Interface authentication method, device and equipment

Abstract

Embodiments of the present application provide an interface authentication method and device, equipment and a storage medium, comprising: in the case of intercepting an access request from an interface, reading the method annotation of the interface; extracting the authentication rule of the access request in the method annotation, and reconstructing the authentication expression in the authentication rule into a binary tree structure; executing the authentication rule according to the binary tree structure, and checking whether the access request has access permission. Based on the annotation-based authentication mechanism, non-intrusive permission control is realized, and the business logic and the permission verification logic are decoupled; based on the authentication rule optimization of the binary tree structure, the permission verification efficiency is significantly improved through the logical short circuit and the early termination mechanism.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of digital information transmission, and in particular to an interface authentication method, device and equipment. BACKGROUND

[0002] When an interface receives an external access request, it often needs to authenticate the access request it receives, and provide corresponding resources for it when the access request has the right.

[0003] In related interface authentication methods, due to the non-uniformity of the parameter formats transmitted by different interfaces, the traditional direct parameter authentication method is difficult to unify the authentication logic, leading to difficulty in maintenance; if a specific authentication parameter method is used, the original interface parameter format will be changed, which is invasive to the original code and has the problem of parameter redundancy, and there is also the problem of parameter forgery.

[0004] Traditional monolithic services can only implement access authentication for functions, and cannot implement multi-dimensional authentication by project and function. Especially when a user has access rights to multiple projects, the existing authentication method needs to face the problems of complex parameter judgment, resource and project matching logic, and multi-parameter composite verification. At the same time, since the current method often needs to introduce specific authentication code, it is necessary to reconstruct the authentication method for complex authentication logic, thereby causing strong invasiveness to the original code. SUMMARY

[0005] Embodiments of the present application provide an interface authentication method, device and equipment, which solves the problem in related art that when complex authentication logic is authenticated, the authentication code of the interface needs to be reconstructed, thereby causing strong invasiveness to the code. Based on the authentication mechanism of annotations, non-invasive permission control is achieved, and the business logic and permission verification logic are decoupled; based on the authentication rule optimization of the binary tree structure, the permission verification efficiency is significantly improved through the logical short circuit and early termination mechanism.

[0006] In a first aspect, embodiments of the present application provide an interface authentication method, comprising:

[0007] In the case of intercepting an access request from an interface, reading the method annotation of the interface;

[0008] Extracting the authentication rule of the access request in the method annotation, and reconstructing the authentication expression in the authentication rule into a binary tree structure;

[0009] Executing the authentication rule according to the binary tree structure, and verifying whether the access request has access rights.

[0010] Optionally, the authentication expression includes at least one permission item;

[0011] reconstructing the authentication expression in the authentication rule into a binary tree structure comprises:

[0012] taking each of the permission items as a condition check node and taking the logical relationship between the permission items as the authentication logic of the corresponding logical processing node;

[0013] constructing the binary tree structure based on the authentication logic of each of the condition check nodes and each of the logical processing nodes.

[0014] Optionally, according to the authentication rule, a to-be-detected parameter is determined, a plurality of authentication items in the to-be-detected parameter are extracted, and validity verification is performed on each of the authentication items to determine valid authentication items; in a case where each of the valid authentication items satisfies the authentication logic of the corresponding logical processing node of the binary tree structure, it is determined that the access request has access permission.

[0015] Optionally, the validity verification is performed on each of the authentication items to determine valid verification parameters, which comprises:

[0016] reading the authentication item annotation corresponding to each of the authentication items, judging the validity of each of the authentication items based on the corresponding condition identifier in the authentication item annotation, and determining the valid authentication items as valid authentication items.

[0017] Optionally, the validity of each of the authentication items is judged based on the corresponding target authentication value in the authentication item annotation, which comprises:

[0018] identifying the effective group identifier in the authentication item annotation, and determining the target authentication item from the plurality of authentication items according to the effective group identifier;

[0019] verifying the authentication value of the target authentication item based on the authentication item annotation to obtain an authentication value verification result, and determining that the corresponding target authentication item is valid in a case where the authentication value verification result is valid.

[0020] Optionally, the authentication value of the target authentication item is verified based on the authentication item annotation to obtain an authentication value verification result, which comprises:

[0021] obtaining all valid authentication items based on the authentication item annotation, extracting the authentication value corresponding to each of the valid authentication items and the value of the value strategy identifier in the authentication item annotation to construct an authentication value strategy object, obtaining an authentication value strategy list, traversing the authentication value strategy list, and obtaining the user permission set corresponding to each of the valid authentication items according to the authentication value strategy object;

[0022] verifying the corresponding user permission set obtained from each of the valid authentication items to obtain a user access authentication result.

[0023] Optionally, the acquiring, according to the authentication value policy object, of a user permission set corresponding to each of the valid authentication items comprises:

[0024] The first preset implementation class object is executed to filter a user permission extractor corresponding to the value policy of the authentication value from a plurality of user permission extractors in a user permission extractor manager;

[0025] The second preset implementation class object is called to execute the corresponding user permission extractor to acquire the user permission set, and determine the user permission set corresponding to one or more operation targets of the authentication value in exchange for an access request operation;

[0026] Correspondingly, the obtaining of a user access authentication result by verifying the corresponding user permission set acquired by each of the valid authentication items comprises:

[0027] In a case where the user permission set of all operation targets meets the permission requirement of the access request, it is determined that the authentication value verification result is valid;

[0028] In a case where the user permission set of any one operation target does not meet the permission requirement of the access request, it is determined that the authentication value verification result is invalid.

[0029] In a second aspect, an embodiment of the present application further provides an interface authentication device, which comprises an annotation reading module, an authentication rule extraction module, a binary tree reconstruction module and a binary tree verification module.

[0030] The annotation reading module is configured to read a method annotation of an interface in a case where an access request is intercepted from the interface;

[0031] The authentication rule extraction module is configured to extract an authentication rule of the access request from the method annotation;

[0032] The binary tree reconstruction module is configured to reconstruct an authentication expression in the authentication rule into a binary tree structure;

[0033] The binary tree verification module is configured to execute the authentication rule according to the binary tree structure to verify whether the access request has access permission.

[0034] In a third aspect, an embodiment of the present application further provides an interface authentication device, which comprises:

[0035] One or more processors;

[0036] A storage device configured to store one or more programs,

[0037] When the one or more programs are executed by the one or more processors, the one or more processors implement the interface authentication method provided by the embodiment of the present application.

[0038] In a fourth aspect, the embodiments of the present application further provide a nonvolatile storage medium storing computer executable instructions, which, when executed by a computer processor, are configured to perform the interface authentication method according to the embodiments of the present application.

[0039] In the case of intercepting an access request from an interface, the embodiments of the present application read the method annotation of the interface; extract the authentication rule for the access request in the method annotation, and reconstruct the authentication expression in the authentication rule into a binary tree structure; and perform the authentication rule according to the binary tree structure to check whether the access request has access authority. In the above scheme, the authentication mechanism based on the annotation realizes non-intrusive authority control and decouples the business logic and the authority verification logic; and the authentication rule optimization based on the binary tree structure significantly improves the authority verification efficiency through the logical short circuit and the early termination mechanism. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the present application or related art, the following will briefly introduce the drawings needed to be used in the embodiments or related art descriptions. Obviously, the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0041] Figure 1 is a flowchart of an interface authentication method provided by the embodiments of the present application;

[0042] Figure 2 is a schematic diagram of a binary tree structure provided by the embodiments of the present application;

[0043] Figure 3 is a schematic diagram of an authentication expression data structure provided by the embodiments of the present application;

[0044] Figure 4 is a flowchart of an access request checking method provided by the embodiments of the present application;

[0045] Figure 5 is a flowchart of an authentication value checking method provided by the embodiments of the present application;

[0046] Figure 6 is a schematic diagram of an interface authentication device provided by the embodiments of the present application;

[0047] Figure 7 is a schematic diagram of an interface authentication device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0048] In order to make the purposes, technical solutions and advantages of the present application clearer, the specific embodiments of the present application are further described in detail below with reference to the drawings. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only parts related to the present application are shown in the drawings, but not all. Before discussing the example embodiments in more detail, it should be mentioned that some example embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations (or steps) as sequential processes, many of the operations can be implemented in parallel, concurrently or simultaneously. In addition, the order of the operations can be rearranged. The processes can be terminated when the operations are completed, but can also have additional steps not included in the drawings. The processes can correspond to methods, functions, procedures, subroutines, etc.

[0049] The technical solutions in the embodiments of the present application will be described clearly below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, but not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art belong to the scope of protection of the present application.

[0050] The terms "first", "second", and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are usually a class, not limited to the number of objects, for example, the first object can be one or more. In addition, "and / or" in the specification and claims means at least one of the connected objects, and the character " / ", generally represents a "or" relationship between the associated objects before and after.

[0051] The interface authentication method, device, equipment and medium provided by the embodiments of the present application will be described in detail below with reference to the drawings and specific embodiments and their application scenarios.

[0052] The interface authentication method provided by the embodiments of the present application is used in the scene of security detection or interface access permission management of access request of interface. Based on the above application scenario, it can be understood that the execution subject of each step can be a computer device, which refers to any electronic device with data calculation, processing and storage capability, such as mobile phone, PC (Personal Computer), tablet computer and other terminal devices, or server and other devices, which are not limited by the embodiments of the present application.

[0053] Figure 1 is a flowchart of an interface authentication method provided by an embodiment of the present application, as shown in Figure 1 , comprising:

[0054] Step S101, in the case of intercepting an access request from an interface, reading the method annotation of the interface.

[0055] Wherein, the access request can refer to the instruction sent by an application program, a webpage, a device, etc. to an application program interface (API) of a server or other system through a specific technical way, aiming to obtain data, submit data or trigger a specific function. The method annotation refers to the metadata tag added on the method definition of the program interface, which is attached in front of the method declaration through a specific syntax, such as @annotation name in Java, and is used to pass information such as function description, parameter constraint, permission requirement to the compiler, framework or other tools without directly affecting the business logic implementation of the method.

[0056] In an embodiment, the access request when a user accesses different projects can be intercepted by AOP (Aspect-Oriented Programming), and the access request information to be verified can be obtained. The method corresponding to the interface can be determined by metadata analysis of the access request information, and the method annotation corresponding to the method can be read from the preset data.

[0057] Step S102, extracting the authentication rule of the access request in the method annotation, and reconstructing the authentication expression in the authentication rule into a binary tree structure.

[0058] Wherein, the authentication rule refers to a series of rules, strategies and logics in an information system for verifying the legitimacy of user identity and controlling the access permission range of the user. The authentication rule can be expressed in the form of an expression. The authentication expression can be a declarative syntax for accurately describing the permission range of the user, which defines the judgment logic of "whether the user has the right to perform a specific operation" by combining permission identifiers, logical operators and context variables, and can make the authentication rule more flexible and reusable, avoiding hard-coded complex permission judgment logic. The binary tree structure is a tree-shaped data structure, which is characterized by having at most two child nodes for each node, called left child node and right child node.

[0059] Figure 2is a binary tree structure diagram provided by an embodiment of the present application. If the method annotation is @RequiresPermission, the authentication rule declared in the method annotation "String[] rule()" is extracted as: same as value, and String[] value() declares an authentication expression, such as "(A and B) or C". That is, the authentication rule can be expressed by the authentication expression, and the authentication expression is reconstructed as a binary tree structure. In an embodiment, first, the authentication expression is parsed to determine the operands, operators, and delimiters. For example, the operands of the authentication expression "(A and B) or C" are A, B, and C, the operators are OR and AND, and the delimiters are spaces and English parentheses. Based on the operands and operators, the nodes of the binary tree structure and the relationship between the nodes are determined. Based on the nodes and the relationship between the nodes, the binary tree structure shown in Figure 2 is generated, where the OR node and the AND node are the middle nodes of the binary tree structure, and the A node, the B node, and the C node are the leaf nodes of the binary tree structure. Through the binary tree structure, it can be determined whether the permissions owned by the user all satisfy the conditions A and B or whether the condition C is satisfied. If the conditions A and B are both satisfied, it is determined that the user has the access permission of the interface, or if the condition C is satisfied, it is determined that the user has the access permission of the interface.

[0060] In an embodiment, if the authentication expression in the authentication rule of the access request cannot be extracted from the method annotation, it can be considered that the authentication expression is not filled in advance or is filled in as an empty string, a pure space string, or the like. At this time, a binary tree structure containing only an empty expression node can be generated to intercept all requests, and the authentication result that the user permission cannot pass the check can be directly returned. In the embodiment of the present application, by generating a binary tree structure containing only an empty expression node in the case where the authentication expression cannot be extracted, all requests are intercepted, and the problem that the function access is not safe due to the missing or incorrect filling of the authentication expression is avoided, and the accuracy of the permission verification is improved.

[0061] In step S103, the authentication rule is executed according to the binary tree structure, and it is verified whether the access request has the access permission.

[0062] Optionally, the authentication expression is extracted, and the authentication expression is parsed to determine the required minimum number of permission items, for example, (A and B) or C can allow one permission item at a minimum, A and (B or C) can allow two permission items at a minimum, A or (B and (C or D)) can allow one permission item at a minimum, and (A or B) and (C or D) can allow two permission items at a minimum. The number of permission items possessed by the user is compared with the number of leaf nodes of the binary tree. In the case where the number of permission items possessed by the user is greater than or equal to the required minimum number of permission items, the determination relationship between the operands is determined according to the two leaf nodes associated with each intermediate node in the binary tree structure, the determination relationship is matched with the association relationship between the permission items in the access request, and in the case where the determination relationship is consistent with the association relationship between the permission items, it is determined that the access request has access rights. If the number of permission items possessed by the user is less than the required minimum number of permission items, it can be considered that the to-be-verified data in the access request cannot satisfy the authentication rule, and in this case, the association relationship between the permission items does not need to be verified, and it can be directly determined that the access request does not have access rights.

[0063] In the case where the access request is intercepted from the interface, the method annotation of the interface is read, the authentication rule for the access request in the method annotation is extracted, and the authentication expression in the authentication rule is reconstructed into a binary tree structure. The authentication rule is executed according to the binary tree structure to verify whether the access request has access rights. Based on the annotation-based authentication mechanism, non-intrusive permission control is realized, the business logic is decoupled from the permission verification logic, the authentication rule based on the binary tree structure is optimized, and the permission verification efficiency is significantly improved through the logical short circuit and early termination mechanism.

[0064] In one embodiment, the authentication expression includes at least one permission item, and reconstructing the authentication expression in the authentication rule into a binary tree structure includes: taking each permission item as a condition verification node, and taking the logical relationship between the permission items as the authentication logic of the corresponding logical processing node; and constructing the binary tree structure based on the authentication logic of each condition verification node and each logical processing node.

[0065] The permission item refers to a string identifier with explicit semantics and uniqueness, which is used to describe a specific operation or resource access capability that can be independently authorized or checked, and is the smallest control unit of the system permission management system. The permission item can be the name of a specific type of function that needs to be permission controlled. The condition verification node refers to a technical processing unit that independently executes verification logic for a single permission item in a flow-based authentication mechanism. The authentication logic can refer to the determination relationship between the permission items, such as A and B.

[0066] Figure 3This is a schematic diagram of an authentication expression data structure provided in an embodiment of this application, such as... Figure 3 As shown, the binary tree nodes after parsing the authentication expression all implement the PermissionNode interface, which consists of ConditionNode, RuleModeNode, and EmptyRuleNode. ConditionNode checks whether a user has the required permission, while RuleModeNode checks whether the user's permissions meet the specified condition. PermissionNode has a predicate (Predicate... <string>) method, incoming parameter is a Predicate that is implemented <string>PermissionMode is an enumeration class of permission judgment mode, which has two types of permission judgment mode: AND and OR.

[0067] In one embodiment, each permission item is taken as a condition check node, the logical relationship between each permission item is taken as the authentication logic of the corresponding logical processing node, and each condition check node is determined as a leaf node (ConditionNode) of the binary tree structure. The authentication logic of the logical processing node determines the connection relationship between the intermediate nodes (RuleModeNode) in the binary tree structure, so as to construct the binary tree structure corresponding to the authentication expression according to the connection relationship between each leaf node (ConditionNode) and each intermediate node (RuleModeNode).

[0068] For example, if the condition check nodes are A, B, and C, respectively, the logical processing nodes associated with A, B, and C are determined, such as the AND node associated with A and B and the OR node associated with C, as shown in the following table. Figure 2 The authentication logic of A, B, and C is checked through the AND node and the OR node. Among them, it is judged whether the two condition check nodes associated with the AND node satisfy the check condition, that is, whether the user permission list satisfies the judgment rule of the permission item required by the A node and the B node. If yes, it is considered that the A node and the B node satisfy the authentication logic of the AND node. It is judged whether any of the logical processing nodes and the condition check nodes associated with the OR node satisfies the condition check, that is, the logical processing node corresponding to the A node and the B node satisfies the authentication logic or the user permission list satisfies the judgment rule of the permission item required by the C node. If yes, it is considered that the A node, the B node, and the C node satisfy the authentication logic of the OR node, and it is determined that the access request has access permission. It can be understood that when it is determined that the A node and the B node satisfy the authentication logic of the AND node, since the authentication logic corresponding to the OR node is that any of the two associated nodes satisfies the condition check, it is not necessary to further verify the permission of the C node. Therefore, at this time, it can be directly determined that the access request has access permission, and it is not necessary to judge whether the authentication item corresponding to the C node is a valid check parameter or an invalid check parameter.

[0069] When checking each check node, the right branch can be fused in the in-order traversal of the binary tree to improve the traversal efficiency. The logic is that when the node traversed is a logical processing node, if the judgment mode is AND and the left branch does not satisfy the check condition (i.e., the left branch is judged as False), the traversal of the right branch can be fused, and if the judgment mode is OR and the left branch satisfies the check condition (i.e., the left branch is judged as True), the traversal of the right branch can be fused.

[0070] The embodiments of the present application take each of the permission items as a condition check node, take the logical relationship between the permission items as the authentication logic of the corresponding logical processing node, construct a binary tree structure based on the authentication logic of each condition check node and each logical processing node, traverse each check node according to the in-order traversal mode of the binary tree structure, check the permission items associated with each condition check node and logical processing node respectively, can clearly and quickly understand the current check level while ensuring the accuracy of authentication, and can significantly improve the permission verification efficiency through the logical short circuit and early termination mechanism based on the authentication rule optimization of the binary tree structure.

[0071] Figure 4 is a flowchart of a verification method of an access request provided by the embodiments of the present application, as shown in Figure 4 , comprising:

[0072] Step S201, determining a to-be-detected parameter according to an authentication rule, extracting a plurality of authentication items in the to-be-detected parameter, and performing validity check on each authentication item to determine valid authentication items.

[0073] Step S202, determining that the access request has access permission in the case that each valid authentication item meets the authentication logic of the corresponding logical processing node of the binary tree structure.

[0074] The to-be-detected parameter refers to the parameter carried by the interface request intercepted by AOP and to be authenticated by the user permission, and the authentication item refers to the member variable or method with the authentication item annotation in the data object corresponding to the to-be-detected parameter after the to-be-detected parameter is parsed. In an embodiment, the annotation corresponding to the authentication item is subjected to conditional matching judgment, and the valid authentication item and the invalid authentication item are determined according to the matching result. For example, if the parameters carried by the interface request are "department name" and "department member", and "department name" and "department member" are both authentication items, if "department name" does not meet the condition declared in the authentication item annotation, it is determined that the authentication item is an invalid authentication item, if "department member" meets the condition declared in the authentication item annotation, it is determined that the authentication item is a valid authentication item, and in the case that each valid authentication item meets the authentication logic of the corresponding logical processing node of the binary tree structure, it is determined that the access request has access permission.

[0075] In an embodiment, the validity check on each authentication item to determine the valid authentication item comprises: reading the authentication item annotation corresponding to each authentication item, judging the validity of each authentication item based on the corresponding condition identifier in the authentication item annotation, and determining the valid authentication item as the valid authentication item.

[0076] Among them, the authentication item annotation can be an annotation used to specify that the corresponding parameter value should be used for permission verification in the method that needs to be authenticated currently, such as @AuthorizeData, @AuthorizeValue, and @AuthorizeObject. Among them, @AuthorizeData is used to determine that one or more parameters applied to authentication in the method that needs permission verification are target authentication parameters, @AuthorizeValue is used to determine that the target authentication parameter or the member variable or method in the parameter object is an authentication item, and @AuthorizeObject is used to determine that the member variable value in the target authentication parameter object or the return value object of the method needs to be further parsed. The authentication value can refer to the member variable value or the method return value corresponding to the authentication item, such as "Aa123456". In an embodiment, the authentication items are identified, the authentication item annotations corresponding to each authentication item are read, the authentication values corresponding to each authentication item are determined, and each authentication item and its corresponding authentication value are respectively subjected to conditional judgment verification according to the identification rules defined by the corresponding authentication item annotations. The authentication items that pass the verification are determined as valid authentication items.

[0077] The embodiments of the present application read the authentication item annotations corresponding to each authentication item, judge the validity of each authentication item based on the identification element values in the authentication item annotations, and determine the valid authentication items as a list of valid authentication items. Based on this scheme, the authentication items that need to be used for permission verification can be specified flexibly through the authentication item annotations, the element values defined by the authentication item annotations can be modified to flexibly control the effective conditions of each authentication item, and the original function code logic is not intrusive.

[0078] Optionally, judging the validity of each authentication item based on the authentication item annotations comprises: identifying an effective grouping identifier in the authentication item annotation, and determining a target authentication item in the plurality of authentication items according to the effective grouping identifier.

[0079] The authentication item effective group identifier indicates the authentication item that needs to be verified in the current authentication scenario. This identifier is located in `@AuthorizeData` and `@AuthorizeValue`. The required item identifier indicates whether the authentication item can be ignored in the current authentication scenario. This identifier is located in `@AuthorizeValue`. In one embodiment, the required value identifier in the authentication item annotation is identified, and the authentication value of the obtained authentication item is determined to be null (null, empty string, empty array, empty list) based on the required item identifier. The authentication item and authentication value are verified based on the authentication item annotation to see if they meet the conditions. If the verification result is valid, the corresponding authentication item is determined to be valid. For example, it is identified whether the `@AuthorizeData` annotation exists in the intercepted method parameters that need to be verified. If it exists, one or more method parameters annotated with `@AuthorizeData` are determined as the target authentication parameters that need to be verified in the current authentication scenario. The system retrieves authentication items annotated with `@AuthorizeValue` within the target authentication parameter object, and further parses items annotated with `@AuthorizeObject` to obtain the authentication items. Based on the effective group value specified by `@AuthorizeData`, it determines whether the effective group specified by the `@AuthorizeValue` annotation of the authentication item is consistent with it, or if no effective group is specified, it determines that the authentication item is valid in the current authentication group. Based on the necessary item identifier of the `@AuthorizeValue` annotation of the authentication item, it determines whether the authentication value is null, and then determines whether the authentication value is valid. If the authentication group is effective and the authentication value meets the condition of a null necessary item, then the authentication item is determined to be valid, that is, the authentication item is a valid authentication item.

[0080] This application embodiment determines the validity of an authentication item by judging the effective group identifier and the necessary item identifier in the authentication item annotation. When the authentication group is effective and the authentication value meets the null value judgment condition of the necessary item, an authentication item is determined to be valid, thereby controlling the effective scenario of the authentication item. In the above scheme, the validity of the authentication item can be determined by different identifiers in the authentication item annotation, avoiding the verification of authentication items that are irrelevant to the current authentication scenario. This allows the same data object to be reused in different authentication scenarios, and invalid authentication items can be eliminated, improving authentication efficiency while ensuring verification accuracy.

[0081] Figure 5 This is a flowchart illustrating a method for obtaining user permissions using multiple types of authentication values, as provided in an embodiment of this application. Figure 5 As shown, it includes:

[0082] Step S301, all valid authentication items are obtained based on the authentication item annotation, and the authentication value strategy object is constructed by extracting the authentication value corresponding to the valid authentication item and the value of the value strategy identifier in the authentication item annotation, obtaining the authentication value strategy list, traversing the authentication value strategy list, and obtaining the user permission set corresponding to each valid authentication item according to the authentication value strategy object.

[0083] Step S302, the user access authentication result is obtained by checking the corresponding user permission set obtained by each valid authentication item.

[0084] Among them, the authentication value strategy list refers to a set containing authentication value strategy objects corresponding to all valid authentication items, which is used to obtain the user permission set corresponding to each valid authentication item, which is the actual access parameter controlled by the permission. The authentication value strategy object refers to a data object containing the authentication value corresponding to the valid authentication item and the value strategy.

[0085] In one embodiment, all valid authentication items are obtained based on the authentication item annotation, and the authentication value strategy object is constructed by extracting the authentication value corresponding to the valid authentication item and the value strategy, and stored in the authentication value strategy list. Since each method that needs to be checked for permission may use multiple authentication item combinations for checking, the authentication value strategy list will contain multiple authentication value strategy objects. The user permission extractor supporting the corresponding value strategy is obtained by traversing the authentication value strategy list, the user permission set corresponding to the authentication value is obtained through the user permission extractor, and finally the list of user permission sets corresponding to each valid authentication item is obtained.

[0086] Based on the authentication item annotation, the authentication value strategy list is obtained, the authentication value strategy list includes multiple authentication value strategy objects, and according to the authentication value strategy object, the user permission extractor supporting the value strategy corresponding to the authentication value in the access request is selected from the user permission extractor authentication strategy list; the authentication value is checked and queried through the corresponding user permission extractor, and the user permission set obtained by the authentication value is obtained. In the above scheme, different value strategies can be taken for different authentication values to query and extract user permission sets, and the user permission extractor can be expanded according to the actual required value strategy by implementing the user permission extractor interface.

[0087] Optionally, the user permission set corresponding to each valid authentication item is obtained according to the authentication value policy object, including: executing a preset first implementation class object, screening a user permission extractor corresponding to the value policy of the authentication value from a plurality of user permission extractors in a user permission extraction manager, calling a preset second implementation class object to execute the corresponding user permission extractor to obtain the user permission set, and determining the user permission set of one or more operation targets corresponding to the access request operation in exchange for the authentication value; correspondingly, the user access authentication result is obtained by checking the corresponding user permission set obtained by each valid authentication item, including: in the case that the user permission set of all operation targets meets the permission requirement of the access request, determining that the authentication value check result is valid; in the case that the user permission set of any one operation target does not meet the permission requirement of the access request, determining that the authentication value check result is invalid.

[0088] For example, the implementation class object of the UserPermissionProvider interface is created and the list of UserPermissionProvider is obtained by automatic scanning, the list of UserPermissionProvider is obtained by the UserPermissionProviderDelegate (hereinafter referred to as delegate) delegation query, the specific UserPermissionProvider matching the authentication value strategy is called, the actual user permission set is obtained, if the actual user permission set meets the user permission required by the access request, the authentication value check result is valid, if the actual permission does not contain the user permission of the access request, the authentication value check result is invalid. The method of obtaining user permissions by authentication value can be: the delegate traverses the provider list and finds the provider supporting the authentication value strategy according to the support method of the provider, then calls the getPermissions method of the provider to pass in the user authentication information and the authentication value parameter, and obtains and returns the user permission set after specific verification processing. In one possible implementation, each authentication value strategy can extract a user permission set containing multiple targets operated simultaneously in the access request, in the case of containing multiple target operations in the access request, the user permission corresponding to each operation target needs to be checked one by one, and the permission check results of all operation targets are combined, in the case that the permission verification results of all operation targets are valid, it is determined that the authentication item passes the permission check, otherwise the access request is rejected. For example, the user User1 requests to invite the user User2 to the project with project numbers 1, 2, 3 and 4, the operation corresponding authentication item is the project number list PidList, the authentication value is [1, 2, 3, 4], and the value strategy is PidListStrategy; the provider corresponding to PidListStrategy is obtained by the delegate and the multiple project permission sets corresponding to the operation of User1 are obtained by using PidList, which can be a project number and corresponding operation permission set mapping Map; each project operation permission set is checked one by one to determine whether the authentication item is valid.

[0089] The method for obtaining corresponding user permissions based on authentication values and checking access requests based on user permissions provided by the embodiments of the present application can fully guarantee the accuracy of the check, and accordingly improve the security performance of the system.

[0090] Figure 6 is a structural schematic diagram of an interface authentication device provided by the embodiments of the present application, as Figure 6 As shown, it comprises: an annotation reading module, an authentication rule extraction module, a binary tree reconstruction module and a binary tree verification module.

[0091] The annotation reading module 41 is configured to read the method annotation of the interface in the case of intercepting the access request from the interface;

[0092] The authentication rule extraction module 42 is configured to extract the authentication rule of the method annotation on the access request;

[0093] The binary tree reconstruction module 43 is configured to reconstruct the authentication expression in the authentication rule into a binary tree structure;

[0094] The binary tree verification module 44 is configured to execute the authentication rule according to the binary tree structure to verify whether the access request has access authority.

[0095] In the case of intercepting the access request from the interface, the embodiment of the application reads the method annotation of the interface; extracts the authentication rule of the method annotation on the access request, and reconstructs the authentication expression in the authentication rule into a binary tree structure; executes the authentication rule according to the binary tree structure to verify whether the access request has access authority. In the above scheme, the annotation-based authentication mechanism realizes non-intrusive authority control and decouples the business logic and the authority verification logic; the authentication rule optimization based on the binary tree structure significantly improves the authority verification efficiency through the logical short circuit and the early termination mechanism.

[0096] In one possible embodiment, the authentication expression comprises at least one authentication item;

[0097] The binary tree reconstruction module 43 is specifically configured to take each authentication item as a condition verification node, and take the logical relationship between the authentication items as the authentication logic of the corresponding logical processing node;

[0098] The binary tree structure is constructed based on the authentication logic of each condition verification node and each logical processing node.

[0099] In one possible embodiment, the binary tree verification module 44 is specifically configured to:

[0100] Determine the to-be-detected parameter according to the authentication rule, extract a plurality of authentication items in the to-be-detected parameter, and perform validity verification on each authentication item to determine the valid authentication items;

[0101] In the case where each valid authentication item meets the authentication logic of the corresponding logical processing node of the binary tree structure, it is determined that the access request has access authority.

[0102] In one possible embodiment, the binary tree verification module 44 is specifically configured to:

[0103] read the authentication item annotation corresponding to each authentication item, judge the validity of each authentication item based on the corresponding condition identifier in the authentication item annotation, and determine the valid authentication item as the valid authentication item.

[0104] In one possible embodiment, the binary tree verification module 44 is specifically configured as:

[0105] identify the effective group identifier in the authentication item annotation, and determine the target authentication item in the plurality of authentication items according to the effective group identifier;

[0106] verify the authentication value of the target authentication item based on the authentication item annotation, obtain the authentication value verification result, and determine that the corresponding target authentication item is valid in the case that the authentication value verification result is valid.

[0107] In one possible embodiment, the binary tree verification module 44 is specifically configured as:

[0108] obtain all valid authentication items based on the authentication item annotation, extract the authentication value corresponding to each of the valid authentication items and the value of the value strategy identifier in the authentication item annotation to construct an authentication value strategy object, obtain an authentication value strategy list, traverse the authentication value strategy list, and obtain the user permission set corresponding to each of the valid authentication items according to the authentication value strategy object;

[0109] obtain the user access authentication result by verifying the corresponding user permission set obtained by each of the valid authentication items.

[0110] In one possible embodiment, the binary tree verification module 44 is specifically configured as:

[0111] execute the preset first implementation class object, filter the user permission extractor matched with the value strategy of the authentication value from the plurality of user permission extractors in the user permission extraction manager;

[0112] call the preset second implementation class object to execute the corresponding matched user permission extractor to obtain the user permission set, and determine the user permission set of one or more operation targets of the corresponding access request operation in exchange for the authentication value;

[0113] in the case that the user permission set of all operation targets meets the permission required by the access request, determine that the authentication value verification result is valid;

[0114] in the case that the user permission set of any one operation target does not meet the permission required by the access request, determine that the authentication value verification result is invalid.

[0115] The application embodiment also provides an electronic device, and the interface authentication device can integrate the interface authentication system provided by the application embodiment. Figure 7 is a structural schematic diagram of an interface authentication device provided by an embodiment of the present application, referring to Figure 7 The interface authentication device comprises an input device 53, an output device 54, a memory 52, and one or more processors 51; the memory 52 is used for storing one or more programs; when the one or more programs are executed by the one or more processors 51, the one or more processors 51 implement the interface authentication method provided by the above-mentioned embodiments. The input device 53, the output device 54, the memory 52, and the processor 51 can be connected through a bus or other means, Figure 7 for example, a bus connection is taken as an example in the connection.

[0116] The memory 52 is a kind of readable storage medium of a computing device, which can be used for storing software programs, computer executable programs, and modules, such as program instructions / modules of the interface authentication method provided by any embodiment of the present application. The memory 52 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required by a function; the data storage area can store data created according to the use of the device, etc. In addition, the memory 52 can include a high-speed random access memory, and can also include a non-volatile memory, for example, at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some examples, the memory 52 can further include a memory remotely arranged with respect to the processor 51, which can be connected to the device through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0117] The input device 53 can be used for receiving input digital or character information, and generating key signal input related to user settings and function control of the device. The output device 54 can include a display device such as a display screen.

[0118] The processor 51 executes various function applications and data processing of the device by running the software programs, instructions, and modules stored in the memory 52, that is, implements the above-mentioned interface authentication method.

[0119] The interface authentication device, device, and computer provided above can be used to execute the interface authentication method provided by any embodiment described above, and have corresponding functions and beneficial effects.

[0120] The embodiment of the present application further provides a storage medium storing computer executable instructions, which, when executed by a computer processor, are used to perform the interface authentication method provided by the above embodiment, and the interface authentication method comprises the following steps: in the case that an access request is intercepted from an interface, reading method annotations of the interface; extracting authentication rules of the access request in the method annotations, and reconstructing authentication expressions in the authentication rules into a binary tree structure; and performing the authentication rules according to the binary tree structure, and checking whether the access request has access authority.

[0121] Storage medium - any of various types of memory devices or storage devices. The term "storage medium" is intended to include an installation medium, e.g., a CD-ROM, floppy disks, or tape device; a computer system memory or random access memory such as DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, etc.; or a non-volatile memory such as a magnetic medium (e.g., a hard drive or optical storage); registers or other similar types of memory elements, etc. The memory medium can also include other types of storage medium and combinations thereof. In addition, the memory medium can reside in a first computer system's main memory, or in a second different computer system's memory, and the second computer system can provide the data to the first computer system over a network (e.g., the Internet) for execution by the first computer system. The term "memory medium" should be taken to include a single medium or multiple media that store the program instructions for execution by the processor of the first computer system. The memory medium can also store the received data or other type of information that is to be processed by the first computer system.

[0122] Of course, the storage medium provided by the embodiment of the present application contains computer executable instructions, which are not limited to the interface authentication method as described above, but can also perform the related operations in the interface authentication method provided by any embodiment of the present application.

[0123] The interface authentication system, device and storage medium provided in the above embodiment can perform the interface authentication method provided by any embodiment of the present application, and the technical details not described in detail in the above embodiment can be referred to the interface authentication method provided by any embodiment of the present application.

[0124] The above merely describes the preferred embodiments of the present application and the technical principles applied. The present application is not limited to the specific embodiments described herein, and various obvious changes, modifications and replacements made by those skilled in the art without departing from the scope of the present application shall not be excluded. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and more other equivalent embodiments can be included without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.< / string> < / string>

Claims

1. An interface authentication method, characterized in that, include: If an access request is intercepted from the interface, read the method annotations of the interface; Extract the authentication rules declared for the access request in the method annotation, take each permission item as a condition verification node, take the logical relationship between each permission item as the authentication logic of the corresponding logical processing node, construct a binary tree structure based on each condition verification node and each logical processing node, and the authentication expression includes at least one permission item. The parameters to be detected are determined according to the authentication rules, multiple authentication items are extracted from the parameters to be detected, and the validity of each authentication item is verified to determine the valid authentication item. If each valid authentication item satisfies the authentication logic of the corresponding logical processing node of the binary tree structure, the access request is determined to have access rights.

2. The interface authentication method according to claim 1, characterized in that, The validity of each authentication item is verified to determine the valid verification parameters, including: Read the authentication annotations corresponding to each authentication item, determine the validity of each authentication item based on the corresponding condition identifiers in the authentication annotations, and identify the valid authentication items as valid authentication items.

3. The interface authentication method according to claim 2, characterized in that, The determination of the validity of each authentication item based on the corresponding condition identifier in the authentication item annotation includes: Identify the effective group identifier in the authentication item annotation, and determine the target authentication item among multiple authentication items based on the effective group identifier; The authentication value of the target authentication item is verified based on the authentication item annotation to obtain the authentication value verification result. If the authentication value verification result is valid, the corresponding target authentication item is determined to be valid.

4. The interface authentication method according to claim 3, characterized in that, The step of verifying the authentication value of the target authentication item based on the authentication item annotation to obtain the authentication value verification result includes: Based on the authentication item annotation, obtain all valid authentication items, extract the authentication value corresponding to each valid authentication item and the value of the value strategy identifier in the authentication item annotation to construct an authentication value strategy object, obtain an authentication value strategy list, traverse the authentication value strategy list, and obtain the user permission set corresponding to each valid authentication item according to the authentication value strategy object. The user access authentication result is obtained by verifying the corresponding user permission set obtained from each of the valid authentication items.

5. The interface authentication method according to claim 4, characterized in that, The step of obtaining the set of user permissions corresponding to each valid authentication item based on the authentication value policy object includes: Execute the preset first implementation class object, and filter the user permission extractors that match the value policy corresponding to the authentication value from multiple user permission extractors in the user permission extraction manager; Call the preset second implementation class object to execute the corresponding matching user permission extractor to obtain the user permission set, and determine the user permission set of one or more operation targets of the corresponding access request operation by exchanging the authentication value; Accordingly, the step of verifying the corresponding user permission set obtained from each of the valid authentication items to obtain the user access authentication result includes: If the set of user permissions for all operation targets satisfies the permissions required by the access request, the authentication value verification result is determined to be valid. If the user permission set of any operation target does not meet the permissions required by the access request, the authentication value verification result is determined to be invalid.

6. An interface authentication device, characterized in that, include: The module includes an annotation reading module, an authentication rule extraction module, a binary tree reconstruction module, and a binary tree verification module. The annotation reading module is configured to read the method annotations of the interface when an access request is intercepted from the interface. The authentication rule extraction module is configured to extract the authentication rules declared by the method annotation for the access request; The binary tree reconstruction module is configured to use each permission item as a condition verification node, and the logical relationship between each permission item as the authentication logic of the corresponding logical processing node. Based on the authentication logic of each condition verification node and each logical processing node, a binary tree structure is constructed, and the authentication expression includes at least one permission item. The binary tree verification module is configured to determine the parameters to be detected according to the authentication rules, extract multiple authentication items from the parameters to be detected, and perform validity verification on each authentication item to determine a valid authentication item. If each valid authentication item satisfies the authentication logic of the corresponding logical processing node of the binary tree structure, the access request is determined to have access rights.

7. An interface authentication device, the device comprising: One or more processors; A storage device configured to store one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the interface authentication method according to any one of claims 1-5.

8. A non-volatile storage medium for storing computer-executable instructions, wherein the computer-executable instructions, when executed by a computer processor, are configured to perform the interface authentication method of any one of claims 1-5.

Images