Access control methods and electronic devices

Abstract

This invention discloses a permission control method and electronic device, relating to the field of computer application technology. The method monitors page operations, obtains the functional entry points and request methods involved in the requested page, and retrieves permission configuration information for the interface corresponding to the functional entry point from local cache or a server. If the corresponding interface is a wrapper interface, the permission configuration information consists of several wrapper permission tags, each corresponding to a set of command lines to be called by the interface. If the corresponding interface is a custom interface, the permission configuration information matches a custom permission matching rule. Then, permission control is applied to the target functional entry point based on the permission configuration information. This invention, by organizing and centrally managing the permission configuration information corresponding to the interface, decouples the permission configuration information from the specific functional entry point, reducing the development workload of functional entry points and interfaces, avoiding omissions or errors in permission control, and improving security.

Description

Technical Field

[0001] This invention relates to the field of computer application technology, and in particular to access control methods and electronic devices. Background Technology

[0002] Currently, access control in web (World Wide Web) storage management systems primarily involves defining a list of executable permissions for each function's entry point during web system development and configuring this list in HTML (HyperTextMarkup Language) or JavaScript (JavaScript, a programming language that runs on web pages) code. When a user interacts with the system, the JavaScript code verifies permissions based on the currently logged-in user's configured permissions. If permissions are not met, the function's entry point is disabled to prevent accidental user actions.

[0003] The development of this approach is cumbersome, prone to omissions or errors in access control, and has poor security. Therefore, how to solve the access control problem in web storage management systems is a technical problem that urgently needs to be addressed by those skilled in the art. Summary of the Invention

[0004] This invention provides an access control method and electronic device. By decoupling access control from functional operation entry points, it reduces development workload, avoids access control omissions or errors, and improves security.

[0005] An access control method, comprising:

[0006] Monitor page operations to obtain the function entry points and function request methods involved in the requested page;

[0007] Retrieve the permission configuration information of the interface corresponding to the function entry point from the local cache;

[0008] If the permission configuration information for the corresponding interface is not found in the local cache, a request to obtain configuration information is sent to the server based on the function request method to obtain the permission configuration information for the corresponding interface.

[0009] Determine the target function entry corresponding to the current page operation, and use the obtained permission configuration information to control the access of the target function entry; wherein, if the corresponding interface is a packaged interface, the permission configuration information is a number of packaged permission tags, and the number of permission tags corresponds to a number of command lines to be called by the corresponding interface; if the corresponding interface is a custom interface, the permission configuration information matches the custom permission matching rules.

[0010] An access control method, comprising:

[0011] Based on the calling requirements, the interfaces for centralized permission management are divided into encapsulated interfaces and custom interfaces;

[0012] Determine the number of command lines that the encapsulated interface needs to call, obtain the permission flags corresponding to the command lines, and encapsulate the permission flags to obtain the permission configuration information of the encapsulated interface;

[0013] Parse the permission matching rules of the custom interface to obtain the permission configuration information of the custom interface;

[0014] The permission configuration information corresponding to the encapsulated interface and the custom interface is stored in the permission configuration information database.

[0015] Receive a permission configuration request sent by the client, and query the permission configuration information of the corresponding interface from the permission configuration information database;

[0016] The obtained permission configuration information is fed back to the client so that the client can control the permissions of the requested operation based on the permission configuration information.

[0017] The present invention also provides an access control client, comprising:

[0018] The page monitoring module is used to monitor page operations and obtain the function entry points and function request methods involved in the requested page.

[0019] The cache lookup module is used to retrieve permission configuration information of the interface corresponding to the function entry point from the local cache;

[0020] The configuration request module is used to send a request to the server to obtain configuration information based on the function request method if there is no permission configuration information for the corresponding interface in the local cache.

[0021] The permission control module is used to determine the target function entry corresponding to the current page operation, and to control the permission of the target function entry using the obtained permission configuration information; wherein, if the corresponding interface is a packaged interface, the permission configuration information is a number of packaged permission tags, and the number of permission tags corresponds to a number of command lines to be called by the corresponding interface; if the corresponding interface is a custom interface, the permission configuration information matches the custom permission matching rules.

[0022] The present invention also provides an access control server, comprising:

[0023] The interface classification module is used to classify interfaces with centralized permission management into encapsulated interfaces and custom interfaces according to calling requirements;

[0024] The permission encapsulation module is used to determine several command lines that the encapsulation interface needs to call, obtain permission tags corresponding to several command lines respectively, and encapsulate several permission tags to obtain permission configuration information of the encapsulation interface;

[0025] The permission parsing module is used to parse the permission matching rules of the custom interface to obtain the permission configuration information of the custom interface;

[0026] The permission storage module is used to store the permission configuration information corresponding to the encapsulated interface and the custom interface in the permission configuration information database.

[0027] The permission query module is used to receive a permission configuration request sent by the client and query the permission configuration information of the corresponding interface from the permission configuration information database.

[0028] The permission feedback module is used to feed back the permission configuration information obtained from the query to the client, so that the client can perform permission control on the request operation based on the permission configuration information.

[0029] The present invention also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-described access control methods when executing the computer program.

[0030] The present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described access control methods.

[0031] The present invention also provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, it implements the steps of any of the above-described access control methods.

[0032] This invention allows for monitoring of page operations, obtaining the functional entry points and request methods involved in the requested page, and then retrieving the permission configuration information of the interface corresponding to the functional entry point from the local cache. If the permission configuration information for the corresponding interface is not found in the local cache, a request to obtain configuration information is sent to the server based on the functional request method to obtain the permission configuration information for the corresponding interface. In other words, the permission configuration information for the interface corresponding to the functional entry point is no longer configured in the relevant code of the functional entry point, but is centrally managed. Specifically, there are two centralized storage locations: one is the local cache, and the other is the server. If the permission configuration information for the corresponding interface cannot be obtained from the local cache, it can be obtained from the server. Then, for the target functional entry point corresponding to the current page operation, permission control can be performed on the target functional entry point based on the obtained permission configuration information. It should be noted that the permission configuration information corresponds to different interfaces. That is, if the corresponding interface is a wrapped interface, the permission configuration information consists of several wrapped permission tags, and these permission tags correspond to several command lines that the corresponding interface needs to call; if the corresponding interface is a custom interface, the permission configuration information matches the custom permission matching rules.

[0033] As can be seen, by organizing and centrally managing the permission configuration information corresponding to different interfaces, this invention can decouple the permission configuration information from the specific functional entry points. This allows for centralized management of the permission configuration information of different functional entry points and centralized verification of permissions, thereby reducing development workload, avoiding omissions or errors in permission control, and improving security.

[0034] In response to the above control method, another control method, access control client, access control server, electronic device, readable storage medium, and computer program product of the present invention also have corresponding technical effects. Attached Figure Description

[0035] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 A flowchart illustrating an access control method provided in an embodiment of the present invention;

[0037] Figure 2 An implementation framework diagram of a storage management system provided in an embodiment of the present invention;

[0038] Figure 3 A flowchart illustrating another access control method provided in an embodiment of the present invention;

[0039] Figure 4 This is a schematic diagram illustrating an implementation framework for access control in a storage management system, provided by an embodiment of the present invention.

[0040] Figure 5 A schematic diagram of an access control client provided in an embodiment of the present invention;

[0041] Figure 6 This is a schematic diagram of an access control server provided in an embodiment of the present invention;

[0042] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention;

[0043] Figure 8 This is a schematic diagram of the specific structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0045] It should be noted that, in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0046] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0047] The access control method provided in this invention can be applied to a web storage management system to control user operations. This allows for the categorization and management of user actions, ensuring that users can only access data and functions within their scope of responsibility. This prevents low-privilege users from accidentally operating critical functions, reduces human error risks, and enhances system security. Robust access management has become an indispensable foundational capability in system design.

[0048] like Figure 2As shown, this web storage management system includes a browser and a storage system. The browser contains a permission control client, and the storage system contains a permission control server. Users can manipulate the browser, and the permission control client and server can control user access permissions. Specifically, the permission control server is responsible for defining basic permission policies, automatically generating API permission configurations, and server-side permission control; the permission control client is responsible for acquiring and managing function entry permission configurations and controlling function entry permissions (for web pages).

[0049] For details, please refer to Figure 1 , Figure 1 The method shown can be applied to Figure 2 The access control client shown includes the following steps.

[0050] S101. Monitor page operations and obtain the function entry points and function request methods involved in the requested page.

[0051] Access control clients reside in the browser and can monitor user page operations to obtain the function entry points and function request methods involved in the user's current requested page.

[0052] Among them, the function entry point refers to the starting point for triggering a function or entering a certain operation process, such as a button on a webpage (such as a send button, clicking which will start sending the relevant content), a menu / icon (such as a file save menu), a link / card (such as a view details link), etc.

[0053] The feature request method is the same as the feature request method defined in the JS code.

[0054] S102. Retrieve the permission configuration information of the interface corresponding to the function entry point from the local cache.

[0055] After determining all the function entry points and function request methods of the page requested by the page operation, the permission configuration information of the corresponding interface of the function entry point can be obtained from the local cache.

[0056] That is, the permission configuration information for all interfaces involved in this function entry point.

[0057] In this embodiment, the permission configuration information of the interface can be stored in a local cache to accelerate the efficiency of permission control. Therefore, when permission configuration information is needed, the permission configuration information of the corresponding interface can be searched locally first.

[0058] In this embodiment, the mapping relationship between the function entry point and the relevant interface can be stored. After the function entry point is determined, the corresponding relevant interface can be determined.

[0059] Retrieving the permission configuration information for the corresponding interface from the local cache can result in two outcomes: either it can be found, or it cannot be found.

[0060] S103. If the permission configuration information for the corresponding interface is not in the local cache, a request to obtain configuration information is sent to the server based on the function request method to obtain the permission configuration information for the corresponding interface.

[0061] If the permission configuration information for a corresponding interface is not found in the local cache, a request to retrieve the configuration information can be sent to the server using the function request method. Upon receiving the request, the server can retrieve the permission configuration information for the corresponding interface from the permission configuration information repository and then provide feedback.

[0062] In this way, the access control client can obtain the permission configuration information for the corresponding interface.

[0063] In one specific embodiment of this invention, after sending a request to the server to obtain configuration information based on the function request method to obtain the permission configuration information of the corresponding interface, the method further includes: storing the newly obtained permission configuration information in a local cache. That is, after obtaining the permission configuration information of the corresponding interface from the permission control server, the currently obtained permission configuration information can be cached locally to facilitate subsequent permission control of the same function entry point. For example, after the server returns the permission configuration, the ID of the front-end div (division, a basic container element) element of the function entry point and the permission configuration can be placed in the cache as a mapping relationship. The ID and the function entry point correspond one-to-one.

[0064] S104. Determine the target function entry corresponding to the current page operation, and use the obtained permission configuration information to control the access permissions of the target function entry.

[0065] If the corresponding interface is a wrapper interface, the permission configuration information consists of several wrapper permission tags, which correspond to several command lines that the corresponding interface needs to call; if the corresponding interface is a custom interface, the permission configuration information matches the custom permission matching rules.

[0066] It should be noted that in this invention, in order to achieve unified management of interface permission configuration information and avoid missing relevant permission configurations, the interfaces are classified by type in this embodiment, and corresponding permission configuration information is organized for different types of interfaces.

[0067] Specifically, interfaces can be divided into encapsulated interfaces and custom interfaces. An encapsulated interface refers to an interface that invokes command lines to achieve a specific function.

[0068] Therefore, in this embodiment, for the encapsulated interface, the permission configuration information corresponds to several encapsulated permission tags, and these permission tags correspond to the command lines that the interface needs to call. Specifically, all command lines can be divided according to storage objects and read / write operation types, and the permissions required to execute the command line can be generated. For example, the commands mkstoragepool (create storage pool), lsstoragepool (query storage pool), chstoragepool (modify storage pool), and rmstoragepool (delete storage pool) all belong to the storagepool storage object. Among them, the commands mkstoragepool, chstoragepool, and rmstoragepool are commands related to configuring the storage pool and require write permissions for the storage pool; the command lsstoragepool is for querying storage pool information and requires read permissions for the storage pool. According to the classification, permission tags are generated for each command line, as shown in the following examples: mkstoragepool:storagepool_write / / Create storage pool CLI: requires write permissions for the storage pool; lsstoragepool:storagepool_read / / Query storage pool CLI: requires read permissions for the storage pool.

[0069] For custom interfaces, the permission configuration information corresponds to their custom permission matching rules. For example, defining matching rules for marking permissions. On the server side handling interface requests, the same interface processing class can complete configuration or query tasks based on different request parameters or parameter values. Therefore, it is necessary to combine multiple pieces of information to determine the permissions required for the request. Taking downloading a file as an example, the corresponding permission matching rules are as follows:

[0070] {"api":"DownloadFileHandler", / / API name: "DownloadFileHandler"

[0071] "rules":[ / / Permission rules]

[0072] { “method”:”get”, / / “Request method”: “Get” / / Can also be POST (create), PUT (modify), DELETE (delete)

[0073] "parameters":["filename=file1",...], / / "Request parameters":["parameter name=parameter value"]

[0074] "auth":"storagepool_r" / / "Required permissions": "Storage pool read permissions"

[0075] }, {

[0076] "method": "get", / / Request method: "get"

[0077] "parameters":["filename=file2",...], / / "Request parameters":["parameter name=parameter value",...],

[0078] "auth":"volume_r" / / "Required permissions": "volume read permissions"

[0079] },…].

[0080] Once the permission configuration information is obtained, access control can be applied to the target function entry points.

[0081] In one specific embodiment of the present invention, access control of the target function entry is performed using the acquired permission configuration information, including: acquiring the user permission information of the current operation; determining whether the user permission information matches the permission configuration information; if yes, allowing entry into the target function entry; if no, prohibiting entry into the target function entry.

[0082] In practical applications, a permission list for each user role can be predefined to indicate which CLI and custom interfaces each user role can execute. User permission information can specifically be the permission list for the current user's corresponding role. Alternatively, user permission information can be pre-defined permission configurations for the user. After obtaining the permission configuration information and user permission information, it can be determined whether the user permission information matches the permission configuration information. For example, if the user's permission information only has volume read permission, while the permission configuration information includes volume creation, it indicates a mismatch, and access to the target function entry point can be prohibited. If the user permission information includes all permission configuration information, it indicates that the user's permissions satisfy the permissions corresponding to the target function entry point, and access to the target function entry point can be allowed. In other words, it is possible to either prohibit the user from using the relevant function or page, or allow the user to use the relevant function or page.

[0083] The method provided in this embodiment of the invention can monitor page operations, obtain the functional entry points and functional request methods involved in the requested page, and then retrieve the permission configuration information of the interface corresponding to the functional entry point from the local cache. If the permission configuration information of the corresponding interface is not found in the local cache, a request to obtain configuration information is sent to the server based on the functional request method to obtain the permission configuration information of the corresponding interface. That is to say, the permission configuration information of the interface corresponding to the functional entry point is no longer configured in the relevant code of the functional entry point, but is centrally managed. Specifically, there are two centralized storage locations: one is the local cache, and the other is the server. If the permission configuration information of the corresponding interface cannot be obtained from the local cache, it can be obtained from the server. Then, for the target functional entry point corresponding to the current page operation, permission control can be performed on the target functional entry point based on the obtained permission configuration information. It should be noted that the permission configuration information is different for different interfaces. That is, if the corresponding interface is a packaged interface, the permission configuration information is several encapsulated permission tags, and the several permission tags correspond to several command lines that the corresponding interface needs to call; if the corresponding interface is a custom interface, the permission configuration information matches the custom permission matching rules.

[0084] As can be seen, by organizing and centrally managing the permission configuration information corresponding to different interfaces, this invention can decouple the permission configuration information from the specific functional entry points. This allows for centralized management of the permission configuration information of different functional entry points and centralized verification of permissions, thereby reducing development workload, avoiding omissions or errors in permission control, and improving security.

[0085] Based on the above method embodiments, the present invention also proposes several improved solutions. The similarities and similarities between the improved solutions and the above process will not be repeated.

[0086] In one specific embodiment of this invention, the method further includes: when the local cache reaches a preset capacity threshold, determining the comprehensive value corresponding to each cached permission configuration information; and deleting the permission configuration information of the corresponding interface using the comprehensive value to release cache space. In other words, considering the large number of interfaces in practical applications, the cached permission configuration information will accumulate over time, while the local cache storage space is limited. To avoid cache overflow, a comprehensive value can be calculated for the permission configuration information corresponding to different interfaces, and the cached permission configuration information can be deleted based on the comprehensive value, thereby releasing cache space. Accordingly, permission configuration information with lower comprehensive values ​​can be deleted. A separate comprehensive value can be calculated for the permission configuration information corresponding to each interface. In this way, only the permission configuration information corresponding to the more frequently used and recently accessed interfaces can be retained in the local cache.

[0087] In one specific embodiment of the present invention, determining the comprehensive values ​​corresponding to the cached permission configuration information includes: obtaining the last usage time and usage count corresponding to each cached interface permission configuration; and calculating the time decay value matching the last usage time using a time decay value formula; wherein, the time decay value formula is: Where RS is the time decay value, The difference between the current time and the last usage time; using the usage frequency formula, calculate the usage frequency value that matches the number of uses; where, the usage frequency formula is: FS represents the frequency of use. For the number of times it is used, The value is a preset constant; the time decay value and the usage frequency value are weighted and summed according to preset weighting coefficients to obtain a comprehensive value. The usage frequency can be periodically adjusted based on a preset decay factor.

[0088] In other words, to implement cache data clearing, we can first define a cache space capacity threshold T and a time decay factor γ; then define the time decay value (Recency Score), denoted as RS, and calculate it using the following formula: ,in, This represents the current time minus the last used time. Logarithmic smoothing is used to avoid the influence of extreme values.

[0089] Define the frequency score, denoted as FS, and calculate it using the following formula: ,in, Representing extremely small constants (e.g., 1e-5) to prevent Division by zero error when the result is zero. Logarithmic smoothing is used to suppress weight differences in high-frequency operations (suitable for...). (Scenarios with large value ranges).

[0090] The number of uses can be defined. This periodic correction method reduces the impact of historical data. Calculation formula: ,in, This represents the attenuation factor, with a value range of [0,1].

[0091] An eviction score, denoted as ES, can be defined. The calculation formula is as follows: The weighting coefficients of α and β are adjusted according to business characteristics (for example, if configuration operations prioritize timeliness, the time weight is increased). A cache data deletion strategy can be defined: deletion is triggered when the cache reaches a capacity threshold T. The Elasticsearch (ES) value of all cached items is calculated, and they are sorted according to their ES values. Items with lower ES values ​​are deleted first to free up cache space.

[0092] In one specific embodiment of this invention, access control for a target function entry point is performed using the acquired access configuration information, including: controlling access to the target function entry point using the acquired access configuration information; recording the usage time corresponding to the access configuration information, and updating the last usage time of the access configuration information using the usage time; and incrementing the usage count corresponding to the access configuration information by one. That is, each time the access configuration information corresponding to an interface is used, the last usage time of the access configuration information can be updated, and the usage count can be incremented by one. For example, if the access to each function entry point in the cache is acquired once, its read time is recorded, denoted as... The number of reads (denoted as) Add 1.

[0093] Please refer to Figure 3 The present invention also provides an access control method applied to an access control server, the method comprising the following steps.

[0094] S201. According to the calling requirements, the interfaces for centralized permission management are divided into encapsulated interfaces and custom interfaces.

[0095] In this embodiment, interfaces for centralized permission management can be divided into encapsulated interfaces and custom interfaces based on whether the interface calls the command-line interface (CLI).

[0096] S202. Determine the number of command lines that the encapsulated interface needs to call, obtain the permission flags corresponding to the command lines, and encapsulate the permission flags to obtain the permission configuration information of the encapsulated interface.

[0097] In this embodiment, different command lines can be predefined with corresponding permission tags. When determining the permission configuration information of the encapsulated interface, the permission tags corresponding to all the command lines it needs to call can be encapsulated, thus obtaining the permission configuration information of the encapsulated interface. That is, the permission configuration information includes the permission tags of all command lines that the interface needs to call.

[0098] S203. Parse the permission matching rules of the custom interface to obtain the permission configuration information of the custom interface.

[0099] For custom interfaces, there is no need to call the command line. Custom interfaces can predefine their corresponding permission matching rules, and permission configuration information can be obtained by parsing the permission matching rules.

[0100] S204. Store the permission configuration information corresponding to the encapsulated interface and the custom interface in the permission configuration information database.

[0101] After obtaining the permission configuration information of the interface, it can be saved in the permission configuration information database in such a way that one permission configuration information corresponds to one interface.

[0102] S205. Receive the permission configuration request sent by the client and query the permission configuration information of the corresponding interface from the permission configuration information database.

[0103] Once a permission configuration request is received from the client, the permission configuration information for the corresponding interface can be retrieved from the permission configuration information data. For details on how to query the database, please refer to relevant database implementation schemes; these will not be elaborated upon here.

[0104] Among them, the client can execute Figure 1 After following the relevant steps shown, send a request to obtain permission configuration.

[0105] S206. Feed back the obtained permission configuration information to the client so that the client can control the permissions of the requested operation based on the permission configuration information.

[0106] After retrieving the permission configuration information, it can be sent back to the client. Once the client receives the permission configuration information, it can then execute actions such as... Figure 1 The permission control operations in the method steps shown.

[0107] In one specific embodiment of the present invention, the method further includes: receiving an interface access request; querying the permission configuration information of the corresponding interface from the permission configuration information database; verifying the permission of the interface access request using the permission configuration information; if the verification passes, allowing access to the corresponding interface; if the verification fails, prohibiting access to the corresponding interface.

[0108] In other words, when a request is intercepted by a third party and simulates front-end page operations to directly send a request to the web system's server in an attempt to damage the system, the front-end page's permission restrictions can be bypassed, resulting in poor security. To address this issue, the server-side of the storage system in this invention can verify interface access requests, allowing access to the corresponding interface only if the verification is successful. This avoids security attacks and improves security.

[0109] In one specific embodiment of this invention, when the permission configuration of a certain function entry point or data interface changes, the corresponding permission configuration information in the permission configuration information database on the server can be updated; when a new function entry point or data entry point is added, the corresponding permission configuration information is added to the permission configuration information database. In other words, because the permission configuration information is centrally managed, when permissions change, only the permission configuration information in the permission configuration database needs to be adjusted to achieve permission control based on the new permission configuration, without needing to modify the code of the function entry point or data interface itself. This reduces development workload and avoids overlooking relevant permission controls.

[0110] Please refer to Figure 4 ,Will Figure 1 and Figure 3 The methods shown are mainly applied to Figure 2 In the system shown, the coordination process between the two is as follows.

[0111] The command-line permission definition includes: Classifying the system CLI according to storage resource objects and CLI operation types, and defining basic permission configuration information for each CLI operation based on its type. This information will be used to generate permission configurations for calling the server-side encapsulated APIs of the CLI.

[0112] Custom API permission definition: Define permission configurations for APIs that the server does not call via CLI.

[0113] Permission generation: When the server starts, it generates the permission configuration for each encapsulated API based on the basic permission configuration information of the system CLI; when a client has permission to obtain a request, it returns the permission configuration for that request based on the request content; and it provides the permission verification module with the corresponding permission configuration for the requested API.

[0114] Permission verification (server-side): Responsible for verifying the permissions of requests made directly to the server API. Based on the request information, it retrieves the required permission configuration from the permission generation module and verifies whether the current request meets the permission requirements, thereby improving system security.

[0115] Permission Request: Responsible for retrieving permission configuration information for API requests based on the API request information sent by the operation monitoring module. It first retrieves the corresponding permission configuration from the client-side permission cache module. If the corresponding permission configuration is not found in the cache, it then retrieves it from the permission control server. It prioritizes retrieval from the cache; after obtaining the request, it saves it to the permission cache module.

[0116] Operation monitoring: Monitor user operations on web pages, obtain API request information for the relevant function entry points on the corresponding pages, and pass it to the permission request module, especially returning the permission configuration of the relevant function entry points on the page.

[0117] Permission caching: This module is responsible for saving and retrieving permission configurations to improve the response speed of permission configuration retrieval requests and ensure that the permission verification (client) module performs permission control in a timely manner. It is also responsible for clearing permission configurations that have not been used for a long time. When the cache reaches a certain capacity, it can also clear related permission configuration information based on information usage to free up cache space.

[0118] Permission verification (client): Retrieves the permission configuration information of the current function entry point and verifies whether the current user has permission to operate this function. If not, the current operation location is disabled.

[0119] Therefore, the access control method provided by this invention eliminates the need to predefine permission configurations for each function entry point on the front end, avoiding tedious design and development work and improving development efficiency. When new functions need to be developed and delivered, only the CLI permissions or custom interface permissions required for that function need to be configured, without additional design and development work, demonstrating excellent flexibility and scalability. Simultaneously, this method can support permission verification for both client operations and server APIs, minimizing the possibility of unauthorized operations and enhancing system security.

[0120] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0121] Embodiments of the present invention also provide an access control client, which can be used with... Figure 1 The access control methods shown are mutually referential.

[0122] Please refer to Figure 5 The client includes:

[0123] The present invention also provides an access control client, comprising:

[0124] The page monitoring module 101 is used to monitor page operations and obtain the function entry points and function request methods involved in the requested page.

[0125] The cache lookup module 102 is used to retrieve the permission configuration information of the interface corresponding to the function entry from the local cache;

[0126] The configuration request module 103 is used to send a request to the server to obtain configuration information based on the function request method if there is no permission configuration information for the corresponding interface in the local cache.

[0127] The permission control module 104 is used to determine the target function entry corresponding to the current page operation and to control the access of the target function entry using the obtained permission configuration information. If the corresponding interface is a packaged interface, the permission configuration information consists of several packaged permission tags, and the several permission tags correspond to several command lines that the corresponding interface needs to call. If the corresponding interface is a custom interface, the permission configuration information matches the custom permission matching rules.

[0128] In one specific implementation of this invention, the access control module is specifically used to obtain the user access information of the current operation; determine whether the user access information matches the access configuration information; if so, allow entry into the target function entry; if not, prohibit entry into the target function entry.

[0129] In one specific implementation of the present invention, it further includes: a cache management module, used to determine the comprehensive value corresponding to each cached permission configuration information when the local cache reaches a preset capacity threshold; and to delete the permission configuration information of the corresponding interface using the comprehensive value to release cache space.

[0130] In one specific implementation of this invention, the cache management module is specifically used to obtain the last usage time and usage count corresponding to each cached interface permission configuration; and to calculate the time decay value matching the last usage time using a time decay formula; wherein, the time decay formula is: Where RS is the time decay value, The difference between the current time and the last usage time; using the usage frequency formula, calculate the usage frequency value that matches the number of uses; where, the usage frequency formula is: FS represents the frequency of use. For the number of times it is used, The preset constant is used as the basis for calculating the weighted sum of the time decay value and the usage frequency value according to the preset weighting coefficients, so as to obtain the comprehensive value.

[0131] In one specific implementation of this invention, the cache management module is also used to periodically correct the number of uses based on a preset decay factor.

[0132] In one specific implementation of this invention, the access control module is specifically used to control access to the target function entry using the acquired access configuration information; record the usage time corresponding to the access configuration information, and update the last usage time of the access configuration information using the usage time; and increment the usage count corresponding to the access configuration information by one.

[0133] In one specific implementation of the present invention, a cache update module is further included, which is used to store the newly obtained permission configuration information in the local cache after sending a request to the server to obtain configuration information based on the function request method to obtain the permission configuration information of the corresponding interface.

[0134] Embodiments of the present invention also provide an access control server, which can be connected to... Figure 3 The access control methods shown are mutually referential.

[0135] Please refer to Figure 6 The server includes:

[0136] The interface classification module 201 is used to classify the interfaces with centralized permission management into encapsulated interfaces and custom interfaces according to the calling requirements.

[0137] The permission encapsulation module 202 is used to determine the number of command lines that the encapsulation interface needs to call, obtain the permission flags corresponding to the command lines, and encapsulate the permission flags to obtain the permission configuration information of the encapsulation interface.

[0138] The permission parsing module 203 is used to parse the permission matching rules of the custom interface and obtain the permission configuration information of the custom interface.

[0139] The permission storage module 204 is used to store the permission configuration information corresponding to the encapsulated interface and the custom interface in the permission configuration information database.

[0140] The permission query module 205 is used to receive the permission configuration request sent by the client and query the permission configuration information of the corresponding interface from the permission configuration information database.

[0141] The permission feedback module 206 is used to feed back the permission configuration information obtained from the query to the client, so that the client can control the permissions of the requested operation based on the permission configuration information.

[0142] In one specific embodiment of the present invention, the system further includes: an access control module, configured to receive an interface access request; query the permission configuration information of the corresponding interface from the permission configuration information database; verify the permission of the interface access request using the permission configuration information; if the verification passes, access to the corresponding interface is allowed; if the verification fails, access to the corresponding interface is prohibited.

[0143] Corresponding to the above method embodiments, this invention also provides an electronic device. The electronic device described below and the access control method described above can be referred to in correspondence.

[0144] See Figure 7 As shown, the electronic device includes:

[0145] Memory 332 is used to store computer programs;

[0146] The processor 322 is used to implement the steps of the permission control method in the above method embodiments when executing a computer program.

[0147] For details, please refer to Figure 8 , Figure 8 This is a schematic diagram of the specific structure of an electronic device provided in this embodiment. The electronic device can vary significantly due to differences in configuration or performance. It may include one or more central processing units (CPUs) (e.g., one or more processors) and a memory 332. The memory 332 stores one or more computer programs 342 or data 344. The memory 332 can be temporary or permanent storage. The program stored in the memory 332 may include one or more modules (not shown in the diagram), each module may include a series of instruction operations on the data processing device. Furthermore, the processor 322 may be configured to communicate with the memory 332 and execute the series of instruction operations stored in the memory 332 on the electronic device 301.

[0148] Electronic device 301 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341.

[0149] The steps in the access control method described above can be implemented by the structure of an electronic device. This electronic device can be a computer carrying the access control client, or a server carrying the access control server.

[0150] Corresponding to the above method embodiments, this invention also provides a readable storage medium. The readable storage medium described below corresponds to the access control method described above. This invention also provides a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the access control method embodiments described above when run.

[0151] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0152] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described permission control method embodiments.

[0153] Embodiments of the present invention also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described access control method embodiments.

[0154] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0155] This article uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only intended to help understand the method and core ideas of the present invention. It should be noted that those skilled in the art can make various improvements and modifications to the present invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the present invention.

Claims

1. A method for access control, characterized in that, include: Monitor page operations to obtain the function entry points and function request methods involved in the requested page; Retrieve the permission configuration information of the interface corresponding to the function entry point from the local cache; If the permission configuration information for the corresponding interface is not found in the local cache, a request to obtain configuration information is sent to the server based on the function request method to obtain the permission configuration information for the corresponding interface. Determine the target function entry corresponding to the current page operation, and use the obtained permission configuration information to control the access of the target function entry; wherein, if the corresponding interface is a packaged interface, the permission configuration information is a number of packaged permission tags, and the number of permission tags corresponds to a number of command lines to be called by the corresponding interface; if the corresponding interface is a custom interface, the permission configuration information matches the custom permission matching rules. When the local cache reaches a preset capacity threshold, determine the comprehensive values ​​corresponding to the cached permission configuration information respectively; Use the comprehensive numerical values ​​to delete the permission configuration information of the corresponding interface to free up cache space; Among them, the comprehensive values ​​corresponding to the cached permission configuration information are determined, including: Retrieve the last usage time and usage count for each cached interface permission configuration; Using the time decay formula, calculate the time decay value that matches the last used time; where the time decay formula is: Where RS is the time decay value, This is the difference between the current time and the last time it was used. Using the usage frequency formula, a specific usage frequency value matching the number of uses is calculated; wherein, the usage frequency formula is: FS represents the frequency of use. For the number of times it is used, This is a preset constant; The time decay value and the usage frequency value are weighted and summed according to a preset weighting coefficient to obtain the comprehensive value.

2. The method according to claim 1, characterized in that, Also includes: The number of uses is periodically adjusted based on a preset decay factor.

3. The method according to claim 1, characterized in that, Using the acquired permission configuration information to control access to the target function entry point, including: The obtained permission configuration information is used to control access to the target function entry point; Record the usage time corresponding to the permission configuration information, and update the last usage time of the permission configuration information using the usage time; Increment the usage count corresponding to this permission configuration information by one.

4. The method according to claim 1, characterized in that, After sending a request to the server to obtain configuration information based on the aforementioned function request method, and obtaining the permission configuration information for the corresponding interface, the method further includes: Store newly acquired permission configuration information in the local cache.

5. The method according to any one of claims 1 to 4, characterized in that, Using the acquired permission configuration information to control access to the target function entry point, including: Get the user permission information for the current operation; Determine whether the user permission information matches the permission configuration information; If so, then access to the target function entry point is permitted; If not, access to the target function entry point will be prohibited.

6. A method for access control, characterized in that, include: Based on the calling requirements, the interfaces for centralized permission management are divided into encapsulated interfaces and custom interfaces; Determine the number of command lines that the encapsulated interface needs to call, obtain the permission flags corresponding to the command lines, and encapsulate the permission flags to obtain the permission configuration information of the encapsulated interface; Parse the permission matching rules of the custom interface to obtain the permission configuration information of the custom interface; The permission configuration information corresponding to the encapsulated interface and the custom interface is stored in the permission configuration information database. Receive a permission configuration request sent by the client, and query the permission configuration information of the corresponding interface from the permission configuration information database; The obtained permission configuration information is fed back to the client so that the client can control the permissions of the request operation based on the permission configuration information; The client executes the steps of the access control method according to any one of claims 1 to 5.

7. The method according to claim 6, characterized in that, Also includes: Receive API access requests; Query the permission configuration information of the corresponding interface from the permission configuration information database; The permission configuration information is used to verify the permissions of the interface access request; If the verification passes, access to the corresponding interface is allowed; If verification fails, access to the corresponding interface will be prohibited.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for implementing the steps of the access control method as described in any one of claims 1 to 7 when executing the computer program.

Images