Transaction authority control method and device, electronic equipment and computer program product

Abstract

The invention discloses a transaction authority control method and device, electronic equipment and a computer program product, and the method comprises the steps: receiving a transaction request message which carries a service code and transaction element information; matching in a preset transaction configuration table according to the service code to obtain transaction attribute information corresponding to the service code; when the transaction attribute information is to perform transaction authority control, matching in a preset transaction authority configuration table according to the service code and the corresponding transaction element information to obtain a matching result of transaction authority configuration; and determining a transaction permission verification result according to the matching result of the transaction permission configuration and the permission type of the transaction permission control. According to the invention, through the transaction configuration table and the transaction permission configuration table, interface-level fine-grained permission control can be realized according to business scene requirements, the flexibility of transaction permission control is improved, the transaction security and correctness are improved, permission configuration can be flexibly changed according to requirements, and the maintenance cost is reduced.

Description

Technical Field

[0001] The present application relates to the field of transaction processing technology, and in particular to a transaction authority control method, device, electronic device, and computer program product. Background Art

[0002] In recent years, the digital transformation of the domestic financial industry has achieved rapid development. The core systems of major banks have adopted the distributed microservices technology architecture to achieve high availability, flexibility and scalability of the core systems. However, they are also facing greater challenges. For example, the microservices architecture splits the system into multiple independent services, which greatly increases the complexity of the system. Developers need to deal with more service call issues, and it is extremely important to do a good job of service governance. In order to prevent incorrect calls to the interface and avoid business and financial risks, a flexible and controllable permission control mechanism is needed to ensure the correctness of the business.

[0003] A relatively simple transaction authority control method currently provided in the prior art is to control it through a transaction whitelist. The control method is relatively simple, and transaction authority can only be controlled in a single dimension according to the transaction code, and it is unable to solve the problem of flexible control according to business scenarios under complex calling relationships.

[0004] In order to solve the interface-level transaction permission access control, technical solutions such as role-based access control (RBAC), attribute-based access control (ABAC), OAuth2.0, API gateway, and JWT are currently commonly used. However, these solutions are often highly complex. As the scale of the system expands and business needs increase, the number of interfaces and permission rules may become very large, prone to errors or omissions, lack of flexibility, and high maintenance costs. In addition, the above methods will have a certain impact on system performance when performing permission verification and filtering on interfaces. Summary of the invention

[0005] The embodiments of the present application provide a transaction authority control method, device, electronic device, and computer program product to implement fine-grained transaction authority control that is easy to expand and maintain.

[0006] The present application embodiment adopts the following technical solutions:

[0007] In a first aspect, an embodiment of the present application provides a transaction authority control method, the transaction authority control method comprising:

[0008] Receive a transaction request message, wherein the transaction request message carries a service code and corresponding transaction element information;

[0009] Matching the service code in a preset transaction configuration table to obtain transaction attribute information corresponding to the service code;

[0010] In the case where the transaction attribute information is for transaction authority control, matching is performed in a preset transaction authority configuration table according to the service code and the corresponding transaction element information to obtain a matching result of the transaction authority configuration;

[0011] The transaction permission verification result corresponding to the transaction request message is determined according to the matching result of the transaction permission configuration and the permission type of the transaction permission control.

[0012] Optionally, the transaction request message carries a combined service code, and matching is performed in a preset transaction configuration table according to the service code to obtain transaction attribute information corresponding to the service code, including:

[0013] According to the combined service code, all basic service codes corresponding to the combined service code are matched in the preset transaction configuration table, where the combined service code is the code of the service interface obtained by assembling and arranging multiple basic service interfaces;

[0014] According to the combined service code and each corresponding basic service code, the corresponding transaction attribute information is matched in the preset transaction configuration table respectively.

[0015] Optionally, the preset transaction authority configuration table is configured with a dimension code, and the matching result of the transaction authority configuration includes a matching result of a limiting factor. When the transaction attribute information is for transaction authority control, matching is performed in the preset transaction authority configuration table according to the service code and the corresponding transaction element information, and the matching result of the transaction authority configuration obtained includes:

[0016] Classifying the transaction authority configuration information in the preset transaction authority configuration table according to the dimension code;

[0017] Determine, according to the dimension code of each category and the transaction element information, the value of the limiting factor corresponding to the dimension code of each category in the transaction element information as the limiting factor verification value corresponding to the dimension code of each category;

[0018] The limiting factor check value corresponding to the dimension code of each category is matched with the limiting factor target value corresponding to the dimension code of each category in the preset transaction authority configuration table to obtain the matching result of the limiting factor.

[0019] Optionally, the step of matching the limiting factor check value corresponding to the dimension code of each category with the limiting factor target value corresponding to the dimension code of each category in the preset transaction authority configuration table to obtain the matching result of the limiting factor includes:

[0020] If the limit factor check value is the same as the corresponding limit factor target value, then determining the matching result of the limit factor is a successful match;

[0021] Otherwise, it is determined that the matching result of the limiting factor is a matching failure.

[0022] Optionally, the transaction attribute information is divided into performing transaction authority control and not performing transaction authority control, and determining the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control includes:

[0023] Determining a control type for transaction authority control according to the transaction attribute information corresponding to the service code, wherein the control type for transaction authority control is divided into authority control for allowing transactions, authority control for rejecting transactions, and authority control for both allowing transactions and rejecting transactions;

[0024] Determining the permission type of the transaction permission control according to the control type of the transaction permission control;

[0025] The transaction permission verification result corresponding to the transaction request message is determined according to the matching result of the transaction permission configuration and the permission type of the transaction permission control.

[0026] Optionally, the matching result of the transaction authority configuration includes a matching result of a limiting factor, the authority type of the transaction authority control includes allowing a transaction and rejecting a transaction, and determining the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control includes:

[0027] If the permission type of the transaction permission control is to allow the transaction and the matching result of the limiting factor is a matching failure, or the permission type of the transaction permission control is to reject the transaction and the matching result of the limiting factor is a matching success, then determining that the transaction permission verification result corresponding to the transaction request message is that the transaction permission verification fails;

[0028] Otherwise, it is determined that the transaction authority verification result corresponding to the transaction request message is that the transaction authority verification is passed.

[0029] Optionally, the matching result of the limiting factor includes a matching result of a primary limiting factor and a matching result of an auxiliary limiting factor, the matching result of the auxiliary limiting factor is a matching result of the primary limiting factor, and the determining of the transaction permission verification result corresponding to the transaction request message according to the matching result of the transaction permission configuration and the permission type of the transaction permission control includes:

[0030] Verifying the matching result of the primary limiting factor according to the permission type of the transaction permission control to obtain a verification result of the primary limiting factor;

[0031] If the verification result of the primary limiting factor is successful, the matching result of the auxiliary limiting factor is verified according to the permission type of the transaction permission control to obtain the verification result of the auxiliary limiting factor;

[0032] If the verification result of the auxiliary limiting factor is successful, determining that the verification result of the transaction authority corresponding to the transaction request message is successful;

[0033] If the verification result of the primary limiting factor is verification failure or the verification result of the auxiliary limiting factor is verification failure, it is determined that the verification result of the transaction authority corresponding to the transaction request message is verification failure.

[0034] Optionally, the determining the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control includes:

[0035] If the permission type of the transaction permission control is to allow the transaction and the matching result of the primary limiting factor is a matching failure and at least one of the matching results of the auxiliary limiting factor is a matching failure, or the permission type of the transaction permission control is to reject the transaction and at least one of the matching result of the primary limiting factor and the matching result of the auxiliary limiting factor is a matching success, then determining that the transaction permission verification result corresponding to the transaction request message is a transaction permission verification failure;

[0036] Otherwise, it is determined that the transaction authority verification result corresponding to the transaction request message is that the transaction authority verification is passed.

[0037] In a second aspect, an embodiment of the present application further provides a transaction authority control device, the transaction authority control device comprising:

[0038] A receiving unit, configured to receive a transaction request message, wherein the transaction request message carries a service code and corresponding transaction element information;

[0039] A first matching unit, configured to match the service code in a preset transaction configuration table to obtain transaction attribute information corresponding to the service code;

[0040] A second matching unit is used to match the service code and the corresponding transaction element information in a preset transaction authority configuration table to obtain a matching result of the transaction authority configuration when the transaction attribute information is for transaction authority control;

[0041] The verification unit is used to determine the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control.

[0042] In a third aspect, an embodiment of the present application further provides an electronic device, including:

[0043] A processor; and a memory arranged to store computer executable instructions, which, when executed, cause the processor to execute any of the aforementioned transaction authority control methods.

[0044] In a fourth aspect, an embodiment of the present application further provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements any of the aforementioned transaction authority control methods.

[0045] At least one of the above technical solutions adopted in the embodiment of the present application can achieve the following beneficial effects: the transaction authority control method of the embodiment of the present application first receives a transaction request message, which carries a service code and corresponding transaction element information; then matches in the preset transaction configuration table according to the service code to obtain the transaction attribute information corresponding to the service code; then, in the case where the transaction attribute information is for transaction authority control, matches in the preset transaction authority configuration table according to the service code and the corresponding transaction element information to obtain the matching result of the transaction authority configuration; finally, the transaction authority verification result corresponding to the transaction request message is determined according to the matching result of the transaction authority configuration and the authority type of the transaction authority control. The transaction authority control method of the embodiment of the present application can realize fine-grained authority control at the interface level according to the needs of the business scenario through the transaction configuration table and the transaction authority configuration table, improves the flexibility of transaction authority control, and thus improves the security and correctness of the transaction. In addition, the transaction authority configuration information is maintained through the transaction configuration table and the transaction authority configuration table, which is convenient for flexible changes in authority configuration according to needs, without the need to re-develop the program version, and reduces maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0047] Figure 1 This is a flow chart of a transaction authority control method in an embodiment of the present application;

[0048] Figure 2 This is a schematic diagram of the overall process of transaction authority control in an embodiment of the present application;

[0049] Figure 3 This is a structural diagram of a transaction authority control device in an embodiment of the present application;

[0050] Figure 4 It is a schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0052] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0053] The main technical terms involved in this application are explained as follows:

[0054] 1) Bank core system: It is the core and foundation of the bank's software system. It is a transaction processing system for various banking businesses. Through transaction processing, it drives accounting and payment settlement, and ultimately achieves the goal of intensively processing back-end business. Whether it is the back-end credit management, fund management and other systems or the series of counter businesses that the front-end platform directly connects with customers, they all need the support of the core business system.

[0055] 2) Bank peripheral system: It is a business system that revolves around the core system, provides information and instruction transmission or business data preprocessing, and assists the operation of the core system.

[0056] 3) Service interface: It is a set of work completed by the service provider to deliver the required results to the service user. The service is based on technical implementation, through the well-defined interface of the component, and the externally visible functions provided by one or more components. The service is realized in the interaction between functions.

[0057] 4) Service orchestration: refers to the bank's core system taking over application transaction services, being called by peripheral systems, and providing combined business capabilities to peripheral systems by combining and calling multiple basic service interfaces.

[0058] 5) Composite service interface: refers to the bank's core system that orchestrates multiple basic services to form a new functional interface, providing more complex business processing to the outside world and providing account, accounting and other business processing capabilities for the bank's peripheral systems.

[0059] 6) Basic service interface: refers to a basic service processing interface, such as deposits (balance increase), withdrawals (balance deduction) or account status changes to an account and other basic accounting or account operations.

[0060] 7) Combined service code: refers to the unique identifier of a combined service, which can be a string of numbers or letters or a combination of numbers and letters.

[0061] 8) Basic service code: refers to the unique identifier of a basic service, which can be a string of numbers or letters or a combination of numbers and letters.

[0062] 9) Transaction authority: refers to whether the bank's peripheral system can directly or indirectly call a service interface of the bank's core system to provide external services.

[0063] 10) Dimension coding: refers to classifying transaction authority control rules based on a certain business attribute to achieve refined transaction authority control, such as product dimension, currency dimension, account type dimension, business initiation channel dimension, etc.

[0064] 11) Primary limiting factor: refers to the business parameter value that is primarily checked when verifying transaction permissions.

[0065] 12) Auxiliary limiting factor: refers to the business parameter value that is additionally checked when verifying transaction permissions, based on the verification of the primary limiting factor.

[0066] 13) Permission Type: refers to the restriction type of the current permission verification rule, which is divided into allowing transactions and rejecting transactions.

[0067] The present application embodiment provides a transaction authority control method, such as Figure 1 As shown, a flow chart of a transaction authority control method in an embodiment of the present application is provided, and the transaction authority control method at least includes the following steps S110 to S140:

[0068] Step S110, receiving a transaction request message, wherein the transaction request message carries a service code and corresponding transaction element information.

[0069] Combination Figure 2, provides a schematic diagram of the overall process of transaction authority control in an embodiment of the present application. In the financial field, the transaction authority control method can be executed by the bank core system, and the bank core system provides a transaction interface to the outside. When the transaction interface provided by the bank core system is called by the bank's peripheral system, correct authority control is required to prevent business and capital risks caused by erroneous calls.

[0070] Therefore, to control transaction permissions, it is necessary to first receive a transaction request message, which carries a service code and other transaction element information. The service code is the unique identifier of the service interface. Transaction element information may include account number, product code, transaction amount, transaction currency, account type, business initiation channel and other information.

[0071] Step S120: matching the service code in a preset transaction configuration table to obtain transaction attribute information corresponding to the service code.

[0072] The embodiment of the present application designs a transaction configuration table based on actual business needs. The main function of the transaction configuration table is to control the transaction permission control switch status of each service interface, that is, whether it is necessary to perform transaction permission verification on the service interface to meet the permission verification requirements of different business parties and realize flexible and configurable transaction permission verification.

[0073] Based on the above transaction configuration table, the service code carried in the transaction request message is queried and matched in the transaction configuration table to match the corresponding transaction attribute information. The transaction attribute information reflects whether the service interface called by the current request requires transaction authority verification.

[0074] Step S130, when the transaction attribute information is for transaction authority control, matching is performed in a preset transaction authority configuration table according to the service code and the corresponding transaction element information to obtain a matching result of the transaction authority configuration.

[0075] If the transaction attribute information indicates that the service interface to be called currently requires transaction permission verification, it is necessary to query and match in the pre-configured transaction permission configuration table based on the service code and the corresponding specific transaction element information. The transaction permission configuration table is the permission control information of different dimensions configured for each service interface, and is the basis for implementing fine-grained permission control.

[0076] By performing multi-dimensional query and matching of the service code and the corresponding specific transaction element information with the transaction authority configuration table, the matching result of the transaction authority configuration is obtained. The matching result may be a successful match, that is, the corresponding authority configuration information exists, or a failed match, that is, the corresponding authority configuration information does not exist.

[0077] Step S140: determining a transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control.

[0078] After obtaining the matching result of the transaction permission configuration in the above steps, it is necessary to further combine the specific permission type of the transaction permission control in the transaction permission configuration table to determine whether the transaction permission verification has passed. The permission type is mainly divided into two types: allowing transactions and rejecting transactions. Combined with the matching result of success or failure and the permission type of allowing or rejecting transactions, it is determined whether the current transaction request message has passed the verification.

[0079] The transaction authority control method of the embodiment of the present application can realize fine-grained authority control at the interface level according to the needs of business scenarios through the transaction configuration table and the transaction authority configuration table, thereby improving the flexibility of transaction authority control and thus improving transaction security and correctness. In addition, the transaction authority configuration information is maintained through the transaction configuration table and the transaction authority configuration table, which facilitates the flexible change of authority configuration according to needs, without the need to re-develop the program version, thereby reducing maintenance costs.

[0080] In some embodiments of the present application, the transaction request message carries a combined service code, and matching is performed in a preset transaction configuration table according to the service code to obtain transaction attribute information corresponding to the service code, including: matching all basic service codes corresponding to the combined service code in the preset transaction configuration table according to the combined service code, where the combined service code is the code of the service interface obtained by orchestrating and assembling multiple basic service interfaces; matching corresponding transaction attribute information in the preset transaction configuration table according to the combined service code and each corresponding basic service code.

[0081] The calling relationship between the composite service and the basic service is recorded in the form of a configuration table within the core system of the bank. Therefore, the transaction configuration table can be queried to obtain the transaction attribute flag based on the composite service code and the basic service code, and the type of transaction authority check corresponding to the current basic service interface can be determined through the transaction authority verification switch contained in the transaction attribute flag.

[0082] As shown in Table 1 below, a structural design of a transaction configuration table in an embodiment of the present application is given:

[0083] Table 1

[0084]

[0085] The transaction configuration table mainly consists of fields such as combined service code, basic service code and transaction attribute flag. A combined service interface is configured with a unique combined service code, and a basic service interface is configured with a unique basic service code. Each "combined service code + basic service code" is configured with a transaction attribute flag, and the transaction attribute flag can be identified in the form of a bitmap, such as 0000000000. Each bit represents whether the transaction executes the switch of the general component, and the value of this bit can represent different meanings. For example, the first bit of the bitmap can be configured as a switch to identify whether to perform transaction authority verification. When the bit is configured to 0, it means that no transaction authority verification is performed. When it is 1, only the authority rules for allowing transactions for the current transaction are checked. When it is 2, only the authority rules for rejecting transactions for the current transaction are checked. When it is 3, both the authority rules for allowing transactions and the authority rules for rejecting transactions are checked, that is, two-way checks. The remaining bits of the bitmap are irrelevant to this application and will not be explained in detail here.

[0086] For ease of understanding, as shown in Table 2 below, a configuration example of a transaction configuration table in an embodiment of the present application is given:

[0087] Table 2

[0088]

[0089] The above configuration example explains:

[0090] 1) For the first configuration, the first bit of the transaction attribute flag is 0, which means that no transaction permission verification is performed;

[0091] 2) In the second configuration, the first bit of the transaction attribute flag is 1, which means checking the permission rules for allowing transactions;

[0092] 3) In the third configuration, the first bit of the transaction attribute flag is 2, which means checking the permission rules for rejecting transactions;

[0093] 4) For the fourth configuration, the first bit of the transaction attribute flag is 3, which checks both the permission rules for allowing transactions and the permission rules for rejecting transactions.

[0094] In some embodiments of the present application, the preset transaction authority configuration table is configured with a dimension code, and the matching result of the transaction authority configuration includes a matching result of a limiting factor. When the transaction attribute information is for transaction authority control, matching is performed in the preset transaction authority configuration table according to the service code and the corresponding transaction element information, and obtaining the matching result of the transaction authority configuration includes: classifying the transaction authority configuration information in the preset transaction authority configuration table according to the dimension code; determining the value of the limiting factor corresponding to the dimension code of each category in the transaction element information according to the dimension code of each category and the transaction element information, as the limiting factor verification value corresponding to the dimension code of each category; matching the limiting factor verification value corresponding to the dimension code of each category with the limiting factor target value corresponding to the dimension code of each category in the preset transaction authority configuration table, to obtain the matching result of the limiting factor.

[0095] As shown in Table 3 below, a structural design of a transaction authority configuration table in an embodiment of the present application is given:

[0096] Table 3

[0097]

[0098] For ease of understanding, the following Table 4 provides a configuration example of a transaction authority configuration table in an embodiment of the present application:

[0099] Table 4

[0100]

[0101] It should be noted that the primary key in the transaction permission configuration table is the combined service code + basic service code + dimension + dimension code + primary limiting factor + auxiliary limiting factor, that is, only one unique record is allowed. The same transaction (combined service code + basic service code) can only be configured with one restriction type in the same permission dimension.

[0102] Taking the first configuration in the table as an example, the combined service code provided by the bank's core system to the peripheral system is 10000000001. This combined service internally calls the basic service (sub-service) B0000000001. The permission rule of this basic service includes the product dimension. Under this dimension, the value of the primary limiting factor is configured, but the value of the auxiliary limiting factor is not configured. Therefore, when checking permissions, only the primary limiting factor needs to be checked, and the auxiliary limiting factor does not need to be checked.

[0103] Based on the above transaction permission configuration table, the same transaction (combined service code + basic service code) may correspond to a combination of multiple dimension codes and limiting factors, and the value types of the primary limiting factors and auxiliary limiting factors corresponding to different dimensions are different. When performing permission verification, the transaction permission configuration information can be first classified according to the dimension code, for example, divided into product dimension, currency dimension, channel dimension, etc. For each dimension classification, the corresponding value is obtained from the transaction element information sent in the request for verification.

[0104] Taking the second configuration as an example, the dimension category configured is the product dimension. The specific product type, such as fixed-term product or demand product, is first extracted from the uploaded business parameters as the primary limiting factor check value. Then, the specific value of the auxiliary limiting factor, such as RMB or USD, is extracted from the uploaded business parameters as the auxiliary limiting factor check value. Finally, the primary limiting factor check value and the auxiliary limiting factor check value are matched with the primary limiting factor target value (i.e., demand product in the second configuration) and the auxiliary limiting factor target value (i.e., RMB in the second configuration) configured in the table, respectively, to obtain the matching results of the primary limiting factor and the auxiliary limiting factor.

[0105] It should be noted that the primary limiting factor is the business parameter that is first checked in the transaction permission verification, so the primary limiting factor is a parameter that must be configured, while the auxiliary limiting factor is a business parameter that is further added on the basis of the primary limiting factor. Whether to configure it can be determined based on business needs, so it is a parameter that does not have to be configured.

[0106] In some embodiments of the present application, the limiting factor check value corresponding to the dimension code of each category is matched with the limiting factor target value corresponding to the dimension code of each category in the preset transaction authority configuration table, and the matching result of the limiting factor is obtained, including: if the limiting factor check value is the same as the corresponding limiting factor target value, then the matching result of the limiting factor is determined to be a successful match; otherwise, the matching result of the limiting factor is determined to be a failed match.

[0107] Based on the foregoing embodiment, the verification of the limiting factor is to match the limiting factor verification value from the transaction request message with the corresponding limiting factor target value in the transaction authority configuration table. If the limiting factor verification value is the same as the corresponding limiting factor target value, the match is successful; if they are not the same, the match fails.

[0108] Specifically, the main limiting factor check value and the corresponding main limiting factor target value can be matched respectively. If the two are different, there is no need to match the subsequent auxiliary limiting factors. If the two are the same, the main limiting factor is matched successfully, and the auxiliary limiting factor can be further matched. If the auxiliary limiting factor is not configured, such as the auxiliary limiting factor is "*" in the first configuration in Table 4 above, no matching is required. If the auxiliary limiting factor is configured, the auxiliary limiting factor check value and the corresponding auxiliary limiting factor target value are matched. If the two are the same, the auxiliary limiting factor is matched successfully.

[0109] It should be noted that "matching success" means that the business parameters sent in the current transaction request message hit the corresponding transaction authority configuration information in the transaction authority configuration table, and "matching failure" means that the business parameters sent in the current transaction request message do not hit the corresponding transaction authority configuration information in the transaction authority configuration table.

[0110] In some embodiments of the present application, the transaction attribute information is divided into performing transaction authority control and not performing transaction authority control, and determining the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control includes: determining the control type for performing transaction authority control according to the transaction attribute information corresponding to the service code, the control type for performing transaction authority control is divided into authority control for allowing transactions, authority control for rejecting transactions, and authority control for allowing and rejecting transactions at the same time; determining the authority type of the transaction authority control according to the control type of the transaction authority control; determining the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control.

[0111] As shown in Table 1 in the aforementioned embodiment, the transaction attribute flags can be divided into two categories: transaction authority control and no transaction authority control. The specific control types of transaction authority control can be further divided into authority control for allowing transactions, authority control for refusing transactions, and two-way authority control for allowing and refusing transactions.

[0112] The transaction permission configuration table is queried according to the specific types of the combined service code, basic service code and transaction permission control. The value of the restriction type field configured in the transaction permission configuration table depends on the value of the type of transaction permission control in the transaction configuration table. For example, if the type of transaction permission control corresponding to a transaction (combined service code + basic service code) is 1, then the corresponding permission type is to allow the transaction; if the type of transaction permission control is 2, then the permission type is to refuse the transaction; if the type of transaction permission control is 3, then the permission type is to allow the transaction or refuse the transaction.

[0113] In some embodiments of the present application, the matching result of the transaction authority configuration includes the matching result of the limiting factor, the permission type of the transaction authority control includes allowing transactions and rejecting transactions, and determining the transaction authority verification result corresponding to the transaction request message based on the matching result of the transaction authority configuration and the permission type of the transaction authority control includes: if the permission type of the transaction authority control is allowing transactions and the matching result of the limiting factor is a matching failure, or the permission type of the transaction authority control is rejecting transactions and the matching result of the limiting factor is a matching success, then determining that the transaction authority verification result corresponding to the transaction request message is that the transaction authority verification fails; otherwise, determining that the transaction authority verification result corresponding to the transaction request message is that the transaction authority verification passes.

[0114] Continue to refer Figure 2 When verifying trading permissions based on the matching results of limiting factors and the permission types of trading permission control, it can be divided into the following situations:

[0115] 1) The permission type of transaction permission control is to allow transactions, and the matching result of the limiting factor is a successful match: this indicates that the business parameters in the current transaction request message hit the permission configuration information for allowing transactions, so it can be considered that the current transaction request message belongs to a request message for allowing transactions, so the transaction permission check passes, and subsequent transaction processing can be performed.

[0116] 2) The permission type of transaction permission control is to allow transactions, and the matching result of the limiting factor is a match failure: This means that the business parameters in the current transaction request message do not match the permission configuration information for allowing transactions. In this case, it can be considered that the current transaction request message does not belong to the request message for allowing transactions. Therefore, the transaction permission check fails, the transaction is reported as an error, and subsequent transaction processing cannot be performed;

[0117] 3) The permission type of transaction permission control is to reject the transaction, and the matching result of the limiting factor is a successful match: it means that the business parameters in the current transaction request message hit the permission configuration information of rejecting the transaction, so it can be considered that the current transaction request message belongs to the request message of rejecting the transaction, so the transaction permission verification fails, the transaction error is reported, and subsequent transaction processing cannot be carried out;

[0118] 4) The permission type of transaction permission control is to reject the transaction, and the matching result of the limiting factor is a match failure: This indicates that the business parameters in the current transaction request message do not match the permission configuration information for rejecting the transaction. In this case, it can be considered that the current transaction request message does not belong to the request message for rejecting the transaction. Therefore, the transaction permission check passes, and subsequent transaction processing can be performed.

[0119] In some embodiments of the present application, the matching result of the limiting factor includes the matching result of the main limiting factor and the matching result of the auxiliary limiting factor, the matching result of the auxiliary limiting factor is the matching result of the main limiting factor, and the determining the transaction permission verification result corresponding to the transaction request message according to the matching result of the transaction permission configuration and the permission type of the transaction permission control includes: verifying the matching result of the main limiting factor according to the permission type of the transaction permission control to obtain the verification result of the main limiting factor; if the verification result of the main limiting factor is a verification success, verifying the matching result of the auxiliary limiting factor according to the permission type of the transaction permission control to obtain the verification result of the auxiliary limiting factor; if the verification result of the auxiliary limiting factor is a verification success, determining that the transaction permission verification result corresponding to the transaction request message is a verification success; if the verification result of the main limiting factor is a verification failure or the verification result of the auxiliary limiting factor is a verification failure, determining that the transaction permission verification result corresponding to the transaction request message is a verification failure.

[0120] Since the auxiliary limiting factor is an additional limiting condition based on the main limiting factor, the main limiting factor can be checked first in the verification logic, and the auxiliary limiting factor can be checked after the main limiting factor is checked, thereby improving the overall verification efficiency.

[0121] In some embodiments of the present application, determining the transaction permission verification result corresponding to the transaction request message based on the matching result of the transaction permission configuration and the permission type of the transaction permission control includes: if the permission type of the transaction permission control is to allow the transaction and the matching result of the primary limiting factor is a matching failure and at least one of the matching results of the auxiliary limiting factor is a matching failure, or the permission type of the transaction permission control is to reject the transaction and at least one of the matching result of the primary limiting factor and the matching result of the auxiliary limiting factor is a matching success, then determining that the transaction permission verification result corresponding to the transaction request message is that the transaction permission verification failed; otherwise, determining that the transaction permission verification result corresponding to the transaction request message is that the transaction permission verification passed.

[0122] Continue to refer Figure 2 Specifically, based on the above-mentioned embodiment, the matching result of the main limiting factor can be verified first according to the permission type of the transaction permission control, for example, it can be divided into the following situations:

[0123] 1) If the permission type of the transaction permission control is to allow transactions and the matching result of the primary limiting factor is a successful match, the transaction permission check of the primary limiting factor is passed, and the auxiliary limiting factor is further checked.

[0124] 2) If the permission type of the transaction permission control is to allow trading and the matching result of the primary limiting factor is a match failure, then the transaction permission check of the primary limiting factor has failed and there is no need to check the auxiliary limiting factor;

[0125] 3) If the permission type of the transaction permission control is to reject the transaction and the matching result of the primary limiting factor is a successful match, then the transaction permission check of the primary limiting factor has failed and there is no need to check the auxiliary limiting factor;

[0126] 4) If the permission type of the transaction permission control is to reject the transaction and the matching result of the primary limiting factor is a matching failure, the transaction permission check of the primary limiting factor passes, and the auxiliary limiting factor is further checked.

[0127] When the primary limiting factor is verified, the matching result of the auxiliary limiting factor is further verified according to the permission type of the transaction permission control. For example, it can be divided into the following cases:

[0128] 1) If the permission type of the transaction permission control is to allow transactions and the matching result of the auxiliary limiting factor is successful, the transaction permission check of the auxiliary limiting factor also passes, and subsequent transaction processing can be performed.

[0129] 2) If the permission type of the transaction permission control is to allow transactions and the matching result of the auxiliary limiting factor is a matching failure, the transaction permission check of the auxiliary limiting factor fails, the transaction is reported as an error, and subsequent transaction processing cannot be performed.

[0130] 3) If the permission type of the transaction permission control is to reject the transaction and the matching result of the auxiliary limiting factor is a successful match, the transaction permission check of the auxiliary limiting factor fails, the transaction is reported as an error, and subsequent transaction processing cannot be performed.

[0131] 4) If the permission type of the transaction permission control is to reject the transaction and the matching result of the auxiliary limiting factor is a matching failure, the transaction permission check of the auxiliary limiting factor also passes and subsequent transaction processing can be performed.

[0132] In summary, the key points and technical effects of the transaction authority control method of this application mainly include:

[0133] 1) Through the authority control of combined service code + basic service code, the authority control of each basic service in the entire transaction processing process can be accurately controlled to prevent incorrect orchestration and calling, and avoid business risks and financial risks.

[0134] 2) Splitting transaction permissions into multiple dimensions of permission control rules based on business scenarios can meet the needs of various business scenarios, with high business scalability. Adding verification dimensions can meet the expansion of business scenarios.

[0135] 3) Business permissions are managed uniformly through configuration tables. When business permissions change, you only need to modify the permission control table configuration. There is no need to modify the application code version to achieve dynamic adjustment of permissions.

[0136] This application divides the interface-level permission control into multiple dimensions according to the needs of banking business scenarios, flexibly controls transaction permissions, and improves transaction security and correctness. Banks can modify transaction access rights by modifying the transaction permission control rule parameters, which has good flexibility. Relevant permission control rules can be set through parameters. If changes are required during the maintenance of the transaction system, only the parameters need to be adjusted, without the need to re-develop the program version, and the system maintenance cost is low.

[0137] The present application also provides a transaction authority control device 300, such as Figure 3 As shown, a schematic diagram of the structure of a transaction authority control device in an embodiment of the present application is provided, wherein the transaction authority control device 300 at least includes: a receiving unit 310, a first matching unit 320, a second matching unit 330 and a verification unit 340, wherein:

[0138] The receiving unit 310 is used to receive a transaction request message, wherein the transaction request message carries a service code and corresponding transaction element information;

[0139] A first matching unit 320, configured to match the service code in a preset transaction configuration table to obtain transaction attribute information corresponding to the service code;

[0140] The second matching unit 330 is used to match the service code and the corresponding transaction element information in a preset transaction authority configuration table to obtain a matching result of the transaction authority configuration when the transaction attribute information is for transaction authority control;

[0141] The verification unit 340 is used to determine the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control.

[0142] In some embodiments of the present application, the transaction request message carries a combined service code, and the first matching unit 320 is specifically used to: match all basic service codes corresponding to the combined service code in a preset transaction configuration table according to the combined service code, where the combined service code is the code of the service interface obtained by orchestrating and assembling multiple basic service interfaces; and match corresponding transaction attribute information in the preset transaction configuration table according to the combined service code and each corresponding basic service code.

[0143] In some embodiments of the present application, the preset transaction authority configuration table is configured with a dimension code, and the matching result of the transaction authority configuration includes the matching result of the limiting factor. The second matching unit 330 is specifically used to: classify the transaction authority configuration information in the preset transaction authority configuration table according to the dimension code; determine the value of the limiting factor corresponding to the dimension code of each category in the transaction element information according to the dimension code of each category and the transaction element information, as the limiting factor verification value corresponding to the dimension code of each category; match the limiting factor verification value corresponding to the dimension code of each category with the limiting factor target value corresponding to the dimension code of each category in the preset transaction authority configuration table, to obtain the matching result of the limiting factor.

[0144] In some embodiments of the present application, the second matching unit 330 is specifically used to: if the limiting factor check value is the same as the corresponding limiting factor target value, determine that the matching result of the limiting factor is a successful match; otherwise, determine that the matching result of the limiting factor is a failed match.

[0145] In some embodiments of the present application, the transaction attribute information is divided into performing transaction authority control and not performing transaction authority control, and the verification unit 340 is specifically used to: determine the control type for performing transaction authority control according to the transaction attribute information corresponding to the service code, the control type for performing transaction authority control is divided into authority control for allowing transactions, authority control for rejecting transactions, and authority control for allowing transactions and rejecting transactions at the same time; determine the authority type of the transaction authority control according to the control type of the transaction authority control; determine the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control.

[0146] In some embodiments of the present application, the matching result of the transaction authority configuration includes the matching result of the limiting factor, and the permission type of the transaction authority control includes allowing transactions and rejecting transactions. The verification unit 340 is specifically used to: if the permission type of the transaction authority control is allowing transactions and the matching result of the limiting factor is a matching failure, or the permission type of the transaction authority control is rejecting transactions and the matching result of the limiting factor is a matching success, then determine that the transaction authority verification result corresponding to the transaction request message is that the transaction authority verification fails; otherwise, determine that the transaction authority verification result corresponding to the transaction request message is that the transaction authority verification passes.

[0147] In some embodiments of the present application, the matching result of the limiting factor includes the matching result of the main limiting factor and the matching result of the auxiliary limiting factor, and the matching result of the auxiliary limiting factor is the matching result of the main limiting factor. The verification unit 340 is specifically used to: verify the matching result of the main limiting factor according to the permission type of the transaction permission control to obtain the verification result of the main limiting factor; if the verification result of the main limiting factor is a successful verification, then verify the matching result of the auxiliary limiting factor according to the permission type of the transaction permission control to obtain the verification result of the auxiliary limiting factor; if the verification result of the auxiliary limiting factor is a successful verification, then determine that the transaction permission verification result corresponding to the transaction request message is a successful verification; if the verification result of the main limiting factor is a verification failure or the verification result of the auxiliary limiting factor is a verification failure, then determine that the transaction permission verification result corresponding to the transaction request message is a verification failure.

[0148] In some embodiments of the present application, the verification unit 340 is specifically used to: if the permission type of the transaction permission control is to allow the transaction and the matching result of the main limiting factor is a matching failure and at least one of the matching results of the auxiliary limiting factor is a matching failure, or the permission type of the transaction permission control is to reject the transaction and at least one of the matching result of the main limiting factor and the matching result of the auxiliary limiting factor is a matching success, then determine that the transaction permission verification result corresponding to the transaction request message is that the transaction permission verification failed; otherwise, determine that the transaction permission verification result corresponding to the transaction request message is that the transaction permission verification passed.

[0149] It can be understood that the above-mentioned transaction authority control device can implement each step of the transaction authority control method provided in the above-mentioned embodiment, and the relevant explanations about the transaction authority control method are applicable to the transaction authority control device and will not be repeated here.

[0150] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 4 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0151] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0152] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0153] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a transaction authority control device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations:

[0154] Receive a transaction request message, wherein the transaction request message carries a service code and corresponding transaction element information;

[0155] Matching the service code in a preset transaction configuration table to obtain transaction attribute information corresponding to the service code;

[0156] In the case where the transaction attribute information is for transaction authority control, matching is performed in a preset transaction authority configuration table according to the service code and the corresponding transaction element information to obtain a matching result of the transaction authority configuration;

[0157] The transaction permission verification result corresponding to the transaction request message is determined according to the matching result of the transaction permission configuration and the permission type of the transaction permission control.

[0158] The above application Figure 1The method performed by the transaction authority control device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0159] The present application also provides a computer program product, including a computer program or an instruction, which is implemented when the computer program or the instruction is executed by a processor. Figure 1 The transaction authority control method in the illustrated embodiment is specifically used to execute:

[0160] Receive a transaction request message, wherein the transaction request message carries a service code and corresponding transaction element information;

[0161] Matching the service code in a preset transaction configuration table to obtain transaction attribute information corresponding to the service code;

[0162] In the case where the transaction attribute information is for transaction authority control, matching is performed in a preset transaction authority configuration table according to the service code and the corresponding transaction element information to obtain a matching result of the transaction authority configuration;

[0163] The transaction permission verification result corresponding to the transaction request message is determined according to the matching result of the transaction permission configuration and the permission type of the transaction permission control.

[0164] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0165] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0166] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0168] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0169] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0170] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0171] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0172] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0173] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A transaction authority control method, characterized in that: The transaction authority control method comprises: Receive a transaction request message, wherein the transaction request message carries a service code and corresponding transaction element information; Matching the service code in a preset transaction configuration table to obtain transaction attribute information corresponding to the service code; In the case where the transaction attribute information is for transaction authority control, matching is performed in a preset transaction authority configuration table according to the service code and the corresponding transaction element information to obtain a matching result of the transaction authority configuration; The transaction permission verification result corresponding to the transaction request message is determined according to the matching result of the transaction permission configuration and the permission type of the transaction permission control.

2. The transaction authority control method according to claim 1, characterized in that: The transaction request message carries a combined service code, and the matching in the preset transaction configuration table according to the service code to obtain the transaction attribute information corresponding to the service code includes: According to the combined service code, all basic service codes corresponding to the combined service code are matched in the preset transaction configuration table, where the combined service code is the code of the service interface obtained by assembling and arranging multiple basic service interfaces; According to the combined service code and each corresponding basic service code, the corresponding transaction attribute information is matched in the preset transaction configuration table respectively.

3. The transaction authority control method according to claim 1, characterized in that: The preset transaction authority configuration table is configured with a dimension code, and the matching result of the transaction authority configuration includes a matching result of a limiting factor. When the transaction attribute information is for transaction authority control, a matching result of the transaction authority configuration is obtained by matching the service code and the corresponding transaction element information in the preset transaction authority configuration table, and the matching result includes: Classifying the transaction authority configuration information in the preset transaction authority configuration table according to the dimension code; Determine, according to the dimension code of each category and the transaction element information, the value of the limiting factor corresponding to the dimension code of each category in the transaction element information as the limiting factor verification value corresponding to the dimension code of each category; The limiting factor check value corresponding to the dimension code of each category is matched with the limiting factor target value corresponding to the dimension code of each category in the preset transaction authority configuration table to obtain the matching result of the limiting factor.

4. The transaction authority control method according to claim 3 is characterized in that: The limiting factor check value corresponding to the dimension code of each category is matched with the limiting factor target value corresponding to the dimension code of each category in the preset transaction authority configuration table to obtain the matching result of the limiting factor, including: If the limit factor check value is the same as the corresponding limit factor target value, then determining the matching result of the limit factor is a successful match; Otherwise, it is determined that the matching result of the limiting factor is a matching failure.

5. The transaction authority control method according to claim 1, characterized in that: The transaction attribute information is divided into transaction authority control and non-transaction authority control, and the transaction authority verification result corresponding to the transaction request message is determined according to the matching result of the transaction authority configuration and the authority type of the transaction authority control, including: Determining a control type for transaction authority control according to the transaction attribute information corresponding to the service code, wherein the control type for transaction authority control is divided into authority control for allowing transactions, authority control for rejecting transactions, and authority control for both allowing transactions and rejecting transactions; Determining the permission type of the transaction permission control according to the control type of the transaction permission control; The transaction permission verification result corresponding to the transaction request message is determined according to the matching result of the transaction permission configuration and the permission type of the transaction permission control.

6. The transaction authority control method according to claim 1, characterized in that: The matching result of the transaction authority configuration includes the matching result of the limiting factor, the authority type of the transaction authority control includes allowing the transaction and rejecting the transaction, and the transaction authority verification result corresponding to the transaction request message is determined according to the matching result of the transaction authority configuration and the authority type of the transaction authority control, including: If the permission type of the transaction permission control is to allow the transaction and the matching result of the limiting factor is a matching failure, or the permission type of the transaction permission control is to reject the transaction and the matching result of the limiting factor is a matching success, then determining that the transaction permission verification result corresponding to the transaction request message is that the transaction permission verification fails; Otherwise, it is determined that the transaction authority verification result corresponding to the transaction request message is that the transaction authority verification is passed.

7. The transaction authority control method according to claim 6, characterized in that: The matching result of the limiting factor includes the matching result of the primary limiting factor and the matching result of the auxiliary limiting factor, the matching result of the auxiliary limiting factor is the matching result of the primary limiting factor, and the determining of the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control includes: Verifying the matching result of the primary limiting factor according to the permission type of the transaction permission control to obtain a verification result of the primary limiting factor; If the verification result of the primary limiting factor is successful, the matching result of the auxiliary limiting factor is verified according to the permission type of the transaction permission control to obtain the verification result of the auxiliary limiting factor; If the verification result of the auxiliary limiting factor is successful, determining that the verification result of the transaction authority corresponding to the transaction request message is successful; If the verification result of the primary limiting factor is verification failure or the verification result of the auxiliary limiting factor is verification failure, it is determined that the verification result of the transaction authority corresponding to the transaction request message is verification failure.

8. The transaction authority control method according to claim 7, characterized in that: The determining of the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control includes: If the permission type of the transaction permission control is to allow the transaction and the matching result of the primary limiting factor is a matching failure and at least one of the matching results of the auxiliary limiting factor is a matching failure, or the permission type of the transaction permission control is to reject the transaction and at least one of the matching result of the primary limiting factor and the matching result of the auxiliary limiting factor is a matching success, then determining that the transaction permission verification result corresponding to the transaction request message is a transaction permission verification failure; Otherwise, it is determined that the transaction authority verification result corresponding to the transaction request message is that the transaction authority verification is passed.

9. A transaction authority control device, characterized in that: The transaction authority control device comprises: A receiving unit, configured to receive a transaction request message, wherein the transaction request message carries a service code and corresponding transaction element information; A first matching unit, configured to match the service code in a preset transaction configuration table to obtain transaction attribute information corresponding to the service code; A second matching unit is used to match the service code and the corresponding transaction element information in a preset transaction authority configuration table to obtain a matching result of the transaction authority configuration when the transaction attribute information is for transaction authority control; The verification unit is used to determine the transaction authority verification result corresponding to the transaction request message according to the matching result of the transaction authority configuration and the authority type of the transaction authority control.

10. An electronic device, comprising: processor; and a memory arranged to store computer executable instructions, wherein when the executable instructions are executed, the processor executes the transaction authority control method according to any one of claims 1 to 8.

11. A computer program product, comprising a computer program or an instruction, wherein the computer program or the instruction, when executed by a processor, implements the transaction authority control method according to any one of claims 1 to 8.

Images