System access control method and apparatus, storage medium, computer program product

Abstract

The application discloses a system access control method and device, a storage medium and a computer program product. The method comprises the following steps: obtaining a system access request initiated by a target object, wherein the system access request at least comprises first identification information of a target system, second identification information of the target object and website information of the target object when accessing the target system, and the first identification information at least comprises a network environment identifier of the target system, which comprises an intranet identifier or an extranet identifier; verifying the legality of the second identification information and the website information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object according to a verification result. The application solves the technical problem that the current intranet and extranet each deploy a background server, which leads to more resources required for deployment, and when a user accesses the systems in the intranet and the extranet, the user needs to share and exchange between the systems, which leads to more system overhead.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electronic information, in particular to a system access control method and device, a storage medium and a computer program product. BACKGROUND

[0002] With the progress of informatization, due to the increasing requirements of information disclosure and work transparency, the demand for enterprise informatization projects has evolved from the initial single intranet application to integrated functions containing multiple subsystems of intranet and extranet. And in the early stage of development, due to the construction of intranet application first, then the demand for extranet application is put forward. Therefore, the common situation of enterprise informatization projects is that the extranet application is constructed by one manufacturer, and the intranet is constructed by another manufacturer, and the data intercommunication between systems is realized through data sharing and exchange mechanism.

[0003] However, in recent years, more and more enterprise requirements are to integrate multiple subsystems of intranet and extranet in a set of systems, and the construction of such multiple subsystems usually requires strict isolation of users and functions between different subsystems of intranet and extranet. In other words, the user account of intranet cannot be used for login of extranet application, and the user account of extranet cannot be used for login of intranet system. In this scenario, if multiple subsystems are developed independently, it is no doubt that the demand can be met, but the multiple subsystems are essentially one large application, therefore, when implementing and deploying the multiple systems, the server resources need to be doubled; in addition, the data intercommunication between these subsystems still needs to be realized through sharing and exchange, which undoubtedly increases the additional system overhead and complexity.

[0004] At present, there is no effective solution to the above problems. SUMMARY

[0005] The embodiments of the present application provide a system access control method and device, a storage medium and a computer program product, to at least solve the technical problem that the current intranet and extranet each have a background server, resulting in more resources required for deployment, and when users access the systems in intranet and extranet, they need to pass through the sharing and exchange between systems, resulting in more system overhead.

[0006] According to an aspect of the embodiments of the present application, a system access control method is provided, comprising: obtaining a system access request initiated by a target object, wherein the system access request at least includes: first identification information of a target system to be accessed, second identification information of the target object, and website information of the target object when accessing the target system, and the first identification information at least includes: a network environment identifier of the target system, the network environment identifier including: an intranet identifier or an extranet identifier; verifying the legality of the second identification information and the website information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object according to the obtained verification result.

[0007] Optionally, verifying the legality of the second identification information and the website information in the system access request based on the first identification information in the system access request comprises: matching the first identification information in the system access request with a preset system access configuration table to obtain corresponding target access configuration information, wherein the system access configuration table includes an association relationship between the first identification information of a plurality of systems and corresponding access configuration information, and the access configuration information at least includes: pre-set website information of the system and second identification information of a plurality of objects having access rights, and the website information includes at least one of: a uniform resource locator and an endpoint of an application programming interface; and determining the legality of the second identification information and the website information in the system access request according to a matching result of the target access configuration information and the second identification information and the website information in the system access request.

[0008] Optionally, determining the legality of the second identification information and the website information in the system access request according to the matching result of the target access configuration information and the second identification information and the website information in the system access request comprises: in a case where the target access configuration information and the second identification information and the website information in the system access request are all the same, determining that the second identification information and the website information in the system access request pass the legality verification; and in a case where the target access configuration information and the second identification information and / or the website information in the system access request are not the same, determining that the second identification information and / or the website information in the system access request do not pass the legality verification.

[0009] Optionally, feeding back a corresponding access result to the target object according to the obtained verification result comprises: in a case where the second identification information and the website information in the system access request pass the legality verification, responding to the system access request and feeding back a response result corresponding to the system access request to the target object as the access result; and in a case where the second identification information and / or the website information in the system access request do not pass the legality verification, feeding back the reason why the second identification information and / or the website information do not pass the legality verification as an access failure reason to the target object as the access result.

[0010] Optionally, the access result further comprises an HTTP status code, wherein, in response to the system access request, the response result corresponding to the system access request is fed back to the target object as the access result, comprising: when the system access request response is successful, the access result carrying the success status code is fed back to the target object; when the system access request response fails, the corresponding response failure reason is determined, and the access result carrying the server error status code and the response failure reason is fed back to the target object.

[0011] Optionally, in the case that the second identification information and / or the website information in the system access request fails the legality verification, the access result further comprises a client error status code.

[0012] Optionally, the system access request further comprises encrypted ciphertext obtained by encrypting the first identification information, the second identification information and the website information by using a preset encryption key, wherein, after obtaining the system access request initiated by the target object, the method further comprises: decrypting the encrypted ciphertext in the system access request by using a preset decryption key to obtain decrypted information.

[0013] According to another aspect of the embodiments of the present application, a system access control device is further provided, comprising: an obtaining module, configured to obtain a system access request initiated by a target object, wherein the system access request comprises at least: first identification information of a target system to be accessed, second identification information of the target object, and website information when the target object accesses the target system, and the first identification information comprises at least: network environment identification of the target system, wherein the network environment identification comprises: intranet identification or extranet identification; a request verification module, configured to verify the legality of the second identification information and the website information in the system access request based on the first identification information in the system access request; and a feedback module, configured to feed back corresponding access result to the target object according to the obtained verification result.

[0014] According to another aspect of the embodiments of the present application, a non-volatile storage medium is further provided, comprising a stored computer program, wherein a device where the non-volatile storage medium is located executes the system access control method by running the computer program.

[0015] According to another aspect of the embodiments of the present application, a computer program product is further provided, comprising a stored computer program, wherein the computer program is executed by a processor to implement the system access control method.

[0016] In the embodiment of the present application, the background server performs legality verification on the second identification information of the target object embedded in the system access request and the website information when the target object accesses the target system based on the first identification information of the target system in the request, and feeds back the corresponding access result according to the verification result. The technical effect of realizing that multiple systems in the internal and external networks share the same background service, accurately controlling and verifying the security of user identity and function access permission, achieves the purpose of effectively reducing system deployment and maintenance cost without affecting the business logic, while ensuring strict isolation of internal and external network users and functions, improving the overall security and efficiency of the system. Further, the current internal and external networks each deploy a background server, which requires more resources for deployment, and when users access the systems in the internal and external networks, they need to share and exchange between systems, resulting in more system overhead. BRIEF DESCRIPTION OF DRAWINGS

[0017] The drawings described herein are used to provide further understanding of the present application, and form a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a hardware structure block diagram of an optional computer terminal (or mobile device) according to an embodiment of the present application;

[0019] Figure 2 is a flowchart of an optional system access control method according to an embodiment of the present application;

[0020] Figure 3 is a structure diagram of an optional system access control device according to an embodiment of the present application;

[0021] Figure 4 is a structure diagram of another optional system access control device according to an embodiment of the present application;

[0022] Figure 5 is a structure diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order for those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0025] In addition, the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, analyzed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties. For example, an interface is provided between the system and the relevant user or institution. Before obtaining the relevant information, the interface needs to send a request to the aforementioned user or institution, and after receiving the consent information feedback from the aforementioned user or institution, the relevant information is obtained.

[0026] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0027] Intranet: refers to a private network within an organization, which uses Internet technologies such as TCP / IP protocol, HTTP protocol, etc., but is limited to internal employees or authorized personnel access. Therefore, the intranet usually contains sensitive information, internal resources and applications, such as enterprise internal mail system, file sharing, OA system, etc. Access to the intranet is strictly controlled, and generally requires a username, password or other identity verification mechanism to enter.

[0028] Extranet: refers to a network architecture that allows external users (such as customers, suppliers or partners) to access certain selected services in the internal network of an organization. Extranet can be seen as an extension of intranet, but access rights are more strictly limited, allowing external users to access only specific information or applications that the organization consciously discloses or shares. Access to the extranet usually also requires identity verification, but its user group is more extensive than the intranet.

[0029] Embodiment 1

[0030] According to the embodiments of the present application, an embodiment of a system access control method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] The method embodiments provided by the embodiments of the present application can be executed in a mobile terminal, a computer terminal or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing the system access control method is shown. As shown in Figure 1 , the computer terminal 10 (or mobile device 10) can include one or more processors 102 (the processor 102 can include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it can also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports in the BUS bus), a network interface, a power supply and / or a camera. Those skilled in the art can understand that Figure 1 The structure shown is only schematic, which does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 10 can include more or less components than those shown in Figure 1 , or have a different configuration from that shown in Figure 1 .

[0032] It should be noted that the one or more processors 102 and / or other data processing circuits described above can be referred to herein as "data processing circuits" in general. The data processing circuit can be embodied in whole or in part as software, hardware, firmware or any other combination. In addition, the data processing circuit can be a single independent processing module, or any one of the other elements combined into the computer terminal 10 (or mobile device) in whole or in part. As referred to in the embodiments of the present application, the data processing circuit as a kind of processor control (for example, the selection of the variable resistance terminal path connected with the interface).

[0033] The memory 104 can be used to store software programs of application software and modules, such as program instructions / data storage means corresponding to the system access control method of the embodiments of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, i.e. implements the system access control method of the application program as described above. The memory 104 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include a memory remotely arranged with respect to the processor 102, which can be connected to the computer terminal 10 through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. The specific examples of the network can include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet in a wireless manner.

[0035] The display can be, for example, a touch screen type liquid crystal display (LCD), which can enable a user to interact with the user interface of the computer terminal 10 (or mobile device).

[0036] In the above operating environment, Figure 2 is a flowchart of an optional system access control method according to an embodiment of the present application, as shown in Figure 2 The method at least includes steps S202-S206, wherein:

[0037] In step S202, a system access request initiated by a target object is acquired.

[0038] The target object can be a user or a program initiating the access request, including but not limited to a staff, a specific application program or a service. The system access request can be a request for accessing an intranet system or an extranet system, and therefore, the system access request at least includes first identification information of a target system to be accessed (i.e., a unique identifier of the target system), second identification information of the target object (i.e., identity information of the target object, including but not limited to a user account, an API key or an authentication token), and website information when the target object accesses the target system (i.e., a specific path or a resource address of the target object accessing the target system).

[0039] To enable the intranet system and the extranet system to share the same background service, the first identification information of the target system at least includes a network environment identifier of the target system, and the network environment identifier includes an intranet identifier (such as intra_, internal, etc., to identify that the target system is located in an internal network of an organization) or an extranet identifier (such as extra_, external, etc., to identify that the target system is located in an external network of an organization). In addition, the first identification information of the target system can further include a system code, a system ID, version information, a service name, etc.

[0040] As an optional implementation, the system access request further includes encrypted ciphertext obtained by encrypting the first identification information, the second identification information and the website information by using a preset encryption key. Then, the background server decrypts the encrypted ciphertext in the system access request by using a preset decryption key to obtain decrypted information after receiving the system access request. The decryption process ensures the security of the information during transmission and prevents unauthorized third parties from tampering with or intercepting critical access information. The decryption key and the encryption key for encrypting the identification information and the website information are obtained by the target system and the background server in advance, and the encryption algorithm can be an HMAC or SHA-256 algorithm.

[0041] After the above decryption operation is completed, the background system executes the following step S204 based on the first identification information, the second identification information and the website information in the decrypted information.

[0042] Step S204: verifying the legitimacy of the second identification information and the website information in the system access request based on the first identification information in the system access request.

[0043] As an optional implementation, the technical solution provided in the step S204 can include:

[0044] Step S2041: matching the first identification information in the system access request with a preset system access configuration table to obtain corresponding target access configuration information.

[0045] In the technical solution provided in step S2041, the matching process can be understood as follows: the background server (also referred to as a service micro-service cluster) compares the first identification information in the system access request with the record content in the system access configuration table to obtain the target access configuration information. Specifically, the background server can integrate micro-services of multiple systems in advance, and pre-configure the association relationship between the first identification information of each system and the corresponding access configuration information, obtain a system access configuration table, and store the system access configuration table in a pre-set database. The access configuration information at least includes pre-set website information (also referred to as a function address) of the system and second identification information of multiple objects having the access right to the system, and the website information can have the following forms:

[0046] (1) Uniform Resource Locator (URL). For example, http: / / 192.168.1.100:8080 / finance can represent the page access path of the finance department in an intranet environment; or https: / / www.example.com / api / v1 / user / login can represent the address of a user login API interface in an extranet. http: / / intranet.example.com / dept / finance (2) Application Programming Interface (API) endpoint. For example, / api / data / v2 / query can represent an API endpoint of a data query service for accessing data query functions; or / service / auth / v1 / logout can represent an API endpoint of an authentication service for processing user logout requests.

[0047] (3) Access path of a specific function page. For example, / admin / dashboard can represent a dashboard page of an intranet management background; or / public / newsletter can represent an electronic newsletter page accessible by users in an extranet.

[0048] The above forms of website information are only used as examples for illustration, and the specific representation form of the website information can be set according to the actual application scenario, and the present application does not make specific limitations thereto.

[0049] Step S2042, according to the matching result of the target access configuration information and the second identification information and the website information in the system access request, the legality of the second identification information and the website information in the system access request is determined.

[0050] Step S2042, according to the matching result of the target access configuration information and the second identification information and the website information in the system access request, the legality of the second identification information and the website information in the system access request is determined.

[0051] In the technical solution provided in step S2042, the determination of the legality of the system access request is based on whether the target access configuration information is consistent with the second identification information and the website information in the system access request, wherein:

[0052] In the case where the target access configuration information and the second identification information and the website information in the system access request are all the same, it is determined that the second identification information and the website information in the system access request pass the legality check;

[0053] In the case where the target access configuration information and the second identification information and / or the website information in the system access request are not the same, it is determined that the second identification information and / or the website information in the system access request do not pass the legality check.

[0054] Specifically, when matching the target access configuration information with the second identification information and the website information in the system access request, the matching content includes checking whether the user rights are matched and verifying whether the website of the access request is within the authorized range of the target system, so as to ensure the compliance and security of the access request.

[0055] In step S206, the corresponding access result is fed back to the target object according to the obtained check result.

[0056] In the technical solution provided in step S206, according to the check result obtained in the above step S204, there can be two cases as follows:

[0057] In the case where the second identification information and the website information in the system access request pass the legality check, the system access request is responded to, and the response result corresponding to the system access request is fed back to the target object as the access result;

[0058] In the case where the second identification information and / or the website information in the system access request do not pass the legality check, the second identification information and / or the website information not passing the legality check is taken as the access failure reason, and the access failure reason is fed back to the target object as the access result.

[0059] In an exemplary embodiment, taking the application scenario of a public information query system as an example, it is assumed that the system includes two subsystems of an intranet and an extranet, and the intranet subsystem is mainly used for enterprise internal data query and management, and the extranet subsystem is provided for the public to query public information.

[0060] When a staff A tries to access the intranet subsystem from the intranet to query data, the staff A can first send a system access request to the background server, and the request includes the intranet identifier (such as system ID: GOV_DATA_IN) of the intranet subsystem, the account information (such as user001) of the staff A, and the requested resource path (such as website information: / data / query). Then, the background server searches for the target access configuration information associated with GOV_DATA_IN from the preset system access configuration table, wherein the target access configuration information indicates which users have the permission to access the data query function of the intranet subsystem and which URL paths are legal. If the background server judges that the account information of the staff A is in the permission list and the requested resource path belongs to the legal path pre-configured in the intranet subsystem, it indicates that the request passes the legality check. Then, the background server responds to the request and feeds back the data query result to the staff A.

[0061] On the contrary, if a public user B tries to access the intranet data using the extranet subsystem, the public user B can first send a system access request to the background server, and the request includes the extranet identifier (such as system ID: GOV_DATA_OUT) of the extranet subsystem, the account information (such as pub_user001) of the public user B, and the requested resource path (such as website information: / data / query). Then, the background server searches for the target access configuration information associated with GOV_DATA_OUT from the preset system access configuration table, wherein the target access configuration information indicates which users have the permission to access the data query function of the intranet subsystem and which URL paths are legal. If the background server judges that the account information of the public user B is not in the permission list and / or the requested resource path does not belong to the legal path pre-configured in the intranet subsystem, it indicates that the request does not pass the legality check. At this time, the background server generates an access failure reason, such as "You do not have the permission to access the intranet data query function", and feeds back the failure reason as the access result to the public user B, so as to prevent illegal or unauthorized access attempts and ensure the security and function isolation of the system.

[0062] As an optional implementation, the access result further includes an HTTP status code, which is a three-digit code returned by the server when responding to the HTTP request, and is used to indicate the result state of the client request. Then, when the background server responds to the system access request, the response result can be divided into the following two cases:

[0063] When the system access request response is successful, the access result carrying a success status code (2xx: indicates that the request is successfully received, understood and accepted by the server. The most common success status code is 200 OK, which means that the request is successful, and the server returns the requested information) is fed back to the target object;

[0064] When the system access request response fails, the corresponding response failure reason is determined, and the access result carrying the server error status code (5xx: indicates that the server encounters an error when processing the request. For example: 500 Internal Server Error means that the server encounters an unexpected situation and cannot complete the request, and 503 Service Unavailable means that the server cannot handle the request temporarily) and the response failure reason is fed back to the target object.

[0065] For example, a staff C uses his account (such as staff001) to try to access a specific management page (website information: / intranet / manager / dashboard) from the intranet, but the background server finds that the management page is currently unavailable due to server maintenance (or system configuration error, resulting in incorrect user permission verification) during the verification process. Therefore, the system access request response fails, and the background server generates a response failure reason, such as "server maintenance, please try later" or a specific technical error description, and feeds back the server error status code (such as 503 Service Unavailable, indicating that the service is unavailable) and the above response failure reason to the staff C. The client (such as browser or mobile application) of staff C can know the reason why its request is not successfully processed according to the server error status code and the response failure reason after receiving this feedback, and take appropriate action, such as retrying later or contacting the system administrator to confirm the server maintenance status.

[0066] In addition, when the second identification information and / or website information in the system access request fails the legality check, the access result (i.e. access failure reason) carrying the client error status code (4xx: indicates that the client's request contains errors or cannot be completed, for example: 400 Bad Request means that the request syntax is incorrect; 401 Unauthorized means that the user is not logged in or the token is invalid; 403 Forbidden means that the server understands the request, but refuses to execute it because the user has no permission to access the specific function address) can be fed back to the target object.

[0067] Based on the scheme defined in steps S202 to S206, in the embodiment, the background server performs legality verification on the second identification information of the target object embedded in the system access request and the website information when the target object accesses the target system based on the first identification information of the target system in the request, and feeds back the corresponding access result according to the verification result. The technical effects of realizing that multiple systems in the internal and external networks share the same background service, accurately controlling and verifying the security of user identity and function access permission, achieve the purpose of effectively reducing system deployment and maintenance costs without affecting the business logic, while ensuring strict isolation of internal and external network users and functions, improving the overall security and efficiency of the system.

[0068] Embodiment 2

[0069] Based on the embodiment 1 of the present application, an embodiment of a system access control device is also provided, which executes the system access control method of the above-mentioned embodiments when running. Wherein, Figure 3 is a structural schematic diagram of an optional system access control device according to the embodiment of the present application, as Figure 3 shown, the system access control device at least includes an acquisition module 32, a request verification module 34 and a feedback module 36, wherein:

[0070] The acquisition module 32 is used to acquire the system access request initiated by the target object, wherein the system access request at least includes: the first identification information of the target system to be accessed, the second identification information of the target object, and the website information when the target object accesses the target system, and the first identification information at least includes: the network environment identification of the target system, and the network environment identification includes: internal network identification or external network identification;

[0071] The request verification module 34 is used to verify the legality of the second identification information and the website information in the system access request based on the first identification information in the system access request;

[0072] The feedback module 36 is used to feed back the corresponding access result to the target object according to the obtained verification result.

[0073] As another optional implementation, Figure 4 is a structural schematic diagram of another optional system access control device according to the embodiment of the present application, as Figure 4 shown. The device also includes a sub-application identification adding module and a sub-application role configuration module, wherein:

[0074] The sub-application identification adding module is used to add the corresponding first identification information to the system access request initiated by the target object, wherein the sub-application identification adding module is deployed in the same NGINX as the front end of the target system in the internal or external network environment.

[0075] The sub-application role configuration module is configured to set an association relationship between the first identification information of each system and the corresponding access configuration information, record the obtained multiple sets of association relationships in a system access configuration table, and store the association relationships in a preset database.

[0076] It should be noted that each module in the system access control apparatus described above can be a program module (for example, a program instruction set for implementing a certain specific function) or a hardware module. For the latter, it can be in the following form, but is not limited thereto: the form of each module described above is a processor, or the functions of each module described above are implemented by a processor.

[0077] Embodiment 3

[0078] According to the embodiments of the present application, a non-volatile storage medium is also provided, which stores a program. When the program is executed, the device in which the non-volatile storage medium is located performs the system access control method in Embodiment 1.

[0079] Optionally, the device in which the non-volatile storage medium is located performs the following steps by executing the program: obtaining a system access request initiated by a target object, wherein the system access request at least includes first identification information of a target system to be accessed, second identification information of the target object, and website information of the target object when accessing the target system, and the first identification information at least includes a network environment identifier of the target system, the network environment identifier including an intranet identifier or an extranet identifier; verifying the legality of the second identification information and the website information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object according to the obtained verification result.

[0080] According to the embodiments of the present application, a computer program product is also provided, which includes a stored computer program. When the computer program is executed by a processor, the system access control method in Embodiment 1 is implemented.

[0081] Optionally, the computer program performs the following steps: obtaining a system access request initiated by a target object, wherein the system access request at least includes first identification information of a target system to be accessed, second identification information of the target object, and website information of the target object when accessing the target system, and the first identification information at least includes a network environment identifier of the target system, the network environment identifier including an intranet identifier or an extranet identifier; verifying the legality of the second identification information and the website information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object according to the obtained verification result.

[0082] According to an embodiment of the present application, a processor is also provided, which is configured to execute a program. When the program is executed, the system access control method in the above embodiment 1 is implemented.

[0083] Optionally, when the program is executed, the following steps are implemented: obtaining a system access request initiated by a target object, wherein the system access request at least includes first identification information of a target system to be accessed, second identification information of the target object, and website information of the target object when accessing the target system, and the first identification information at least includes a network environment identifier of the target system, and the network environment identifier includes an intranet identifier or an extranet identifier; verifying the second identification information and the website information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object according to a result of the verification.

[0084] According to an embodiment of the present application, an electronic device is also provided, wherein, Figure 5 is a structural schematic diagram of an optional electronic device according to an embodiment of the present application, as Figure 5 shown, the electronic device includes one or more processors; a memory configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement a program running method, wherein the program is configured to be executed to implement the system access control method in the above embodiment 1.

[0085] Optionally, the processor is configured to implement the following steps by executing a computer program: obtaining a system access request initiated by a target object, wherein the system access request at least includes first identification information of a target system to be accessed, second identification information of the target object, and website information of the target object when accessing the target system, and the first identification information at least includes a network environment identifier of the target system, and the network environment identifier includes an intranet identifier or an extranet identifier; verifying the second identification information and the website information in the system access request based on the first identification information in the system access request; and feeding back a corresponding access result to the target object according to a result of the verification.

[0086] The serial numbers of the above embodiments of the present application are only for description, not representing the advantages and disadvantages of the embodiments.

[0087] In the above embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0088] In several embodiments provided in the present application, it should be understood that the disclosed technology can be implemented by other ways. Among them, the above-described device embodiments are only schematic, for example, the division of units can be a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, units or modules, which can be electrical or other forms.

[0089] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e. they can be located in one place or distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0090] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0091] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the essential part or all or part of the related technology can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various program code storage media.

[0092] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should be considered as the protection scope of the present application.

Claims

1. A system access control method characterized by, The method comprises the following steps: obtaining a system access request initiated by a target object, wherein the system access request at least comprises first identification information of a target system to be accessed, second identification information of the target object, and website information of the target object when accessing the target system, and the first identification information at least comprises a network environment identifier of the target system, and the network environment identifier comprises an intranet identifier or an extranet identifier; verifying the legality of the second identification information and the website information in the system access request based on the first identification information in the system access request, comprising: matching the first identification information in the system access request with a preset system access configuration table to obtain corresponding target access configuration information, wherein the system access configuration table comprises an association relationship between the first identification information of a plurality of systems and corresponding access configuration information, and the access configuration information at least comprises pre-set website information of a system and second identification information of a plurality of objects with access authority, and the website information comprises at least one of a uniform resource locator and an application programming interface endpoint; determining the legality of the second identification information and the website information in the system access request according to the matching result of the target access configuration information and the second identification information and the website information in the system access request; feeding back a corresponding access result to the target object according to the obtained verification result.

2. The method of claim 1, wherein, The method further comprises the following steps: in a case where the target access configuration information and the second identification information and the website information in the system access request are all the same, determining that the second identification information and the website information in the system access request pass the legality verification; in a case where the target access configuration information and the second identification information and / or the website information in the system access request are not the same, determining that the second identification information and / or the website information in the system access request do not pass the legality verification.

3. The method of claim 2, wherein, The method further comprises the following steps: in a case where the second identification information and the website information in the system access request pass the legality verification, responding to the system access request and feeding back a response result corresponding to the system access request to the target object as the access result; in a case where the second identification information and / or the website information in the system access request do not pass the legality verification, feeding back a reason for the failure of the second identification information and / or the website information to pass the legality verification as an access failure reason to the target object as the access result.

4. The method of claim 3, wherein, The access result further comprises a hypertext transfer protocol (HTTP) status code, and the method further comprises the following steps: in a case where the system access request is successfully responded to, feeding back an access result carrying a success status code to the target object; When the system access request response fails, a corresponding response failure reason is determined, and an access result carrying a server error state code and the response failure reason is fed back to the target object.

5. The method of claim 4, wherein, In a case where the second identification information and / or the website information in the system access request fails the legality check, the access result further includes a client error state code.

6. The method of claim 1, wherein, The system access request further includes encrypted ciphertext obtained by encrypting the first identification information, the second identification information, and the website information using a preset encryption key. The encrypted ciphertext in the system access request is decrypted using a preset decryption key to obtain decrypted information.

7. A system access control apparatus, characterized by comprising: The method further includes: An obtaining module is configured to obtain a system access request initiated by a target object, wherein the system access request at least includes first identification information of a target system to be accessed, second identification information of the target object, and website information when the target object accesses the target system, and the first identification information at least includes a network environment identifier of the target system, and the network environment identifier includes an intranet identifier or an extranet identifier. A request verification module is configured to check the legality of the second identification information and the website information in the system access request based on the first identification information in the system access request, including matching the first identification information in the system access request with a preset system access configuration table to obtain corresponding target access configuration information, wherein the system access configuration table includes an association relationship between first identification information of a plurality of systems and corresponding access configuration information, and the access configuration information at least includes pre-set website information of a system and second identification information of a plurality of objects having access rights, and the website information includes at least one of a uniform resource locator and an endpoint of an application programming interface; and determining the legality of the second identification information and the website information in the system access request according to a matching result of the target access configuration information and the second identification information and the website information in the system access request. A feedback module is configured to feed back a corresponding access result to the target object according to the obtained check result.

8. A non-volatile storage medium, characterized by The non-volatile storage medium stores a computer program, wherein a device in which the non-volatile storage medium is located executes the system access control method of any one of claims 1 to 6 by running the computer program.

9. A computer program product, characterised in that, The computer program is executed by a processor to implement the system access control method of any one of claims 1 to 6. The computer program is executed by a processor to implement the system access control method of any one of claims 1 to 6.

Images