine the role permissions corresponding to each mutually exclusive role of each user, and store and manage the role permissions corresponding to each mutually exclusive role of each user;

[0079] The application integration unit is used to connect and manage multiple system-related applications, obtain the application operation permissions corresponding to each system-related application, integrate the application operation permissions, determine the integrated application permissions and store and manage them.

[0080] In some embodiments, a plurality of mutually exclusive user roles are created in a role management unit, the role management unit is connected to a user management unit, a mapping relationship between users and roles is established through the user management unit, a plurality of target mutually exclusive roles corresponding to each user are determined from the plurality of mutually exclusive user roles, an association is established between the user identity information corresponding to each user and each target mutually exclusive role, the user identity information of each user and each target mutually exclusive role are stored and managed, and optionally, reference is made to Figure 3 , Figure 3 It is an optional schematic diagram of role allocation in an embodiment of the present application, wherein users 1 to 3 are stored in a user management unit, user mutually exclusive roles A to D are stored in a role management unit, the user management unit is connected to the role management unit, and several target mutually exclusive roles for each user are determined from the user mutually exclusive roles A to D. Specifically, user 1 is associated with target mutually exclusive roles A to C, user 2 is associated with target mutually exclusive roles B and D, and user 3 is associated with target mutually exclusive role C.

[0081] In some embodiments, the permission allocation unit stores and manages integrated application permissions, including application operation permissions corresponding to each system-related application. The role management unit is connected to the permission allocation unit, and a mapping relationship between roles and permissions is established through the permission allocation unit. The role permissions corresponding to each user's mutually exclusive role are determined from the integrated application permissions. For example, referring to Figure 4 , Figure 4 It is an optional schematic diagram of permission allocation in an embodiment of the present application. The permission allocation unit stores application operation permissions 1 to 5, and the role management unit stores user mutually exclusive roles A and B. The role management unit is connected to the permission allocation unit. Several target application permissions of each user mutually exclusive role are determined from application operation permissions 1 to 5. Specifically, user mutually exclusive role A is associated with application operation permissions 1 to 4, and user mutually exclusive role B is associated with application operation permissions 3 to 5.

[0082] In some embodiments, the application integration unit integrates multiple applications, integrates the operation permissions of each application, obtains the corresponding integrated application permissions, and establishes a multi-account system through the application integration unit, the user management unit, the role management unit and the permission allocation unit. The permissions enjoyed by different account systems in the permission authentication management system are distinguished by role mapping. For example, referring to Figure 5 , Figure 5It is an optional schematic diagram of establishing a multiple account system in an embodiment of the present application, wherein a user management unit stores multiple users, a role management unit stores multiple mutually exclusive user roles corresponding to each user, an integrated application permission is obtained from an application integration unit through a permission allocation unit, and then part or all of the application operation permissions in the integrated application permission are allocated to each user mutually exclusive role, the role permissions corresponding to each user mutually exclusive role are determined and stored, the user management unit is connected to the role management unit, the role management unit is connected to the permission allocation unit, the permission allocation unit is connected to the application integration unit, an association between user-user mutually exclusive role-integrated application permission is established, and a multiple account system is obtained.

[0083] In some embodiments, optionally, the permission allocation unit has the following permission allocation principles:

[0084] 1) There is a one-to-many relationship between users and roles: a user can have different mutually exclusive roles, and each role has at least one permission. Users and permissions are separated and independent, making the authorization and authentication of permissions more flexible.

[0085] 2) Allow role inheritance: Inheritance relationships can be divided into general inheritance relationships and restricted inheritance relationships. General inheritance relationships only require that the role inheritance relationship is an absolute partial order relationship, allowing multiple inheritance between roles, that is, a role can inherit the permissions of multiple parent roles, and there is no specific hierarchy or order requirement between these parent roles. Restricted inheritance relationships further require that the role inheritance relationship is a tree structure, that is, each role can only have one parent role, realizing single inheritance between roles, and roles can be grouped and layered to form a clear hierarchical structure.

[0086] 3) Mutually exclusive roles: refers to roles whose permissions restrict each other. The same user can only be assigned to at most one role in a set of mutually exclusive roles, supporting the principle of separation of duties. Mutually exclusive roles refer to two roles whose permissions restrict each other. For this type of role, a user can only be assigned one of the roles in a certain activity, and cannot obtain the right to use both roles at the same time;

[0087] 4) Cardinality constraint: The number of users assigned to a role is limited, the number of roles a user can have is limited, and the number of access rights corresponding to a role should also be limited to control the allocation of advanced permissions in the system;

[0088] 5) Prerequisite roles: A role can be assigned to a user only if the user is already a member of another role; correspondingly, access rights can be assigned to a role only if the role already has another access right, that is, in order for a role to obtain a higher level of permission, it must first have a lower level of permission.

[0089] 6) The roles are mutually exclusive at runtime, allowing a user to have membership in two roles, but the two roles cannot be activated at the same time during operation.

[0090] In some embodiments, reference Figure 6 , Figure 6 : is an optional structural diagram of the permission authentication module in the embodiment of the present application, wherein the permission authentication module includes a permission acquisition unit, a request parsing unit and a permission authentication unit;

[0091] A request parsing unit, used to parse user request information and determine the user identity;

[0092] The permission acquisition unit is used to acquire the user identity information corresponding to each user, determine the target user information corresponding to the user identity identifier from the user identity information corresponding to each user, and acquire the target user permissions corresponding to the target user information, wherein the target user permissions include the role permissions corresponding to each target mutually exclusive role corresponding to the target user information;

[0093] The authority authentication unit is used to determine the target role from multiple target mutually exclusive roles corresponding to the target user information in response to the role selection operation, and determine the target role authority corresponding to the target role from the target user authority.

[0094] In some embodiments, reference Figure 7 , Figure 7 It is an optional schematic diagram of role selection in an embodiment of the present application. Assuming that there is user 1, user 1 has target mutually exclusive roles A to D, and performs a user selection operation. User 1 determines the target role from target mutually exclusive roles A to D. If the target role is target mutually exclusive role A, the role permissions corresponding to the target mutually exclusive role A are determined as the target role permissions. Then, after user 1 completes the corresponding application access task, user 1 can also perform a target role switching operation to determine the role to be switched from target mutually exclusive roles A to D. Assuming that the role to be switched is target mutually exclusive role D, the target role is switched from target mutually exclusive role A to target mutually exclusive role D, and then the role permissions corresponding to the target mutually exclusive role D are obtained as the target role permissions.

[0095] In some embodiments, user request information is transmitted to a permission authentication module via the HTTP protocol, the Header of the user request information carries a user identity identifier, the user request information is parsed by a request parsing unit to determine the user identity identifier, permission authentication is performed by a permission acquisition unit, target user information is determined based on the user identity identifier, and target user permissions corresponding to the target user information are obtained from the permission management module, the target role called by the user is determined by the permission authentication unit, and the target role permissions corresponding to the target role are obtained from the target user permissions.

[0096] In some embodiments, the above-mentioned permission authentication management system further includes an application access module;

[0097] The application access module is used to call the target role permissions to access the application.

[0098] In some embodiments, the application access module calls the target role permissions so that the user can access the application and perform related application operations on multiple targets corresponding to the access target role permissions.

[0099] In some embodiments, reference Figure 8 , Figure 8 is an optional structural diagram of an application access module in an embodiment of the present application, wherein the application access module includes a permission generation unit and a request forwarding unit;

[0100] The permission generation unit is used to determine a number of target access applications and a minimum permission set corresponding to each target access application according to the target role permission, and generate an application access permission set according to each target access application and the minimum permission set corresponding to each target access application;

[0101] The request forwarding unit is used to call the application access permission set and perform application access on each target access application.

[0102] In some embodiments, the permission generation unit determines the minimum permission set required for each target access application and the user to access each target access application according to the target role permissions. Assuming there are target access applications X and Y, the minimum permission set corresponding to target access application X is TX, and the minimum permission set corresponding to target access application Y is TY. When the user wants to access target access application X, the minimum permission set TX is called, and then application access is performed on target access application X, and so on.

[0103] In some embodiments, optionally, the above-mentioned permission authentication management system integrates the Nacos registration center, and according to the simple and easy-to-use feature set provided by the Nacos registration center, dynamic service discovery, service configuration management, service and traffic management are quickly implemented to improve the permission management effect of the permission authentication management system.

[0104] Nacos can be integrated with Spring, Spring Boot and Spring Cloud, and can replace Spring Cloud Eureka and Spring Cloud Config. Optionally, Nacos implements dynamic configuration changes through Nacos Server and spring-cloud-starter-alibaba-nacos-config, and implements service registration and discovery through spring-cloud-starter-alibaba-nacos-discovery.

[0105] Through the integrated Nacos registration center, the permission authentication management system can achieve the following functions:

[0106] 1) Service discovery and health check, making it easier for services to register themselves and discover other services through DNS or HTTP interfaces. Provide real-time health checks of services to prevent requests from being sent to unhealthy hosts or service instances.

[0107] 2) Dynamic Configuration Management, Dynamic Configuration Services allow the configuration of all services in all environments to be managed in a centralized and dynamic manner. Eliminating the need to redeploy applications and services when updating configurations makes configuration changes more efficient and flexible.

[0108] 3) Dynamic DNS service, supporting weighted routing, can more easily implement middle-tier load balancing, flexible routing policies, traffic control, and simple DNS resolution services in the production environment of the data center. DNS-based service discovery can be easily implemented and prevent applications from being coupled to vendor-specific service discovery APIs.

[0109] 4) Service and metadata management, providing an easy-to-use service dashboard to manage service metadata, configuration, kubernetes DNS, service health and indicator statistics.

[0110] The permission authentication management system provided in the embodiment of the present application can prevent service downtime problems by integrating the Nacos registration center, and can also meet the needs of a large number of user accesses and high concurrent requests. At the same time, on the basis of integrating the Nacos registration center, a load balancing strategy is added to improve the stability and security of the service, which can not only solve the concurrency pressure and improve the application processing performance, but also realize the failover function and high availability, thereby improving the security protection performance of the permission authentication management system.

[0111] Reference Fig. 9 , Fig. 9 This is an optional flowchart of a permission authentication management method provided in an embodiment of the present application. The method may include but is not limited to steps S101 to S103:

[0112] Step S101, obtaining user authority information and user request information;

[0113] Step S102, determining the user identity according to the user request information;

[0114] Step S103, performing authority authentication according to the user identity and user authority information, and determining the authority authentication result.

[0115] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0116] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned permission authentication management method when executing the computer program. The electronic device can be any smart terminal including a tablet computer.

[0117] It can be understood that the contents of the above system embodiments are all applicable to the present method embodiments, the functions specifically implemented by the present method embodiments are the same as those of the above system embodiments, and the beneficial effects achieved are also the same as those achieved by the above system embodiments.

[0118] See also Fig.10 , Fig.10 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0119] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0120] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the permission authentication management method of the embodiment of this application;

[0121] Input / output interface 903, used to implement information input and output;

[0122] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0123] A bus 905 that transmits information between the various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0124] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0125] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the above-mentioned permission authentication management method is implemented.

[0126] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0127] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0128] The embodiments of the present application provide a permission authentication management system, method, electronic device, and storage medium, which store and manage user permission information through a permission management module, obtain user request information through a permission authentication module, determine the user identity and target permission request information based on the user request information, determine the target user permission that matches the user identity from the user permission information, perform permission authentication based on the target user permission and the target permission request information, and determine the permission authentication result. The embodiments of the present application can realize permission authentication and management, improve the stability and management efficiency of the system, ensure data security, and prevent data leakage.

[0129] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0130] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0131] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0132] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0133] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0134] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0135] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0136] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0138] It should be appreciated that embodiments of the present invention may be implemented or enforced by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory computer-readable memory. The method may be implemented in a computer program using standard programming techniques including a non-transitory computer-readable storage medium configured with a computer program, wherein the storage medium so configured causes the computer to operate in a specific and predefined manner - according to the methods and drawings described in the specific embodiments. Each program may be implemented in a high-level procedural or object-oriented programming language to communicate with a computer system. However, if desired, the program may be implemented in an assembly or machine language. In any case, the language may be a compiled or interpreted language. In addition, the program may be run on a programmed ASIC for this purpose.

[0139] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0140] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A permission authentication management system, characterized in that: The system comprises: The permission management module is used to store and manage user permission information; The authority authentication module is used to obtain user request information, determine the user identity according to the user request information, perform authority authentication according to the user identity and the user authority information, and determine the authority authentication result.

2. The authority authentication management system according to claim 1, characterized in that: The authority management module includes a user management unit, a role management unit and a authority allocation unit; A role management unit, for determining a plurality of mutually exclusive roles for users in response to a role creation operation, and storing and managing the mutually exclusive roles for each user; A user management unit, configured to generate a plurality of users in response to a user registration operation, determine a plurality of target mutually exclusive roles from the plurality of user mutually exclusive roles, and store and manage user identity information corresponding to each of the users and each of the target mutually exclusive roles; The permission allocation unit is used to obtain integrated application permissions, respond to permission allocation operations, allocate permissions to each of the mutually exclusive user roles according to the integrated application permissions, determine the role permissions corresponding to each of the mutually exclusive user roles, and store and manage the role permissions corresponding to each of the mutually exclusive user roles.

3. The authority authentication management system according to claim 2, characterized in that: The rights management module also includes an application integration unit; The application integration unit is used to connect and manage multiple system-related applications, obtain the application operation permissions corresponding to each of the system-related applications, integrate the application operation permissions, determine the integrated application permissions and store and manage them.

4. The authority authentication management system according to claim 2, characterized in that: The authority authentication module includes an authority acquisition unit and a request parsing unit; The request parsing unit is used to parse the user request information and determine the user identity; The permission acquisition unit is used to obtain the user identity information corresponding to each of the users, determine the target user information corresponding to the user identity identifier from the user identity information corresponding to each of the users, and obtain the target user permissions corresponding to the target user information, wherein the target user permissions include the role permissions corresponding to each of the target mutually exclusive roles corresponding to the target user information.

5. The authority authentication management system according to claim 4, characterized in that: The authority authentication module also includes an authority authentication unit; The authority authentication unit is used to determine a target role from the multiple target mutually exclusive roles corresponding to the target user information in response to a role selection operation, and determine a target role authority corresponding to the target role from the target user authority.

6. The authority authentication management system according to claim 5, characterized in that: The system further comprises: The application access module is used to call the target role permissions to access the application.

7. The authority authentication management system according to claim 6, characterized in that: The application access module includes a permission generation unit and a request forwarding unit; The permission generation unit is used to determine a number of target access applications and a minimum permission set corresponding to each of the target access applications according to the target role permission, and generate an application access permission set according to each of the target access applications and the minimum permission set corresponding to each of the target access applications; The request forwarding unit is used to call the application access permission set to perform application access on each of the target access applications.

8. A method for managing authority authentication, characterized in that: The method comprises the following steps: Obtain user permission information and user request information; Determining a user identity according to the user request information; According to the user identity identifier and the user authority information, authority authentication is performed to determine the authority authentication result.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the authority authentication management method described in claim 8 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the permission authentication management method described in claim 8 is implemented.

Images