Data processing method, device, equipment, system, medium and program product

Abstract

The invention discloses a data processing method, device, equipment, system, medium and program product, and relates to the technical field of data processing. According to the method, an access request message of an access object is obtained, when the access request message comprises a request network mark field, the permission of the access object to access at least one application system is verified, and the access request message is determined by a network layer proxy server based on an access request sent by the access object and the request network mark field; the network source is used for indicating the access request; and when the permission of the access object to access each application system is verified to pass, sending an access request message to each application system. Therefore, the request network mark field can be added in the access request to indicate the network source of the access request, the real network source accessed by a user can be accurately identified, the authority control efficiency of accessing an application system by a visitor is improved, and the authority control cost of a service system is reduced because the authority verification logic is simple and hardware does not need to be improved.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to a data processing method, device, equipment, system, medium and program product. Background Art

[0002] The service system integrates service functions for external users, operation functions for internal system operators, and management functions for internal system operation and maintenance to meet the needs of visitors of different identities to access the service system. In order to ensure the data security of the service system, the service system limits the access rights of visitors of different identities to the application system through filters (Filter) used to verify application access rights or by splitting applications by network.

[0003] In the related technology, the former can determine the visitor's identity by verifying the Uniform Resource Locator (URL) in the access request through the Filter, and restrict the visitor's access to the application system based on the visitor's identity. However, this method is easy for illegal persons to bypass the Filter's verification through forged URLs, resulting in the inability to effectively detect the visitor's identity and thus the inability to restrict the visitor's access to the application system. The latter can split the functions of the application system into multiple subsystems, so that all functions on a single subsystem are only released to a specific visitor. Although the visitor's access to the application system can be restricted, due to the high cost of function splitting, the cost of service system resource deployment and operation and maintenance subsystems will increase, and the cost of permission management and control will increase. Summary of the invention

[0004] The embodiments of the present application provide a data processing method, apparatus, device, system, medium and program product, which can solve the problems of low efficiency and high cost in the related art of controlling the permissions of visitors to access application systems.

[0005] In a first aspect, an embodiment of the present application provides a data processing method, which may include:

[0006] Obtain access request message of access object;

[0007] In the case where the access request message includes a request network flag field, verifying the access object's permission to access the application system; wherein the access request message is determined by the network layer proxy server based on the access request and the request network flag field sent by the access object, and the request network flag field is used to indicate the network source of the access request;

[0008] When the access object's permission to access the application system is verified, an access request message is sent to the application system.

[0009] In a second aspect, an embodiment of the present application provides a data processing system, including: a network layer proxy server and a permission verification module; wherein:

[0010] The network layer proxy server is used to receive the access request sent by the access object; determine the access request message of the access object based on the access request and the request network flag field; and send the access request message to the permission verification module;

[0011] The permission verification module is used to execute the steps of the data processing method shown in the first aspect.

[0012] In a third aspect, an embodiment of the present application provides a data processing device, including:

[0013] An acquisition module, used to acquire an access request message of an access object;

[0014] A verification module, used to verify the access object's permission to access the application system when the access request message includes a request network flag field; wherein the access request message is determined by the network layer proxy server based on the access request and the request network flag field sent by the access object, and the request network flag field is used to indicate the network source of the access request;

[0015] The sending module is used to send an access request message to the application system when the access object's access authority to the application system is verified to be passed.

[0016] In a fourth aspect, an embodiment of the present application provides a computer device, the computer device comprising: a processor and a memory storing computer program instructions;

[0017] When the processor executes the computer program instructions, the data processing method shown in the first aspect is implemented.

[0018] In a fifth aspect, an embodiment of the present application provides a computer storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the data processing method shown in the first aspect is implemented.

[0019] In a sixth aspect, an embodiment of the present application provides a chip, the chip including a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the data processing method shown in the first aspect.

[0020] In a seventh aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the data processing method shown in the first aspect.

[0021] The data processing method, device, equipment, system, medium and program product of the embodiment of the present application can obtain the access request message of the access object, and verify the access object's permission to access at least one application system when the access request message includes a request network flag field; wherein the access request message is determined by the network layer proxy server based on the access request and the request network flag field sent by the access object, and the request network flag field is used to indicate the network source of the access request; in this way, when the access object's permission to access each application system is verified, the access request message is sent to each application system. Thus, the network layer proxy server can add a request network flag field to the access request sent by the access object to indicate the network source of the access request, and the request network flags of different networks are different, thereby ensuring that the true network source of the user's access can be accurately identified, and the access request message of the access object can be forwarded to the application system only when the access request message includes the request network flag field and the access object's permission to access at least one application system is verified, which can effectively detect the identity of the access object, thereby restricting the access object from accessing the application system, and improving the efficiency of the permission control of the visitor to access the application system. Furthermore, without the need to modify the application system, by adding a permission verification module that can be shared by at least one application, the network layer proxy server is assisted in the transmission of the request network flag field, thereby effectively solving the problem of multiple network publishing permission management and control for at least one application system. In addition, the verification logic is concise and can ensure the timeliness of network access for the access object. Moreover, the data processing logic does not require hardware improvements and is therefore universal. It can not only meet the demands of a single application system for publishing to multiple networks such as the Internet, office networks, and production networks, but also meet the demands of multiple application systems for publishing to multiple networks at the same time, thereby improving the efficient rate of deployed resources, saving hardware resource costs, and reducing the cost of service system permission management and control. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0023] Figure 1 A schematic diagram of the structure of a data processing system provided in an embodiment of the present application;

[0024] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application;

[0025] Figure 3 A flowchart of a data processing method based on a data processing system provided in an embodiment of the present application;

[0026] Figure 4 A schematic diagram of a structure based on a permission verification module provided in an embodiment of the present application;

[0027] Figure 5 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0028] Figure 6 It is a schematic diagram of the structure of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0029] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0030] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0031] The acquisition, storage, use, and processing of data (including but not limited to the features and information in the text) in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0032] The following will be combined with the attached Figures 1 to 6 , describes in detail the data processing method, device, system, computer equipment, storage medium and computer program product of the embodiments of the present application, so as to effectively solve the permission control of the application system to the access objects of multiple networks and realize the permission control of the visitor to the application system. It should be noted that these embodiments are not intended to limit the scope of the disclosure of this application.

[0033] First, combine Figure 1The data processing system provided in the embodiment of the present application is described in detail as follows.

[0034] like Figure 1 As shown, the data processing system in the embodiment of the present application includes a network layer proxy server and a permission verification module.

[0035] The network layer proxy server 101 in the embodiment of the present application can be divided according to different networks to configure at least one proxy server for each network. The network layer proxy server 101 can be a virtual device such as Ngxin, Apache, or a physical device. In some embodiments, the network can include M networks, where M is an integer greater than 1. If M is 3, the network can include an office network, a production network, and the Internet. Based on this, the network layer proxy server 101 can include an office network zone proxy server corresponding to the office network, a production network zone proxy server corresponding to the production network, and an Internet zone proxy server corresponding to the Internet.

[0036] It should be noted that the office network in the embodiment of the present application is a network used for daily office work, communication and information sharing within an institution or organization, supporting various office applications and collaborative work, and the access objects corresponding to the office network may include various office equipment, desktop computers, email systems and file sharing servers, etc. The production network refers to a network used for production, operation and core business processing within an institution or organization. The access objects corresponding to the production network may include various key business systems and resources, such as databases, servers, production line control systems, etc. The Internet is a global computer network, a network system interconnected by the Transmission Control Protocol (TCP) / Internet Protocol (IP) protocol, and the access objects corresponding to the Internet may include different types of devices and networks communicating with each other, such as websites visited daily on the Internet, online services used (such as email, social media) and other public, open systems or devices.

[0037] In the embodiment of the present application, different request network flag fields can be configured for different networks, for example, HL for the Internet zone, OA for the office network zone, and SC for the production network zone.

[0038] Based on this, the network layer proxy server 101 can be used to receive an access request sent by the access object, and determine the access request message of the access object based on the access request and the request network flag field. For example, when the office network area proxy server receives an access request sent by the access object, it can add OA to the access request to obtain the access request message of the access object, that is, the access request + OA. It should be noted that if the access request is an access request of the TCP protocol, OA can be added to the access request; if the access request is an access request of the HTTP protocol, OA can be added to the header of the access request. Based on this, the network layer proxy server 101 can also be used to send an access request message to the permission verification module.

[0039] Therefore, after receiving the user's access request, each network layer proxy server published by the application system in the embodiment of the present application will add a request network flag field to the access request, that is, add a request source flag to the request message header forwarded to the permission management module to identify whether the access request comes from the Internet, office network or production network. Since the request source identifiers set on different network layer proxy servers are different, it can be ensured that the true network source of the access request can be accurately identified.

[0040] The permission verification module in the embodiment of the present application is used to obtain an access request message of an access object; and when the access request message includes a request network flag field, verify the permission of the access object to access at least one application system, and the request network flag field is used to indicate the network source of the access request; when it is verified that the permission of the access object to access each application system is passed, an access request message is sent to each application system, thereby realizing precise control of application publishing permissions.

[0041] It should be noted that the network layer proxy server in the embodiment of the present application includes at least one network layer proxy server of any one of the M networks, the network type of each of the M networks is different, one network corresponds to a request network flag field, the network identification information corresponding to each network is different, and M is an integer greater than 1.

[0042] Therefore, in an embodiment of the present application, a request network flag field is added to the access request to identify whether the access request comes from the Internet, office network or production network. Since the request source identifiers set on different network layer proxy servers are different, it can be ensured that the true network source of the access request can be accurately identified.

[0043] In some embodiments, the permission verification module in the embodiments of the present application can also be used to, when the access request message includes a request network flag field, determine whether the request network flag field in the access request message satisfies preset legal conditions; when it is determined that the request network flag field in the access request message satisfies the preset legal conditions, verify the access object's permission to access at least one application system according to the access list corresponding to the request network flag field.

[0044] The preset legal condition in the embodiment of the present application includes at least one of the following: a preset format and a preset string type. Thus, when it is determined that the format of the request network flag field in the access request message is the preset format, it is determined that the request network flag field meets the preset legal condition; when it is determined that the string type of the request network identification field in the access request message is the preset string type, it is determined that the request network flag field meets the preset legal condition.

[0045] The permission verification module in the embodiment of the present application can be specifically used to filter, according to the requested network flag field, an access list corresponding to the requested network flag field from N reference access list lists corresponding to each network in M ​​networks, where the network type of each network is different, and the N reference access list lists are provided by at least one application system, and M and N are both integers greater than 1; based on the access address in the access list and the first access address carried in the access request message, verify the permission of the access object to access at least one application system.

[0046] Specifically, the access list includes at least one of the following lists: a white list and a black list. The white list includes the addresses of the application systems that the access object is allowed to access, and the black list includes the addresses of the application systems that the access object is not allowed to access. In this way, when the white list includes the first access address, the access object's permission to access at least one application system is verified; when the black list does not include the first access address, the access object's permission to access at least one application system is verified.

[0047] Therefore, after receiving the access request message from the network layer proxy server, the permission control module can further forward the request or directly intercept the request according to the configured black and white list of applications, functions, and interfaces of each network, thereby improving the efficiency of permission control over visitors' access to the application system. The above configuration is centrally managed by the permission control module, thereby realizing unified and centralized control of multi-network and multi-portal publishing rules, and supporting different networks and portals to publish different applications, functions, and interfaces.

[0048] In other embodiments, the permission verification module in the embodiments of the present application can also be used to send an identity authentication request to the authentication system corresponding to the requested network identification field when the access request message includes a first field for the access object to log in to the application system and the access request message includes a requested network identification field, wherein the identity authentication request is used to request the authentication system to provide policy information for verifying the access object's permission to access each application system; receive the policy information sent by the authentication system, the policy information including a second field for the access object allowed to log in to each application system and access permission information for the access object allowed to log in to each application system; and when the first field matches the second field, verify that the access object's permission to access each application system is passed, and determine the access permission information as the access object's permission to access each application system.

[0049] Therefore, the permission management module can realize different authentication strategies for application system requests on different networks by integrating and adapting different authentication systems. The solution not only effectively meets the demands of differentiated login methods for different networks, but also effectively shields this difference for business applications, thus reducing costs and increasing efficiency. In addition, without modifying the application system, by adding a permission control module, multiple application systems can be reused, and the configuration of the request source mark of the auxiliary network device layer server can realize the precise release control of multi-network release of at least one application system, thus improving the efficient rate of deployed resources.

[0050] It should be noted that the data processing method provided in the embodiment of the present application can be applied to the scenario of multi-network publishing permission management and control of the application system.

[0051] Combine the following Figure 2 The data processing method performed by the authority verification module in the above data processing system is described in detail.

[0052] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application.

[0053] like Figure 2 As shown, the data processing method can be applied to Figure 1 The permission verification module in the data processing system shown in the figure, the data processing method may specifically include the following steps:

[0054] Step 210, obtaining an access request message of the access object; Step 220, verifying the access object's authority to access at least one application system when the access request message includes a request network flag field; wherein the access request message is determined by the network layer proxy server based on the access request and the request network flag field sent by the access object, and the request network flag field is used to indicate the network source of the access request; Step 230, sending an access request message to each application system when verifying that the access object's authority to access each application system is passed.

[0055] Therefore, through the network layer proxy server, a request network flag field can be added to the access request sent by the access object to indicate the network source of the access request. The request network flags of different networks are different, thereby ensuring that the true network source of the user's access can be accurately identified. The access request message includes the request network flag field and the access object's permission to access at least one application system is verified. The access request message of the access object can be forwarded to the application system, which can effectively detect the identity of the access object, thereby restricting the access object from accessing the application system, and improving the efficiency of permission management and control over visitors to access the application system. Furthermore, without the need to modify the application system, by adding a permission verification module that can be shared by at least one application, the network layer proxy server is assisted in the transmission of the request network flag field, thereby effectively solving the problem of multiple network publishing permission management and control for at least one application system. In addition, the verification logic is concise and can ensure the timeliness of network access for the access object. Moreover, the data processing logic does not require hardware improvements and is therefore universal. It can not only meet the demands of a single application system for publishing to multiple networks such as the Internet, office networks, and production networks, but also meet the demands of multiple application systems for publishing to multiple networks at the same time, thereby improving the efficient rate of deployed resources, saving hardware resource costs, and reducing the cost of service system permission management and control.

[0056] The above steps are described in detail below, as shown below.

[0057] First, regarding step 210, the access request message for accessing the object in the embodiment of the present application may include one sent by a network layer proxy server, and may also include one sent by other servers.

[0058] It can be determined whether the access request message includes a request network flag field. If the access request message includes a request network flag field, it can be determined that the access request message is sent after being processed by a network layer proxy server. The access request message can be determined by the access request and the request network flag field sent by the network layer proxy server based on the received access object.

[0059] If the access request message does not include the requested network flag field, it can be determined that it is sent by another server, and the user can be prompted that he has no access rights.

[0060] Secondly, regarding step 220, in some embodiments of the present application, step 220 may specifically include step 2201 and step 2202.

[0061] Step 2201: When the access request message includes a requested network flag field, determine whether the requested network flag field in the access request message meets a preset legal condition.

[0062] Exemplarily, the access request message may include a request network flag field, wherein the network flag field may include a request network flag field HL of an Internet zone, a request network flag field OA of an office zone, and a request network flag field of a production zone SC. If the access request message includes the aforementioned three request network flag fields, it can be determined whether the request network flag field in the access request message meets the preset legal condition.

[0063] Step 2202: When it is determined that the requested network flag field in the access request message meets the preset legal condition, the permission of the access object to access at least one application system is verified according to the access list corresponding to the requested network flag field.

[0064] Therefore, after receiving the user's access request through each network layer proxy server, a request network flag field will be added to the access request, that is, a request source flag will be added to the request message header forwarded to the permission management module to identify whether the access request comes from the Internet, office network or production network. Since the request source identifiers set on different network layer proxy servers are different, it can ensure that the true network source of the access request can be accurately identified.

[0065] In some embodiments, the preset legal conditions in the embodiments of the present application include at least one of the following: a preset format, a preset string type. Based on this, the above step 2201 can specifically determine that the requested network flag field meets the preset legal conditions in the following two ways, as shown below.

[0066] The preset legal condition in the embodiment of the present application is a preset format, and the step 2201 may specifically include: when it is determined that the format of the request network flag field in the access request message is the preset format, determining that the request network flag field meets the preset legal condition. Conversely, when it is determined that the format of the request network flag field in the access request message is not the preset format, determining that the request network flag field does not meet the preset legal condition.

[0067] The preset legal condition in the embodiment of the present application is a preset string type, and the step 2201 may specifically include: when it is determined that the string type of the request network identification field in the access request message is the preset string type, it is determined that the request network flag field meets the preset legal condition. On the contrary, when it is determined that the format of the request network flag field in the access request message is not the preset format, it is determined that the request network flag field does not meet the preset legal condition.

[0068] In some embodiments of the present application, the above step 2202 may specifically include step 22021 and step 22022.

[0069] Step 22021, according to the requested network flag field, filter the access list corresponding to the requested network flag field from the N reference access list lists corresponding to each network in the M networks, each network has a different network type, the N reference access list lists are provided by at least one application system, and M and N are both integers greater than 1.

[0070] Step 22022: Verify the access object's authority to access at least one application system based on the access address in the access list and the first access address carried in the access request message.

[0071] Exemplarily, the access address in the access list may be a URL address, and the first access address is URL1. Based on this, the URL addresses in the access list may be compared with URL1 respectively. When URL1 is included in the access list, the permission of the access object to access at least one application system is verified, and step 230 may be executed; conversely, when URL1 is not included in the access list, the permission of the access object to access at least one application system is verified to be failed, and the user may be prompted that he has no right to access.

[0072] Therefore, the permission control module is introduced to implement the permission control logic of multi-network application publishing. The access list can be used to verify whether the back-end application URL address accessed by the user is legal. Only requests that pass the verification are forwarded to the back-end application server, thereby effectively restricting the access object from accessing the application system and improving the efficiency of permission control over visitors' access to the application system.

[0073] In the embodiment of the present application, the access list includes at least one of the following lists: a white list and a black list. The white list includes the addresses of application systems that the access object is allowed to access, and the black list includes the addresses of application systems that the access object is not allowed to access.

[0074] Based on this, step 22022 may specifically include:

[0075] If the whitelist includes the first access address, the access object's permission to access at least one application system is verified. If the whitelist does not include the first access address, the access object's permission to access at least one application system is not verified, and the user may be prompted that he has no access rights.

[0076] Alternatively, if the blacklist does not include the first access address, the access object's permission to access at least one application system is verified. If the blacklist includes the first access address, the access object's permission to access at least one application system is not verified, and the user may be prompted that he has no access rights.

[0077] Therefore, it supports publishing different applications for different network configurations and supports targeted publishing of applications to a certain network. It introduces a function blacklist or whitelist mechanism, supports grouping and managing request paths by application and function, and effectively meets the demands for personalized application publishing and control.

[0078] In addition, after step 220 , the data processing method may further include steps 2401 and 2402 .

[0079] Step 2401: upon receiving first update indication information sent by a network layer proxy server, where the first update indication information includes an update legal condition, the preset legal condition is updated to an update legal condition according to the first update indication information.

[0080] Step 2402: upon receiving the second update indication information sent by each application system, where the second update indication information includes an updated access list, the access list is updated to an updated access list according to the second update indication information.

[0081] Therefore, the permission control module detects configuration file change events in real time and supports real-time changes to configuration files. In addition, it also provides a configuration management interface to support the integration of configuration control functions into an external unified operation control platform.

[0082] In some other embodiments of the present application, the access request message includes a first field for accessing the object to log into the application system. Based on this, step 220 may specifically include steps 2203 to 2205.

[0083] Step 2203, when the access request message includes a requested network identification field, an identity authentication request is sent to the authentication system corresponding to the requested network identification field, wherein the identity authentication request is used to request the authentication system to provide policy information for verifying the access object's authority to access each application system.

[0084] Step 2204: Receive the policy information sent by the authentication system, where the policy information includes the second field of the access object allowed to log in to each application system and the access permission information of the access object allowed to log in to each application system.

[0085] Step 2205 , when the first field matches the second field, verify that the access object has the permission to access each application system, and determine the access permission information as the access object's permission to access each application system.

[0086] Therefore, it supports executing different authentication strategies for requests from different networks, forwarding the authenticated user information to business applications according to unified specifications, and shielding the differences in authentication methods of multiple networks and multiple login systems for business applications.

[0087] Then, in step 230, if the access object is accessing an application system, then an access request message can be sent to the application system after verifying that the access object has the permission to access the application system.

[0088] Furthermore, if the access object accesses at least two application systems, then after verifying that the access object has permission to access each of the at least two application systems, an access request message may be sent to each of the at least two application systems.

[0089] Therefore, the data processing method provided by the embodiment of the present application can effectively solve the method of controlling the permission of application publishing on multiple networks, wherein only one permission control module needs to be added to realize the problem that the application supports publishing to multiple networks at the same time without modification. At the same time, since the permission control module is only responsible for verifying whether the URL accessed by the user is in the URL whitelist corresponding to the pre-configured request source mark, the verification logic is very simple, because it has little effect on the timeliness of the user's network access. In addition, the logical design of the network control module has very strong versatility, which can not only meet the demands of a single application to publish to multiple networks such as the Internet and office network at the same time, but also meet the demands of multiple applications to publish to multiple networks at the same time, and can realize a set of permission control modules to serve multiple applications, so as to achieve efficient use of deployment resources and save hardware resource costs.

[0090] In addition, this solution makes very little change to the network layer proxy server. It only requires adding configuration rules for request source flag information to the new message request header on the network layer proxy server. The specific access whitelist control logic is implemented in the permission management module. Subsequent adjustments to the application access whitelist do not require the cooperation of the network server.

[0091] Combine the following Figure 3 and Figure 4 The data processing method provided in the embodiment of the present application is described in detail.

[0092] like Figure 3 As shown, the data processing method may include the following steps.

[0093] Step (1): Network layer proxy server Figure 3 The proxy layer server in the server can receive access requests initiated by the access object, such as page access requests.

[0094] Step (2): The network layer proxy server adds a request network flag field, i.e., request network flag information, to the header of the page access request, obtains an access request message, and sends the access request message to the permission verification module.

[0095] Here, the request network flags set by proxy servers in the same network zone are the same, and the request network flags set by proxy servers in different network zones are different, which effectively ensures that the permission verification module can accurately identify which network the request comes from. In addition, since the network request flag is set by the proxy server, the user cannot forge it by tampering with the message, and the information forged by the user will also be covered by the proxy server setting operation.

[0096] Step (3): After receiving the access request forwarded by the proxy server, the permission verification module can Figure 4 The authentication method 1 shown checks whether the request network flag field in the request message header of the access request message is legal. If it is illegal, the user is prompted that he has no right to access. If it is legal, step (4) is executed.

[0097] Step (4): The permission verification module can be Figure 4 The authentication method 2 shown is to determine whether the URL address in the current access request message is in the URL whitelist corresponding to the current request network flag field according to the pre-configured URL whitelist list accessible by each network.

[0098] Step (5): If the permission verification module determines that the URL address currently requested by the user is not in the URL whitelist corresponding to the requested network flag, the user is prompted that he has no access rights; otherwise, the access request message is forwarded to the backend application system, such as Figure 4 Application B shown.

[0099] Step (6): The application system processes the user's request normally.

[0100] Step (7): After receiving the operation result returned by the application system, the permission verification module may send the operation result to the access object through the proxy layer server.

[0101] It should be noted that the permission verification module can also be used after authentication method 2, such as Figure 4 After the authentication method 3 shown is verified, an access request message can be sent to the application system, wherein the authentication method 3 may include connecting to the specified authentication system according to the requested network flag field, obtaining the user's login information and permission information, thereby realizing user-level application URL menu permission control, and forwarding the authenticated user information to the business application according to a unified specification, thereby shielding the differences in authentication methods of multiple networks and multiple login systems for business applications.

[0102] Therefore, through the above description of the embodiment, in the embodiment of the present application, without the need for modification of the application system, by adding a permission verification module that can be shared by multiple application systems, the network layer proxy server can be assisted in the transmission of the request network mark information, thereby effectively solving the problem of permission control of applications publishing to multiple networks. Since the permission control module is only responsible for verifying whether the URL accessed by the user is in the URL whitelist corresponding to the pre-configured request source mark, the verification logic is very simple because it has little effect on the timeliness of the user's network access. In addition, the logical design of the network layer proxy server has very strong versatility, which can not only meet the demands of a single application to publish to multiple networks such as the Internet and office networks at the same time, but also meet the demands of multiple applications to publish to multiple networks at the same time, and can realize a set of permission control modules to serve multiple applications, so as to achieve efficient use of deployment resources and save hardware resource costs.

[0103] The present application also provides a data processing device corresponding to the above data processing method, specifically in combination with Figure 5 Provide detailed explanation.

[0104] Figure 5 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application.

[0105] In some embodiments of the present application, Figure 5 The data processing device shown can be arranged in the embodiment of the present application as shown in Figure 1 The permission verification module in the data processing system shown.

[0106] Based on this, Figure 5 As shown, the data processing device 50 may specifically include:

[0107] An acquisition module 501 is used to acquire an access request message of an access object;

[0108] Verification module 502, used to verify the access object's permission to access the application system when the access request message includes a request network flag field; wherein the access request message is determined by the network layer proxy server based on the access request and the request network flag field sent by the access object, and the request network flag field is used to indicate the network source of the access request;

[0109] The sending module 503 is used to send an access request message to the application system when the access object's access authority to the application system is verified to be passed.

[0110] The data processing device 50 in the embodiment of the present application is described in detail below.

[0111] In some embodiments of the present application, the verification module 502 may be specifically configured to, when the access request message includes a request network flag field, determine whether the request network flag field in the access request message satisfies a preset legal condition;

[0112] When it is determined that the requested network flag field in the access request message meets the preset legal condition, the permission of the access object to access at least one application system is verified according to the access list corresponding to the requested network flag field.

[0113] In some embodiments of the present application, the verification module 502 may be specifically configured to, when the preset legal condition includes at least one of the following: a preset format, a preset string type, and when it is determined that the format of the request network flag field in the access request message is the preset format, determine that the request network flag field satisfies the preset legal condition;

[0114] When it is determined that the string type of the requested network identification field in the access request message is a preset string type, it is determined that the requested network flag field meets the preset legal condition.

[0115] In some embodiments of the present application, the verification module 502 may be specifically configured to, according to the request network flag field, filter an access list corresponding to the request network flag field from N reference access list lists corresponding to each network in the M networks, each network having a different network type, the N reference access list lists being provided by at least one application system, and M and N being both integers greater than 1;

[0116] The authority of the access object to access at least one application system is verified according to the access address in the access list and the first access address carried in the access request message.

[0117] In some embodiments of the present application, the verification module 502 may be specifically used to verify that the access object has permission to access at least one application system when the access list includes at least one of the following lists: a white list and a black list, the white list includes addresses of application systems that the access object is allowed to access, the black list includes addresses of application systems that the access object is not allowed to access, and the white list includes the first access address;

[0118] In the case that the blacklist does not include the first access address, it is verified that the access object has permission to access at least one application system.

[0119] In some embodiments of the present application, the data processing device 50 in the embodiment of the present application may further include an updating module, which is used to update the preset legal condition to the updated legal condition according to the first update indication information when receiving the first update indication information sent by the network layer proxy server, and the first update indication information includes the updated legal condition;

[0120] When the second update indication information sent by each application system is received, and the second update indication information includes an updated access list, the access list is updated to an updated access list according to the second update indication information.

[0121] In some embodiments of the present application, the sending module 503 may also be used to, when the access request message includes the first field for the access object to log in to the application system, and the access request message includes the request network identification field, send an identity authentication request to the authentication system corresponding to the request network identification field, wherein the identity authentication request is used to request the authentication system to provide policy information for verifying the access object's permission to access each application system;

[0122] The data processing device 50 in the embodiment of the present application may further include a receiving module for receiving policy information sent by the authentication system, the policy information including a second field of the access object allowed to log in to each application system and access permission information of the access object allowed to log in to each application system;

[0123] The verification module 502 may also be used to verify that the access object has permission to access each application system when the first field matches the second field, and determine the access permission information as the access object's permission to access each application system.

[0124] In the embodiment of the present application, the data processing device can obtain the access request message of the access object, and verify the access object's permission to access at least one application system when the access request message includes a request network flag field; wherein the access request message is determined by the network layer proxy server based on the access request and the request network flag field sent by the access object, and the request network flag field is used to indicate the network source of the access request; in this way, when the access object's permission to access each application system is verified, the access request message is sent to each application system. Therefore, the network layer proxy server can add a request network flag field to the access request sent by the access object to indicate the network source of the access request, and the request network flags of different networks are different, thereby ensuring that the true network source of the user's access can be accurately identified, and the access request message of the access object can be forwarded to the application system only when the access request message includes the request network flag field and the access object's permission to access at least one application system is verified, which can effectively detect the identity of the access object, thereby restricting the access object from accessing the application system, and improving the efficiency of the permission control of the visitor to access the application system. Furthermore, without the need to modify the application system, by adding a permission verification module that can be shared by at least one application, the network layer proxy server is assisted in the transmission of the request network flag field, thereby effectively solving the problem of multiple network publishing permission management and control for at least one application system. In addition, the verification logic is concise and can ensure the timeliness of network access for the access object. Moreover, the data processing logic does not require hardware improvements and is therefore universal. It can not only meet the demands of a single application system for publishing to multiple networks such as the Internet, office networks, and production networks, but also meet the demands of multiple application systems for publishing to multiple networks at the same time, thereby improving the efficient rate of deployed resources, saving hardware resource costs, and reducing the cost of service system permission management and control.

[0125] Based on the same inventive concept, the present application also provides a computer device. Figure 6 Provide detailed explanation.

[0126] Figure 6 It is a schematic diagram of the structure of a computer device provided by an embodiment of the present application.

[0127] like Figure 6 As shown, the computer device may include at least one of the following involved in the embodiments of the present application: a server where the data processing system is located, and a device where the authority verification module is located. The computer device may include a processor 601 and a memory 602 storing computer program instructions.

[0128] Specifically, the processor 601 may include a central processing unit (CPU), or an application specific integrated circuit (Application Specific Integrated Circuit (ASTC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0129] The memory 602 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 602 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 602 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 602 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 602 is a non-volatile solid-state memory. In a specific embodiment, the memory 602 includes a solid-state storage (ROM). In appropriate cases, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM) or a flash memory or a combination of two or more of these.

[0130] The processor 601 implements any one of the data processing methods in the above embodiments by reading and executing computer program instructions stored in the memory 602 .

[0131] In one example, the computer device may further include a communication interface 603 and a bus 66. Figure 6 As shown, the processor 601, the memory 602, and the communication interface 603 are connected via a bus 66 and communicate with each other.

[0132] The communication interface 603 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0133] Bus 66 includes hardware, software or both, and the parts of flow control device are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industry standard system (ETSA) bus, front side bus (FSB), hypertransport (HT) interconnection, industry standard system (TSA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel system (MCA) bus, peripheral component interconnection (PCT) bus, PCT-Express (PCT-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 66 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0134] The computer device can execute the data processing method in the embodiment of the present application, thereby realizing the combination Figures 2 to 6 The data processing method and device described.

[0135] In addition, in combination with the data processing method in the above embodiments, the present application embodiment can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the data processing methods in the above embodiments is implemented.

[0136] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0137] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0138] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0139] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A data processing method, comprising: Obtain access request message of access object; In the case where the access request message includes a request network flag field, verifying the access object's permission to access at least one application system; wherein the access request message is determined by a network layer proxy server based on the access request and the request network flag field sent by the access object, and the request network flag field is used to indicate the network source of the access request; When it is verified that the access object has the right to access each of the application systems, the access request message is sent to each of the application systems.

2. The method according to claim 1, wherein: When the access request message includes a request network flag field, verifying the permission of the access object to access at least one application system includes: In the case where the access request message includes a requested network flag field, determining whether the requested network flag field in the access request message satisfies a preset legal condition; When it is determined that the requested network flag field in the access request message meets the preset legal condition, the permission of the access object to access at least one application system is verified according to the access list corresponding to the requested network flag field.

3. The method according to claim 2, wherein: The preset legal condition includes at least one of the following: a preset format, a preset string type; the determining whether the request network flag field in the access request message satisfies the preset legal condition includes: In the case of determining that the format of the requested network flag field in the access request message is the preset format, determining that the requested network flag field satisfies the preset legal condition; In the case where it is determined that the string type of the requested network identification field in the access request message is the preset string type, it is determined that the requested network flag field meets the preset legal condition.

4. The method according to claim 2, wherein: The verifying the permission of the access object to access at least one application system according to the access list corresponding to the request network flag field includes: According to the requested network flag field, an access list corresponding to the requested network flag field is screened from N reference access list lists corresponding to each network in M ​​networks, each network having a different network type, the N reference access list lists are provided by at least one application system, and M and N are both integers greater than 1; The permission of the access object to access at least one application system is verified according to the access address in the access list and the first access address carried in the access request message.

5. The method according to claim 4, wherein: The access list includes at least one of the following lists: a white list and a black list, wherein the white list includes the addresses of the application systems that the access object is allowed to access, and the black list includes the addresses of the application systems that the access object is not allowed to access; The verifying the permission of the access object to access at least one application system according to the access address in the access list and the first access address carried in the access request message includes: In the case where the whitelist includes the first access address, verifying that the access object has permission to access at least one application system; In a case where the blacklist does not include the first access address, it is verified that the access object has permission to access at least one application system.

6. The method according to any one of claims 2 to 4, wherein: The method further comprises: Upon receiving first update indication information sent by the network layer proxy server, where the first update indication information includes an updated legal condition, updating the preset legal condition to the updated legal condition according to the first update indication information; Upon receiving the second update indication information sent by each of the application systems, where the second update indication information includes an updated access list, the access list is updated to the updated access list according to the second update indication information.

7. The method according to claim 1, wherein: The access request message includes a first field for the access object to log in to the application system; and in the case where the access request message includes a request network flag field, verifying the access object's permission to access at least one application system includes: In the case where the access request message includes a request network flag field, sending an identity authentication request to the authentication system corresponding to the request network flag field, wherein the identity authentication request is used to request the authentication system to provide policy information for verifying the access object's permission to access each of the application systems; receiving the policy information sent by the authentication system, the policy information including a second field of an access object allowed to log into each of the application systems and access right information of the access object allowed to log into each of the application systems; In the case where the first field matches the second field, the permission of the access object to access each of the application systems is verified, and the access permission information is determined as the permission of the access object to access each of the application systems.

8. A data processing system comprising: Network layer proxy server and permission verification module; among them, The network layer proxy server is used to receive an access request sent by an access object; determine an access request message of the access object based on the access request and the request network flag field; and send the access request message to the permission verification module; The permission verification module is used to execute the steps of the data processing method as claimed in claim 1.

9. The system according to claim 8, wherein: The network layer proxy server includes at least one network layer proxy server of any one of M networks, the network type of each of the M networks is different, one of the networks corresponds to one requested network flag field, the network identification information corresponding to each of the networks is different, and M is an integer greater than 1.

10. The system according to claim 8, wherein: The permission verification module is used to execute the steps of the data processing method as described in any one of claims 2-7.

11. A data processing device, comprising: An acquisition module, used to acquire an access request message of an access object; A verification module, used to verify the permission of the access object to access at least one application system when the access request message includes a request network flag field; wherein the access request message is determined by a network layer proxy server based on the access request and the request network flag field sent by the access object, and the request network flag field is used to indicate the network source of the access request; The sending module is used to send the access request message to each of the application systems when verifying that the access object has the permission to access each of the application systems.

12. A computer device, comprising: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the steps of the data processing method according to any one of claims 1 to 7 are implemented.

13. A storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement the steps of the data processing method according to any one of claims 1 to 7.

14. A computer program product, characterized in that The program product is stored in a storage medium, and the program product is executed by at least one processor to implement the steps of the data processing method according to any one of claims 1 to 7.

Images