System access control method and device, storage medium and computer program product

Abstract

The invention discloses a system access control method and device, a storage medium and a computer program product. The method comprises the steps that a system access request initiated by a target object is acquired, the system access request at least comprises first identification information of a target system, second identification information of the target object and website information when the target object accesses the target system, and the first identification information at least comprises an identification of a network environment where the target system is located; comprising an intranet identifier or an extranet identifier; verifying the legality of the second identification information and the website information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object according to the obtained verification result. According to the method and the device, the technical problems that resources required for deployment are more due to the fact that background servers are deployed in the current internal network and the current external network respectively, and more system overhead is consumed due to the fact that a user needs to share and exchange among the systems when accessing the systems in the internal network and the external network are solved.

Description

Technical Field

[0001] The present application relates to the field of electronic information technology, and in particular to a system access control method and device, a storage medium, and a computer program product. Background Art

[0002] With the progress of informatization, due to the increasing requirements for information disclosure and work transparency, the demand for enterprise informatization projects has evolved from the initial single intranet application to the integrated function of multiple subsystems of both the intranet and the intranet. In the early stages of development, the intranet application was built first, and then the demand for the external network application was proposed. Therefore, the more common situation of enterprise informatization projects is that the external network application is built by one manufacturer, and the intranet is built by another manufacturer, and the data is interoperable between the systems through data sharing and exchange mechanisms.

[0003] However, in recent years, more and more enterprises have demanded to directly integrate multiple intranet and extranet subsystems into one system, and the construction of such multiple subsystems usually requires strict isolation of users and functions between different intranet and extranet subsystems. In other words, intranet user accounts cannot be used to log in to extranet applications, and extranet user accounts cannot be used to log in to intranet systems. In this scenario, if multiple subsystems are developed independently, it can undoubtedly meet the needs, but these multiple subsystems are essentially a large application, so the implementation and deployment of these multiple systems requires multiple server resources; in addition, data access between these subsystems still needs to be achieved through shared exchange, which will undoubtedly increase additional system overhead and complexity.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a system access control method and device, a storage medium, and a computer program product to at least solve the technical problem that the current intranet and extranet are each deployed with a backend server, resulting in a large number of resources required for deployment, and when users access the systems in the intranet and extranet, they need to share and exchange between systems, resulting in a large amount of system overhead.

[0006] According to one aspect of an embodiment of the present application, a system access control method is provided, comprising: obtaining a system access request initiated by a target object, wherein the system access request includes at least: first identification information of a target system to be accessed, second identification information of the target object, and website address information when the target object accesses the target system, and the first identification information includes at least: a network environment identifier of the target system, the network environment identifier includes: an intranet identifier or an extranet identifier; verifying the legitimacy of the second identification information and website address information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object based on the obtained verification result.

[0007] Optionally, the legitimacy of the second identification information and the website address information in the system access request is verified based on the first identification information in the system access request, including: matching the first identification information in the system access request with a preset system access configuration table to obtain corresponding target access configuration information, wherein the system access configuration table includes the association relationship between the first identification information of multiple systems and the corresponding access configuration information, and the access configuration information at least includes: the website address information of the preset system and the second identification information of multiple objects with access rights, and the website address information includes at least one of the following: a uniform resource locator, an endpoint of an application programming interface; based on the matching result between the target access configuration information and the second identification information and the website address information in the system access request, the legitimacy of the second identification information and the website address information in the system access request is determined.

[0008] Optionally, the legitimacy of the second identification information and the URL information in the system access request is determined based on a matching result between the target access configuration information and the second identification information and the URL information in the system access request, including: when the target access configuration information is the same as the second identification information and the URL information in the system access request, determining that the second identification information and the URL information in the system access request have passed the legitimacy check; when the target access configuration information is different from the second identification information and / or the URL information in the system access request, determining that the second identification information and / or the URL information in the system access request have not passed the legitimacy check.

[0009] Optionally, a corresponding access result is fed back to the target object based on the obtained verification result, including: if the second identification information and the URL information in the system access request pass the legality verification, respond to the system access request, and feed back the response result corresponding to the system access request to the target object as the access result; if the second identification information and / or the URL information in the system access request fails the legality verification, taking the failure of the second identification information and / or the URL information to pass the legality verification as the reason for access failure, and feeding back the reason for access failure as the access result to the target object.

[0010] Optionally, the access result also includes: an HTTP status code, wherein a system access request is responded to, and the response result corresponding to the system access request is fed back to the target object as the access result, including: when the system access request response is successful, the access result carrying the success status code is fed back to the target object; when the system access request response fails, the corresponding response failure reason is determined, and the access result carrying the server error status code and the response failure reason is fed back to the target object.

[0011] Optionally, when the second identification information and / or website information in the system access request fails to pass the legality check, the access result also includes a client error status code.

[0012] Optionally, the system access request also includes: an encrypted ciphertext obtained by encrypting the first identification information, the second identification information and the URL information using a preset encryption key, wherein after obtaining the system access request initiated by the target object, the method also includes: decrypting the encrypted ciphertext in the system access request using a preset decryption key to obtain decrypted information.

[0013] According to another aspect of an embodiment of the present application, a system access control device is also provided, including: an acquisition module, used to acquire a system access request initiated by a target object, wherein the system access request includes at least: first identification information of the target system to be accessed, second identification information of the target object, and website information when the target object accesses the target system, and the first identification information includes at least: a network environment identifier of the target system, and the network environment identifier includes: an intranet identifier or an extranet identifier; a request verification module, used to verify the legitimacy of the second identification information and website information in the system access request based on the first identification information in the system access request; and a feedback module, used to feedback the corresponding access result to the target object based on the obtained verification result.

[0014] According to another aspect of an embodiment of the present application, a non-volatile storage medium is further provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned system access control method by running the computer program.

[0015] According to another aspect of an embodiment of the present application, a computer program product is further provided. The computer program product includes a stored computer program, wherein the computer program implements the above-mentioned system access control method when executed by a processor.

[0016] In an embodiment of the present application, the backend server performs a legitimacy check on the second identification information of the target object embedded in the request and the website information when the target object accesses the target system based on the first identification information of the target system in the system access request, and feeds back the corresponding access result based on the verification result. The technical effect of achieving multiple systems in the intranet and extranet sharing the same backend service and accurately controlling and verifying the security of user identities and functional access rights is achieved, which effectively reduces the system deployment and maintenance costs without affecting the business logic, while ensuring the strict isolation of intranet and extranet users and functions, and improving the overall security and efficiency of the system. This further solves the current technical problem that the intranet and extranet are each deployed with a backend server, resulting in more resources required for deployment, and that users need to access the systems in the intranet and extranet through shared exchanges between systems, resulting in more system overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a hardware structure block diagram of an optional computer terminal (or mobile device) according to an embodiment of the present application;

[0019] Figure 2 is a flowchart of an optional system access control method according to an embodiment of the present application;

[0020] Figure 3 is a schematic structural diagram of an optional system access control device according to an embodiment of the present application;

[0021] Figure 4 is a schematic structural diagram of another optional system access control device according to an embodiment of the present application;

[0022] Figure 5 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] In addition, the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0026] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0027] Intranet: refers to a private network within an organization. Although it uses Internet technologies, such as TCP / IP protocol and HTTP protocol, it is only accessible to employees or authorized personnel within the organization. Therefore, the intranet usually contains sensitive information, internal resources and applications, such as the company's internal mail system, file sharing, OA system, etc. Access to the intranet is strictly controlled and generally requires a username, password or other identity authentication mechanism to enter.

[0028] Extranet: refers to a network architecture that allows external users (such as customers, suppliers or partners) to access certain selected services in the internal network of an organization. Extranet can be regarded as an extension of the internal network, but the access rights are more strictly restricted, allowing external users to access only specific information or applications that the organization consciously makes public or shared. Extranet access usually also requires authentication, but its user group is wider than that of the internal network.

[0029] Example 1

[0030] According to an embodiment of the present application, an embodiment of a system access control method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a system access control method. Figure 1 As shown, the computer terminal 10 (or mobile device 10) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0032] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the system access control method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the system access control method of the above-mentioned application is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0035] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0036] In the above operating environment, Figure 2 is a flow chart of an optional system access control method according to an embodiment of the present application, such as Figure 2 As shown, the method at least includes steps S202-S206, wherein:

[0037] Step S202: obtaining a system access request initiated by the target object.

[0038] In the technical solution provided in step S202, the target object may be a user or program that initiates an access request, including but not limited to a staff member, a specific application or a service. The system access request may be a request to access an intranet system or an extranet system. Therefore, the system access request includes at least: the first identification information of the target system to be accessed (i.e., the unique identification of the target system), the second identification information of the target object (i.e., the identity information of the target object, including but not limited to a user account, an API key or an authentication token), and the URL information when the target object accesses the target system (i.e., the specific path or resource address of the target object to access the target system).

[0039] Among them, in order to enable the intranet system and the extranet system to share the same background service, the first identification information of the target system at least includes: the network environment identification of the target system, and the network environment identification includes: intranet identification (such as intra_, internal, etc., to identify that the target system is located in the internal network of the organization) or extranet identification (such as extra_, external, etc., to identify that the target system is located in the external network of the organization). In addition, the first identification information of the target system can also include: system code, system ID, version information, service name, etc.

[0040] As an optional implementation, the system access request also includes: encrypted ciphertext obtained by encrypting the first identification information, the second identification information and the website information using a preset encryption key. Then, after receiving the system access request, the background server will use the pre-decryption key to decrypt the encrypted ciphertext in the system access request to obtain decrypted information. The decryption process ensures the security of information during transmission and prevents unauthorized third parties from tampering with or intercepting key access information. Among them, the decryption key and the encryption key for encrypting the identification information and the website information are pre-negotiated between the target system and the background server, and the encryption algorithm can be an algorithm such as HMAC or SHA-256.

[0041] After completing the above decryption operation, the background system will execute the following step S204 based on the first identification information, the second identification information and the website information in the decrypted information.

[0042] Step S204: verify the legitimacy of the second identification information and the website address information in the system access request based on the first identification information in the system access request.

[0043] As an optional implementation, in the technical solution provided in the above step S204, the method may include:

[0044] Step S2041: Match the first identification information in the system access request with a preset system access configuration table to obtain corresponding target access configuration information.

[0045] In the technical solution provided in step S2041, the matching process can be understood as: the background server (also known as the business microservice cluster) compares the first identification information in the system access request with the record content in the system access configuration table to obtain the target access configuration information. Specifically, the background server can pre-integrate the microservices of multiple systems, and pre-configure the association between the first identification information of each system and the corresponding access configuration information, obtain the system access configuration table, and store the system access configuration table in a preset database. Among them, the access configuration information includes at least: the URL information of the pre-set system (also known as the functional address) and the second identification information of multiple objects with the authority to access the system, and the URL information can be in the following forms:

[0046] (1) Uniform Resource Locator (URL). http: / / intranet.example.com / dept / finance It can represent the page access path of the finance department in an intranet environment; or, https: / / www.example.com / api / v1 / user / login can represent the address of an external user login API interface.

[0047] (2) Application Programming Interface (API) endpoints. For example, / api / data / v2 / query can represent the API endpoint of a data query service, which is used to access the data query function; or / service / auth / v1 / logout can represent the API endpoint of an authentication service, which is used to process user logout requests.

[0048] (3) The access path of a specific functional page. For example, / admin / dashboard can represent a dashboard page of an intranet management backend; or / public / newsletter can represent an electronic newsletter page that can be accessed by external network users.

[0049] The above-mentioned form of the URL information is only used as an example. The specific representation form of the URL information can be set according to the actual application scenario, and this application does not impose any specific restrictions on this.

[0050] Step S2042: Determine the legitimacy of the second identification information and the website address information in the system access request based on the matching result between the target access configuration information and the second identification information and the website address information in the system access request.

[0051] In the technical solution provided in step S2042, the determination of the legitimacy of the system access request is based on whether the target access configuration information is consistent with the second identification information and the website information in the system access request, wherein:

[0052] In a case where the target access configuration information is identical to the second identification information and the website address information in the system access request, determining that the second identification information and the website address information in the system access request pass the legality check;

[0053] When the target access configuration information is different from the second identification information and / or website information in the system access request, it is determined that the second identification information and / or website information in the system access request has not passed the legality check.

[0054] Specifically, when the target access configuration information is matched with the second identification information and URL information in the system access request, the matching content includes: checking whether the user permissions match and verifying whether the URL of the access request is within the authorization range of the target system, thereby ensuring the compliance and security of the access request.

[0055] Step S206: Feedback the corresponding access result to the target object according to the obtained verification result.

[0056] In the technical solution provided in step S206, according to the verification result obtained in the above step S204, there may be the following two situations:

[0057] If the second identification information and the website address information in the system access request pass the legality check, respond to the system access request, and feed back the response result corresponding to the system access request as the access result to the target object;

[0058] If the second identification information and / or website information in the system access request fails the legality check, the failure of the second identification information and / or website information to pass the legality check is used as the reason for access failure, and the reason for access failure is fed back to the target object as the access result.

[0059] In an exemplary embodiment, taking the application scenario of a public information query system as an example, it is assumed that the system includes two subsystems, an intranet and an extranet, and the intranet subsystem is mainly used for internal data query and management within the enterprise, while the extranet subsystem is provided for the public to query public information.

[0060] When a staff member A attempts to access the intranet subsystem from the intranet to query data, he can first send a system access request to the background server, and the request includes the intranet identifier of the intranet subsystem (such as system ID: GOV_DATA_IN), the account information of staff member A (such as user001), and the requested resource path (such as URL information: / data / query); then, the background server will search for the target access configuration information associated with GOV_DATA_IN from the preset system access configuration table, where the target access configuration information indicates which users have the authority to access the data query function of the intranet subsystem and which URL paths are legal; if the background server determines that the account information of staff member A is in the permission list and the requested resource path belongs to the legal path pre-configured in the intranet subsystem, it means that the request has passed the legality check, then the background server will respond to the request and feedback the data query result to the requesting staff member A.

[0061] On the contrary, if a public user B tries to use the external network subsystem to access the internal network data, he can first send a system access request to the background server, and the request includes the external network identifier of the external network subsystem (such as system ID: GOV_DATA_OUT), the account information of public user B (such as pub_user001), and the requested resource path (such as website information: / data / query); then, the background server will search for the target access configuration information associated with GOV_DATA_OUT from the preset system access configuration table, wherein the target access configuration information indicates which users have the right to access the data query function of the internal network subsystem, and which URL paths are legal; if the background server determines that the account information of public user B is not in the permission list, and / or the requested resource path does not belong to the legal path pre-configured in the internal network subsystem, it means that the request has not passed the legality check. At this time, the background server will generate an access failure reason, such as "You are not authorized to access the internal network data query function", and feedback the failure reason as the access result to public user B to prevent illegal or unauthorized access attempts and ensure the security and functional isolation of the system.

[0062] As an optional implementation, the access result also includes: HTTP status code, which is a three-digit code returned by the server when responding to the HTTP request, used to indicate the result status of the client request. Then, when the backend server responds to the system access request, it can be divided into the following two situations according to the response result:

[0063] When the system access request responds successfully, the access result with a success status code (2xx: indicating that the request is successfully received, understood, and accepted by the server. The most common success status code is 200OK, which indicates that the request is successful and the server returns the requested information) is fed back to the target object;

[0064] When the system access request response fails, the corresponding response failure reason is determined, and the access result carrying the server error status code (5xx: indicating that the server encountered an error when processing the request. For example: 500 Internal Server Error means that the server encountered an unexpected situation and cannot complete the request, and 503 Service Unavailable means that the server is temporarily unable to process the request) and the response failure reason is fed back to the target object.

[0065] For example, a staff member C uses his account (such as staff001) to try to access a specific management page (URL information: / intranet / manager / dashboard) from the intranet, but the backend server finds during the verification process that the management page is currently unavailable due to temporary server maintenance (or there is an error in the system configuration, resulting in the inability to correctly verify user permissions), thus triggering a system access request response failure. At this time, the backend server will generate a response failure reason, such as "Server maintenance, please try again later" or a specific technical error description, and feedback the server error status code (such as 503Service Unavailable, indicating that the service is unavailable) and the access result of the above response failure reason to staff member C. After receiving this feedback, staff member C's client (such as a browser or mobile application) can learn the reason why his request was not successfully processed based on the server error status code and the response failure reason, and take appropriate actions, such as trying again later or contacting the system administrator to confirm the server maintenance status.

[0066] In addition, when the second identification information and / or URL information in the system access request fails to pass the legitimacy check, the access result (i.e., the reason for access failure) carrying a client error status code (4xx: indicating that the client's request contains an error or cannot be completed, for example: 400 Bad Request means a request syntax error; 401 Unauthorized means that the user is not logged in or the token is invalid; 403 Forbidden means that the server understands the request but refuses to execute it because the user does not have permission to access a specific function address) can be fed back to the target object.

[0067] Based on the scheme defined in the above steps S202 to S206, it can be known that in the embodiment, the background server performs a legitimacy check on the second identification information of the target object embedded in the request and the URL information when the target object accesses the target system based on the first identification information of the target system in the system access request, and feeds back the corresponding access result according to the verification result. The technical effect of achieving multiple systems in the internal and external networks sharing the same background service and accurately controlling and verifying the security of user identities and functional access rights has achieved the purpose of effectively reducing system deployment and maintenance costs without affecting business logic, while ensuring strict isolation of internal and external network users and functions, and improving the overall security and efficiency of the system.

[0068] Example 2

[0069] Based on Embodiment 1 of the present application, an embodiment of a system access control device is also provided, and the system access control method of the above embodiment is executed when the device is running. Figure 3 is a schematic diagram of the structure of an optional system access control device according to an embodiment of the present application, such as Figure 3 As shown, the system access control device at least includes an acquisition module 32, a request verification module 34 and a feedback module 36, wherein:

[0070] The acquisition module 32 is used to acquire a system access request initiated by a target object, wherein the system access request includes at least: first identification information of a target system to be accessed, second identification information of the target object, and website information when the target object accesses the target system, and the first identification information includes at least: a network environment identification of the target system, and the network environment identification includes: an intranet identification or an extranet identification;

[0071] A request verification module 34, used to verify the legitimacy of the second identification information and the website information in the system access request based on the first identification information in the system access request;

[0072] The feedback module 36 is used to feed back the corresponding access result to the target object according to the obtained verification result.

[0073] As another optional implementation, Figure 4 is a schematic diagram of the structure of another optional system access control device according to an embodiment of the present application, such as Figure 4 The device also includes: a sub-application identification additional module and a sub-application role configuration module, wherein:

[0074] A sub-application identification addition module is used to add corresponding first identification information to the system access request initiated by the target object, wherein the sub-application identification addition module is deployed in the same NGINX as the front end of the target system in an intranet or extranet environment.

[0075] The sub-application role configuration module is used to set the association relationship between the first identification information of each system and the corresponding access configuration information, record the obtained multiple groups of association relationships in the system access configuration table, and store them in a preset database.

[0076] It should be noted that the various modules in the above-mentioned system access control device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0077] Example 3

[0078] According to an embodiment of the present application, a non-volatile storage medium is further provided, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the system access control method in Example 1.

[0079] Optionally, the device where the non-volatile storage medium is located implements the following steps by running the program: obtaining a system access request initiated by the target object, wherein the system access request includes at least: first identification information of the target system to be accessed, second identification information of the target object, and website information when the target object accesses the target system, and the first identification information includes at least: a network environment identification of the target system, and the network environment identification includes: an intranet identification or an extranet identification; verifying the legitimacy of the second identification information and the website information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object based on the obtained verification result.

[0080] According to an embodiment of the present application, a computer program product is also provided, which includes a stored computer program, wherein the system access control method in Example 1 is implemented when the computer program is executed by a processor.

[0081] Optionally, the computer program executes the following steps: obtaining a system access request initiated by a target object, wherein the system access request includes at least: first identification information of a target system to be accessed, second identification information of the target object, and website address information when the target object accesses the target system, and the first identification information includes at least: a network environment identifier of the target system, the network environment identifier includes: an intranet identifier or an extranet identifier; verifying the legitimacy of the second identification information and website address information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object based on the obtained verification result.

[0082] According to an embodiment of the present application, a processor is also provided, which is used to run a program, wherein the system access control method in Example 1 is executed when the program is running.

[0083] Optionally, when the program is running, the following steps are executed: obtaining a system access request initiated by the target object, wherein the system access request includes at least: first identification information of the target system to be accessed, second identification information of the target object, and website address information when the target object accesses the target system, and the first identification information includes at least: a network environment identifier of the target system, and the network environment identifier includes: an intranet identifier or an extranet identifier; verifying the legitimacy of the second identification information and website address information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object based on the obtained verification result.

[0084] According to an embodiment of the present application, an electronic device is also provided, wherein: Figure 5 is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application, such as Figure 5 As shown, the electronic device includes one or more processors; a memory for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the system access control method in the above-mentioned embodiment 1 when running.

[0085] Optionally, the processor is configured to execute the following steps through a computer program: obtaining a system access request initiated by a target object, wherein the system access request includes at least: first identification information of the target system to be accessed, second identification information of the target object, and website information when the target object accesses the target system, and the first identification information includes at least: a network environment identifier of the target system, and the network environment identifier includes: an intranet identifier or an extranet identifier; verifying the legitimacy of the second identification information and the website information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object based on the obtained verification result.

[0086] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0087] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0088] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0089] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0090] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0091] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0092] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A system access control method, characterized in that: include: Obtaining a system access request initiated by a target object, wherein the system access request includes at least: first identification information of a target system to be accessed, second identification information of the target object, and website information of the target object when accessing the target system, and the first identification information includes at least: a network environment identification of the target system, and the network environment identification includes: an intranet identification or an extranet identification; Verifying the legitimacy of the second identification information and the website address information in the system access request based on the first identification information in the system access request; The corresponding access result is fed back to the target object according to the obtained verification result.

2. The method according to claim 1, characterized in that: Verifying the legitimacy of the second identification information and the website address information in the system access request based on the first identification information in the system access request includes: Matching the first identification information in the system access request with a preset system access configuration table to obtain corresponding target access configuration information, wherein the system access configuration table includes associations between the first identification information of multiple systems and the corresponding access configuration information, and the access configuration information at least includes: a preset system website information and second identification information of multiple objects with access rights, and the website information includes at least one of the following: a uniform resource locator, an endpoint of an application programming interface; The legitimacy of the second identification information and the website address information in the system access request is determined according to a matching result between the target access configuration information and the second identification information and the website address information in the system access request.

3. The method according to claim 2, characterized in that Determining the legitimacy of the second identification information and the website address information in the system access request according to a matching result between the target access configuration information and the second identification information and the website address information in the system access request includes: In a case where the target access configuration information is identical to the second identification information and the website address information in the system access request, determining that the second identification information and the website address information in the system access request pass the legality check; In a case where the target access configuration information is different from the second identification information and / or website information in the system access request, it is determined that the second identification information and / or website information in the system access request has not passed the legality check.

4. The method according to claim 3, characterized in that Feedback corresponding access results to the target object according to the obtained verification results, including: If the second identification information and the website address information in the system access request pass the legality check, respond to the system access request, and feed back the response result corresponding to the system access request as the access result to the target object; When the second identification information and / or website information in the system access request fails to pass the legality check, the failure of the second identification information and / or website information to pass the legality check is used as the reason for access failure, and the reason for access failure is fed back to the target object as the access result.

5. The method according to claim 4, characterized in that The access result also includes: a Hypertext Transfer Protocol HTTP status code, wherein responding to the system access request and feeding back the response result corresponding to the system access request as the access result to the target object includes: When the system access request is responded to successfully, an access result carrying a success status code is fed back to the target object; When the system access request response fails, the corresponding response failure reason is determined, and the access result carrying the server error status code and the response failure reason is fed back to the target object.

6. The method according to claim 5, characterized in that In the case where the second identification information and / or the website address information in the system access request fails to pass the legality check, the access result also includes a client error status code.

7. The method according to claim 1, characterized in that The system access request also includes: encrypted ciphertext obtained by encrypting the first identification information, the second identification information and the website information using a preset encryption key, wherein after obtaining the system access request initiated by the target object, the method further includes: The encrypted ciphertext in the system access request is decrypted using a preset decryption key to obtain decrypted information.

8. A system access control device, characterized in that: include: an acquisition module, configured to acquire a system access request initiated by a target object, wherein the system access request includes at least: first identification information of a target system to be accessed, second identification information of the target object, and website information of the target object when accessing the target system, and the first identification information includes at least: an identification of a network environment in which the target system is located, and the network environment identification includes: an intranet identification or an extranet identification; A request verification module, used to verify the legitimacy of the second identification information and the website information in the system access request based on the first identification information in the system access request; The feedback module is used to feed back the corresponding access result to the target object according to the obtained verification result.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a computer program, wherein the device where the non-volatile storage medium is located executes the system access control method according to any one of claims 1 to 7 by running the computer program.

10. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, the system access control method according to any one of claims 1 to 7 is implemented.

Images