Method for data isolation and authority control among multiple projects in configuration system

Abstract

The invention relates to a data isolation and authority control method among multiple projects in a configurable system, and belongs to the technical field of configurable system application. The method comprises the following steps: creating and configuring a project; the interface returns project key information; encrypting the project key information and embedding the project key information into a link of a project service system; the key parser automatically parses project information in the link, dynamically loads project data according to the project release state and the user role authority, rejects unauthorized users, and ensures that the unreleased project is only visible to the creator. The data isolation and authority control method among the multiple projects in the configuration system is a method capable of sharing project links, identifying member authorities, ensuring data isolation and efficiently switching projects with high security when a plurality of sub-projects and a plurality of team members are ensured to have business intersection in a configuration project business system.

Description

Technical Field

[0001] The present invention relates to the technical field of configurable system applications, and in particular to a method for data isolation and authority control among multiple projects in a configurable system. Background Art

[0002] In traditional configurable project business systems, multiple projects typically share the same underlying database or service resources. When sub-project systems exist and users participate in multiple projects simultaneously, existing technologies face the following problems:

[0003] 1. Poor data isolation: Data between different projects can be easily cross-accessed or leaked due to improper permission configuration or operational errors.

[0004] 2. Rigid permission control: Existing permission models are mostly statically allocated and cannot dynamically adapt to the complex permission requirements in multi-project scenarios.

[0005] 3. Low project switching efficiency: The permission mechanism is mainly based on back-end database view isolation, which has high server computing costs. Users need to log in and out repeatedly when switching projects, which can easily lead to data residue and operational errors.

[0006] 4. Insufficient security: When team members have overlapping roles across multiple projects, it is easy for them to unauthorize operations between projects, and project links or key information are not encrypted, posing the risk of illegal interception.

[0007] Existing solutions, such as role-based access control and database view isolation, partially address the permissions issue within a single project, but struggle to address the dynamic security requirements of multi-project scenarios. Therefore, there is an urgent need to provide a highly efficient, multi-team, multi-project, flexible, and secure data isolation and permissions control method for web-based configurable project business systems. Summary of the Invention

[0008] The present invention aims to solve the technical problems of poor data isolation, rigid authority control, low project switching efficiency and insufficient security in multi-project scenarios in WEB configurable project business systems in the prior art, and provides a method for data isolation and authority control between multiple projects in a configurable system.

[0009] In order to solve the above technical problems, the technical solutions of the present invention are as follows:

[0010] A method for data isolation and permission control among multiple projects in a configurable system, wherein the configurable system includes: a project link information encryption and decryption module, a user information and project information binding module, a permission verification and routing interceptor module, a project business system derivation module, and a browser monitoring and data clearing module;

[0011] Project link information encryption and decryption module, used to automatically generate URL links encrypted by JSEncrypt algorithm based on the project information system;

[0012] The user information and project information binding module is used to bind project information and team members' personal information to the header of the verification interface and store them in the front-end thread storage Pinia and browser storage LocalStorage;

[0013] The permission check and routing interceptor module is used to determine whether to accept routing requests by checking the project information and personal information of team members in Pinia. If any of these attributes are invalid, the routing request will be intercepted and the user will be logged out.

[0014] The project business system derived module is used to identify project information and member permissions. Based on the project data returned by the interface, it loads the various business modules belonging to the current project and the current user, and implements system functions for various specific business scenarios.

[0015] The browser monitoring and data clearing module is used to monitor whether other pages in the same browser have opened related projects under the same domain name. If other projects are opened, the judgment mechanism will be triggered. If the Project-Id of the newly opened project is different from the Project-Id of the current project, the current project will be marked as an old project and the old data related to this project in LocalStorage will be cleared;

[0016] The method for data isolation and permission control among multiple projects in the configurable system includes the following steps:

[0017] Step 1: The project owner creates and configures the project in the project management system;

[0018] Step 2: After the project is successfully created, the interface returns the key project information Project-Id and Project-Status;

[0019] Step 3: Encrypt the key project information using the RSA encryption algorithm and embed it into the link of the project business system to form an encrypted link containing the project information;

[0020] Step 4: Other project members obtain the encrypted link and directly enter the project login page. The key parser automatically parses the project information in the link. If the project status is unpublished, the routing interceptor Router.BeforeEach is called to introduce the user to the unpublished prompt page and deny the user's further access request;

[0021] Step 5: If the project status is published, further verify the user account information.

[0022] In the above technical solution, step 4 is specifically as follows:

[0023] Team members obtain the encrypted link, open it in a browser, and automatically enter the project business system pre-judgment process. The JSEncrypt algorithm parser parses the project information Project-Id and Project-Status. If no valid information is parsed, it is considered an invalid link and jumps to the system's unpublished prompt page, denying further access.

[0024] If valid information is parsed, it will be uploaded to the backend to check whether it is a legal project ID and project status. If the backend interface returns an illegal project, it will jump to the system unpublished prompt page and deny other access;

[0025] Read the Project-Token information in LocalStorage. If the Project-Token is empty, it means the user is not logged in. Then jump to the login page and guide the user to log in.

[0026] The user has logged in, call getInfo() to get the user information;

[0027] Use Project-Status to determine the project release status. If the project has been released, determine whether the user belongs to the project team. If so, enter the system, assign permissions, and obtain corresponding data. If not, log out the user and indicate that the user does not have permission to enter the system.

[0028] If the Project-Status status is Unpublished, determine whether the user is the owner of this project, User-Id == Project-Owner-Id. If so, allow the user to enter the system, assign permissions, and obtain corresponding data; if not, jump to the system Unpublished prompt page and deny other access.

[0029] In the above technical solution, the project information and personal information of team members include: project information Project-Id, Project-Status, Project-Token and user identifier User-Id.

[0030] In the above technical solution, user information includes: user permissions and roles.

[0031] In the above technical solution, the permission check and routing interceptor module contains the navigation guard Router.BeforeEach of the project route. Before each page is requested, the route change will trigger the execution of the permission check.

[0032] In the above technical solution, Project-Status is used to determine the project release status. Project-Status is activated, closed, or invalid, and is set by the project owner.

[0033] In the above technical solution, the browser monitoring and data clearing module uses window.addEventListener('storage', function(){}) to monitor changes in key project information in the browser's long-term storage LocalStorage.

[0034] The present invention has the following beneficial effects:

[0035] The method for isolating data and controlling permissions between multiple projects in a configurable system of the present invention uses RSA encryption technology to hide key project information in shared links, and project members obtain links and use parsers to restore project information; uses a global Axios interface encapsulator to encapsulate the global interface into a Project-Token that integrates project and user information, ensuring that each interface operation will undergo dual authentication of the project and user identity; uses permission verifiers and routing interceptors to ensure that users can only enter specific pages or perform related operations if they have relevant permissions; uses browser monitoring and data clearing modules to ensure that only one project is active in the browser at the same time, further ensuring the isolation of data and operations between projects.

[0036] The method for isolating data and controlling permissions between multiple projects in a configurable system of the present invention is a method for sharing project links, identifying member permissions, ensuring data isolation, and efficiently switching projects in a configurable project business system when there are multiple sub-projects and multiple team members with overlapping business. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0038] Figure 1 This is a schematic diagram of the overall process of the method for isolating data and controlling permissions among multiple projects in the configuration system of the present invention.

[0039] Figure 2 This is a flowchart of the key operations in permission verification and route interception, that is, a flowchart of the key operations in the permission judgment and interception process after entering the system. DETAILED DESCRIPTION

[0040] The inventive concept of the present invention is:

[0041] The method for isolating and controlling data between multiple projects in a configurable system of the present invention realizes efficient, flexible and secure data isolation and permission control between multiple projects through encryption technology, dynamic permission binding, routing interception and browser monitoring mechanism.

[0042] The method for data isolation and authority control among multiple projects in the configuration system of the present invention comprises the following steps:

[0043] Use RSA encryption technology to hide key project information in shared links;

[0044] After project members obtain the encrypted link, they use the key parser in the project business system to restore the project information;

[0045] After the user logs in, the user information and project information are uniformly encapsulated in the global interface. Any user interface operation will pass the integrated header information to the backend for identification of project status and user permissions;

[0046] The backend returns the user's permission authentication status. Before the user loads the page or operates the data, it will be judged by the permission checker and the routing interceptor. If the user is not authorized or has not published a project, the system will prompt the user and log the user out of the system.

[0047] After the user obtains the permission, a global listener of the browser will be registered synchronously. When opening other projects, the original project information will be cleared and the new project information will be loaded, and the permission will be re-checked to prevent data pollution between projects.

[0048] The present invention will be described in detail below with reference to the accompanying drawings.

[0049] The present invention's method for isolating data and controlling permissions between multiple projects in a configurable system is applicable to configurable systems that employ a browser / server model and separate front-end and back-end deployment. The two web front-end systems, a project management system and a project business system, share the same root domain name in HTTP requests. Project owners create and configure projects in the project management system, publish generated projects, and share them with other project members in encrypted form.

[0050] The present invention provides a method for isolating data and controlling permissions among multiple projects in a configurable system, and the applicable configurable system includes: a project link information encryption and decryption module, a user information and project information binding module, a permission verification and routing interceptor module, a project business system derivation module, and a browser monitoring and data clearing module for data isolation.

[0051] The project link information encryption and decryption module is used to automatically generate URL links encrypted using the JSEncrypt algorithm based on the project information system. These links can be shared with other team members to facilitate collaborative work within the project. Project owners in the project management system can click the Share Link button based on the configured project to generate an encrypted URL link.

[0052] The user information and project information binding module is used to bind project information and team member personal information to the authentication interface header, storing it in the front-end thread storage Pinia and browser storage LocalStorage. Project information and team member personal information specifically include: Project ID, Project Status, Project Token, and User ID. When a team member with an authorized link enters the project business system, the project business system automatically parses the encrypted link to extract the project information and binds it to the team member's personal information.

[0053] The project business system derived module is used to identify project information and member permissions. Based on the project data returned by the interface, it loads the various business modules belonging to the current project and the current user, and implements system functions for various specific business scenarios.

[0054] Team members can cross multiple projects, that is, a member belongs to both Project A and Project B, and members can flexibly switch projects in the same browser without worrying about data contamination between the two projects. The implementation principle is: use encrypted links to prevent non-team members from obtaining project information. Before entering the project, members need to send the user ID and decrypted project information Project-Id and Project-Status to the backend. The backend will process this to generate a special Project-Token and return it to the frontend. Each user operation will carry the Project-Token and project information to ensure the correct project data is operated. At the same time, the user permission table returned by the backend is stored in the front-end Pinia variable. Before the user jumps to the page and operates the data, the validity of the Project-Token and the scope of the user's permission will be verified to prevent the user from exceeding his authority. The browser listener is used to monitor whether there are pages in the same browser that open other projects under the same domain name. Once this happens, the original old project will be automatically closed and the data cache will be cleared to prevent data contamination between Project A and Project B.

[0055] In the project business system, team members are responsible for completing specific division of responsibilities in the project. The only way for team members to enter the project is to use the link shared by the project owner and the assigned account and password.

[0056] The method for data isolation and authority control among multiple projects in the configuration system of the present invention comprises the following steps:

[0057] Step 1: The project owner creates and configures the project in the project management system;

[0058] Step 2: After the project is successfully created, the interface returns the key project information Project-Id and Project-Status;

[0059] Step 3: Encrypt the key project information using the RSA encryption algorithm and embed it into the link of the project business system to form an encrypted link containing the project information;

[0060] Step 4: Other project members obtain the encrypted link and directly enter the project login page. The key parser automatically parses the project information in the link. If the project status is "unpublished", the routing interceptor Router.BeforeEach is called to direct the user to the unpublished prompt page and deny the user further access requests.

[0061] Step 5: If the project status is "Published", further verify the user account information.

[0062] Furthermore, in the configurable system, the data isolation and permission control method between multiple projects is implemented. After the user passes the preliminary detection, the back-end server combines the project information Project-Id and the user information User-Id to generate a unique and time-limited project authentication token: Project-Token.

[0063] On the WEB browser side, Project-Id, Project-Status, User-Id, and Project-Token are written together to the browser's long-term storage LocalStorage and temporary process storage Store. The information stored in Store is used for the permission verifier and route interceptor in the current tab, and the information stored in LocalStorage is used for authentication of "active projects" and "old projects" in multiple tabs.

[0064] Furthermore, a global interface encapsulator is set up or developed to encapsulate the project information in the Store into the global configurator in the interface component Axios. Any network interface request will carry authentication information.

[0065] Furthermore, when the interface returns an authentication failure status, including: Project-Id does not exist, User-Id is not in the current project, or Project-Token is expired, the permission verifier and routing interceptor will receive the interface exception handling message and log out the user or direct the user to a project-free prompt page based on the return status.

[0066] Furthermore, after the information passes the authentication check, the interface returns the user routing permission table, which includes: user role, accessible page path, and whether the user is the project owner. The permission table will be stored in the temporary process storage Store together with other project information.

[0067] Furthermore, the principle of the permission checker and the routing interceptor is: each time a user interface is requested, it is determined whether the current user role exists in the allowed roles of the interface call, that is, "user role A"∈

[0068] ['Allow role A', 'Allow role B', 'Allow role C', ...]? If True, the user operation is allowed; if False, the operation is blocked and a prompt window pops up.

[0069] Furthermore, the principle of the permission checker and route interceptor is as follows: when the page path switches, the front-end route guard Router function is triggered, which sequentially checks the user's login status, whether the project token is valid, and whether the user's access path falls within the allowed path range. If True, the user operation is allowed; if False, the page jump is blocked.

[0070] The permission check and routing interceptor module contains navigation guards for project routes

[0071] Router.BeforeEach, that is, before each page is requested, the route change will trigger the execution of the permission check; the permission check and the route interceptor module are used to determine whether to accept the route request by judging the project information Project-Id, Project-Status, Project-Token and user identifier User-Id in the Pinia mentioned above. If any of these attributes fails, the route request will be intercepted and the user will be logged out.

[0072] Project-Status is used to determine the project publishing status. Project-Status can be "Active," "Closed," or "Invalid," and is set by the project owner in the project management system. Permission verification and routing interceptors check the Project-Status. Only members in the "Active" status can access the project. For other statuses, use to.path=" / UnPublish" to redirect ordinary users to the unpublished prompt page. The project owner can bypass this restriction and access the project in real time.

[0073] The browser monitoring and data clearing module is used to monitor whether other pages in the same browser have opened related projects under the same domain name. If other projects are opened, the judgment mechanism will be triggered. When the Project-Id of the newly opened project is different from the Project-Id of the current project, the current project will be marked as an old project, and the old data related to this project in LocalStorage will be cleared. This enables fast project switching and ensures that only one project is active, ensuring the isolation of data and operations between projects.

[0074] The principle of the browser monitoring and data clearing module is: use window.addEventListener('storage', function(){}) to monitor the changes in the key information of the project in the long-term storage LocalStorage of the browser, and whether other pages of the same browser have other related projects under the same domain name opened, triggering the judgment mechanism. When the Project-Id in LocalStora ge is different from the Project-Id stored in the current project process Store, the current project will be marked as an "old project", the old data related to this project in LocalStorage will be cleared, the current project will be closed, and then the "new project" data will be loaded to achieve fast project switching and ensure that only one project is active, ensuring data isolation and mutual exclusion of operations between projects.

[0075] The following will be combined with the Figure 1 and 2 The technical solutions of the present invention are described in detail with reference to the accompanying drawings and exemplary embodiments.

[0076] It should be noted that the "project owner" and "team member" mentioned in this embodiment refer to the division of roles in the system, and can also be replaced by other similar terms; the "project management system" mentioned in this embodiment is used by project owners to create and configure projects, and the "project business system" is used by team members to complete the division of responsibilities in specific projects.

[0077] In this embodiment, the system adopts a B / S service model and a front-end and back-end separation deployment mode. Two business systems are deployed on the front end, namely the project management system and the project business system.

[0078] In S101 and S102, the project owner creates and configures a project in the project management system. After successful project creation, the interface returns key project information, including Project ID and Project Status. The project owner clicks the Share Link button, and the system automatically generates a URL encrypted using the JSEncrypt algorithm based on the project information. JSEncrypt is a JavaScript-based RSA encryption algorithm, but other RSA algorithms can also achieve this functionality.

[0079] From S103 to S105, the team member obtains the encrypted link, clicks on the encrypted link, and enters the pre-parsing process of the project business system. The project business system automatically parses the project information in the encrypted link.

[0080] S106, the team member enters the login page and enters the account and password. If the current member belongs to the team of this project, the interface returns user information, including the user's unique identity information: User-Id, and a list of user permissions.

[0081] S107, store the user information in the browser temporary process Store, such as Vue3's Pinia, and store it in the browser long-term LocalStorage.

[0082] S108, in the request front interceptor Service.interceptors.request.use, encapsulate the Project-Id, Project-Status, Project-Token, User-Id and other information into the request's global configuration object config. This configuration will be applied to all backend interface requests of this project.

[0083] S109 encapsulates independent JS modules: permission checker and route interceptor modules. This module monitors the status of the route interceptor Router.BeforeEach and the interface post-interceptor Service.interceptors.response.use. Before each route request, it first checks whether the route of the page to be redirected exists in the RouteList array that matches the user role. If the result is true, the page is redirected. At the same time, it monitors the status returned by Service.interceptors.response in the interface request of the new page, and checks the user and project status in turn. Only those that meet the predetermined rules can enter the page.

[0084] Furthermore, in this method, S103 to S109 are the core steps of authority identification and routing interception. Figure 2 The flowchart in the figure is described in detail to facilitate technical personnel to more thoroughly understand the present invention:

[0085] First, team members obtain the encrypted link, open it in a browser, and automatically enter the project business system pre-judgment process. The parser part of the JSEncrypt algorithm parses the project information Project-Id and Project-Status. If no valid information is parsed, it is considered an invalid link and jumps to the "System Not Published Prompt Page", denying other access.

[0086] Furthermore, if valid information is parsed, it is uploaded to the backend to check whether it is a legal project ID and project status. If the backend interface returns "illegal project", it will jump to the "system not published prompt page" and deny other access.

[0087] Furthermore, the Project-Token information in LocalStorage is read. If the Project-Token is empty, it proves that the user is not logged in. The user is redirected to the login page to guide the user to log in.

[0088] Furthermore, the user has logged in and calls getInfo() to pull user information, including user permissions and roles.

[0089] Furthermore, the project release status is determined through Project-Status. If the project is "released", determine whether the user belongs to the project team. If so, enter the system, assign permissions, and obtain corresponding data; if not, log out the user and prompt the user "no permission to enter the system".

[0090] Furthermore, if the Project-Status status is "unpublished", determine whether the user is the owner of this project, that is, User-Id == Project-Owner-Id. If so, allow the user to enter the system, assign permissions, and obtain corresponding data; if not, jump to the "System Unpublished Prompt Page" and deny other access.

[0091] S110 and S111: Users who pass all the inspection processes obtain allocation permissions in the project business system, enter the system core page, and obtain corresponding data. The project common data is stored in the browser cache and LocalStorage.

[0092] S112, use window.addEventListener('storage', function(){}) to monitor the changes of key project information in the browser's long-term storage LocalStorage. When other related projects on the same browser page are opened, a new Project-Id will be written to LocalStorage, triggering the judgment mechanism.

[0093] S113, when the Project-Id in LocalStorage is different from the Project-Id stored in the current project process Store, the current project is marked as an "old project", the old data related to the current project in LocalStorage is cleared, the current project is closed, and then the "new project" data is loaded to achieve fast project switching and ensure that only one project is active, ensuring data isolation and mutual exclusion of operations between projects.

[0094] The method for isolating data and controlling permissions between multiple projects in a configurable system of the present invention uses RSA encryption technology to hide key project information in shared links, and project members obtain links and use parsers to restore project information; uses a global Axios interface encapsulator to encapsulate the global interface into a Project-Token that integrates project and user information, ensuring that each interface operation will undergo dual authentication of the project and user identity; uses permission verifiers and routing interceptors to ensure that users can only enter specific pages or perform related operations if they have relevant permissions; uses browser monitoring and data clearing modules to ensure that only one project is active in the browser at the same time, further ensuring the isolation of data and operations between projects.

[0095] The method for isolating data and controlling permissions between multiple projects in a configurable system of the present invention is a method for sharing project links, identifying member permissions, ensuring data isolation, and efficiently switching projects in a configurable project business system when there are multiple sub-projects and multiple team members with overlapping business.

[0096] Obviously, the above embodiments are merely examples for clarity of explanation and are not intended to limit the implementation methods. Those skilled in the art will readily appreciate that other variations or modifications based on the above descriptions are possible. It is not necessary and impossible to enumerate all implementation methods here. Obvious variations or modifications arising therefrom remain within the scope of protection of the present invention.

Claims

1. A method for data isolation and authority control among multiple projects in a configuration system, characterized in that: in, The configurable system includes: project link information encryption and decryption module, user information and project information binding module, permission verification and routing interceptor module, project business system derivation module, and browser monitoring and data clearing module; Project link information encryption and decryption module, used to automatically generate URL links encrypted by JSEncrypt algorithm based on the project information system; The user information and project information binding module is used to bind project information and team members' personal information to the header of the verification interface and store them in the front-end thread storage Pinia and browser storage LocalStorage; The project business system derived module is used to identify project information and member permissions. Based on the project data returned by the interface, it loads the various business modules belonging to the current project and the current user, and implements system functions for various specific business scenarios. The permission check and routing interceptor module is used to determine whether to accept routing requests by checking the project information and personal information of team members in Pinia. If any of these attributes are invalid, the routing request will be intercepted and the user will be logged out. The browser monitoring and data clearing module is used to monitor whether other pages in the same browser have opened related projects under the same domain name. If other projects are opened, the judgment mechanism will be triggered. If the Project-Id of the newly opened project is different from the Project-Id of the current project, the current project will be marked as an old project and the old data related to this project in LocalStorage will be cleared; The method for data isolation and permission control among multiple projects in the configurable system includes the following steps: Step 1: The project owner creates and configures the project in the project management system; Step 2: After the project is successfully created, the interface returns the key project information Project-Id and Project-Status; Step 3: Encrypt the key project information using the RSA encryption algorithm and embed it into the link of the project business system to form an encrypted link containing the project information; Step 4: Other project members obtain the encrypted link and directly enter the project login page. The key parser automatically parses the project information in the link. If the project status is unpublished, the routing interceptor Router.BeforeEach is called to introduce the user to the unpublished prompt page and deny the user's further access request; Step 5: If the project status is published, further verify the user account information.

2. The method for data isolation and authority control among multiple projects in a configuration system according to claim 1, characterized in that: Step 4 is as follows: Team members obtain the encrypted link, open it in a browser, and automatically enter the project business system pre-judgment process. The parser of the JSEncrypt algorithm parses the project information Project-Id and Project-Status. If no valid information is parsed, it is considered an invalid link and the page will be redirected to the "System Not Published Prompt Page", denying further access. If valid information is parsed, it will be uploaded to the backend to check whether it is a legal project ID and project status. If the backend interface returns an illegal project, it will jump to the system unpublished prompt page and deny other access; Read the Project-Token information in LocalStorage. If the Project-Token is empty, it means the user is not logged in. Then jump to the login page and guide the user to log in. The user has logged in, call getInfo() to get the user information; Use Project-Status to determine the project release status. If the project has been released, determine whether the user belongs to the project team. If so, enter the system, assign permissions, and obtain relevant data. If no, log out the user and prompt the user that he / she does not have permission to enter the system; If the Project-Status status is Unpublished, determine whether the user is the owner of this project, User-Id == Project-Owner-Id. If so, allow the user to enter the system, assign permissions, and obtain corresponding data; if not, jump to the system Unpublished prompt page and deny other access.

3. The method for data isolation and authority control among multiple projects in a configuration system according to claim 1 or 2, characterized in that: Project information and team member personal information include: Project-Id, Project-Status, Project-Token, and User-Id.

4. The method for data isolation and authority control among multiple projects in a configuration system according to claim 2, characterized in that: User information includes: user permissions and roles.

5. The method for data isolation and authority control among multiple projects in a configuration system according to claim 1, characterized in that: The permission check and routing interceptor module contains the navigation guard Router.BeforeEach of the project routing. Before each page is requested, the routing change will trigger the execution of the permission check.

6. The method for data isolation and authority control among multiple projects in a configuration system according to claim 3, characterized in that: Project-Status is used to determine the project release status. Project-Status is activated, closed, or invalid, and is set by the project owner.

7. The method for data isolation and authority control among multiple projects in a configuration system according to claim 1, characterized in that: The browser monitoring and data clearing module uses window.addEventListener('storage', function(){}) to monitor changes in key project information in the browser's long-term storage LocalStorage.

Images