Authority control method and device, equipment and storage medium

Abstract

The invention provides an authority control method and device, equipment and a storage medium. The method comprises the following steps: determining a first application programming interface API corresponding to an access request according to request information carried by the access request; determining a target authentication policy corresponding to the first API from a plurality of authentication policies according to the first API and a pre-configured mapping relationship between APIs and authentication policies; according to the target authentication strategy and the subscription message of the first API, authentication information carried in the access request is authenticated, an authentication result is obtained, and the authentication result is used for indicating whether the access request has the permission to access the first API; and performing authority control on the access request according to the authentication result. Dynamic adjustment can be carried out according to different authority control requirements, the security and flexibility of the system are improved, and the complexity of authority management is simplified.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for access control. Background Technology

[0002] In current internet service architectures, access control and management are crucial for ensuring system security and stability. Access control and management refer to restricting and managing access to system resources, ensuring that only authorized users or services can access specific resources. This not only prevents unauthorized access and protects sensitive data but also prevents the abuse of system resources, ensuring stable system operation. In microservice architectures, due to the frequent and complex interactions between services, access control and management become even more critical and complex. In microservice architectures, Kong API Gateway is a popular Application Programming Interface (API) management tool. As a middleware layer, it sits between the client and backend services, handling API requests.

[0003] Existing access control technologies typically include role-based access control (RBAC) and attribute-based access control (APC). RBAC controls access by defining user roles and role permissions, while APC provides finer-grained access control based on user attributes, resource attributes, and environment attributes. These methods each have their advantages and disadvantages in different application scenarios, but currently there is no unified authentication template to manage different authentication strategies. This leads to inconsistencies and complexities in the implementation and management of different authentication strategies. In other words, different authentication strategies require different implementation logic and configuration files, requiring developers to spend significant time and effort understanding and implementing these strategies, which increases the complexity of system development and maintenance.

[0004] Due to inconsistencies in the implementation and management of current authentication strategies, existing access control technologies lack dynamic adaptability to authentication strategies across different APIs and cannot flexibly adjust to specific authentication requirements. This means that the system may appear cumbersome and inflexible when handling complex and ever-changing access control needs. For example, in a complex microservice architecture, different services may require different authentication strategies, but existing systems struggle to dynamically adjust and apply these strategies. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for access control, which addresses the problem that existing access control technologies lack a unified authentication template for managing different authentication strategies, resulting in inconsistencies and complexities in the implementation and management of different authentication strategies, and making it impossible to dynamically adjust them according to different access control requirements.

[0006] Firstly, this application provides an access control method, including:

[0007] Based on the request information carried in the access request, determine the first API corresponding to the access request;

[0008] Based on the first API and the pre-configured mapping relationship between APIs and authentication policies, the target authentication policy corresponding to the first API is determined from multiple authentication policies.

[0009] Based on the target authentication policy and the subscription message of the first API, the authentication information carried in the access request is authenticated, and the authentication result is obtained. The authentication result is used to indicate whether the access request has the permission to access the first API.

[0010] Based on the authentication result, access control is applied to the access request.

[0011] Optionally, in the method described above, the step of authenticating the authentication information carried in the access request based on the target authentication policy and the subscription message of the first API, and obtaining the authentication result, includes:

[0012] According to the target authentication strategy, the authentication information carried in the access request is authenticated to obtain the first sub-authentication result;

[0013] Based on the subscription message of the first API and the first user identifier carried in the access request, the access request is authenticated to obtain a second sub-authentication result. Both the first sub-authentication result and the second sub-authentication result belong to the authentication result.

[0014] Optionally, in the method described above, the step of authenticating the authentication information carried in the access request according to the target authentication policy and obtaining the first sub-authentication result includes:

[0015] Based on the target authentication strategy, a target authentication template corresponding to the target authentication strategy is determined, and the target authentication template includes initial code for implementing the target authentication strategy;

[0016] The authentication information carried in the access request is assigned to the corresponding position in the initial code to generate an authentication script;

[0017] Execute the authentication script to generate the first sub-authentication result.

[0018] Optionally, in the method described above, authenticating the access request based on the subscription message of the first API and the first user identifier carried in the access request, and obtaining the second sub-authentication result, includes:

[0019] Based on the subscription message of the first API, determine whether the first user identifier has subscribed to the first API;

[0020] If it is determined that the first user identifier has subscribed to the first API, a second sub-authentication result is generated indicating that the access request has the permission to access the first API;

[0021] If it is determined that the first user identifier has not subscribed to the first API, a second sub-authentication result is generated indicating that the access request does not have the permission to access the first API.

[0022] Optionally, in the method described above, the authentication strategy includes at least two of the following: JSON Web Token (JWT), Open Authorization (OAuth), and API Key.

[0023] Optionally, in the method described above, before determining whether the first user identifier has subscribed to the first API based on the subscription message of the first API, the method further includes:

[0024] Obtain a subscription request, the subscription request including a second user identifier and a second API;

[0025] Based on the subscription request, establish a subscription relationship between the second user identifier and the second API, and update the subscription information of the second API.

[0026] Optionally, in the method described above, the step of controlling the access request based on the authentication result includes:

[0027] If both the first sub-authentication result and the second sub-authentication result indicate that the access request has the permission to access the first API, then the access request is authorized.

[0028] Secondly, this application provides an access control device, comprising:

[0029] The first API acquisition module is used to determine the first API corresponding to the access request based on the request information carried in the access request.

[0030] The target authentication strategy confirmation module is used to determine the target authentication strategy corresponding to the first API from multiple authentication strategies based on the first API and the pre-configured mapping relationship between APIs and authentication strategies.

[0031] The authentication module is used to authenticate the authentication information carried in the access request according to the target authentication policy and the subscription message of the first API, and obtain the authentication result. The authentication result is used to indicate whether the access request has the permission to access the first API.

[0032] The access control module is used to control the access request based on the authentication result.

[0033] Thirdly, this application provides an electronic device, including a memory, a processor, and computer-executable instructions stored in the memory and executable on the processor, wherein the processor executes the computer-executable instructions to implement the access control method described in any one of the first aspects above.

[0034] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the access control method described in any one of the first aspects above.

[0035] Fifthly, this application provides a computer program product that, when run on a terminal device, causes the terminal device to execute the access control method described in any of the first aspects above.

[0036] The access control method, apparatus, device, and storage medium provided in this application determine a first API corresponding to an access request based on request information carried in the access request; determine a target authentication policy corresponding to the first API from multiple authentication policies based on the first API and a pre-configured mapping relationship between APIs and authentication policies; authenticate the authentication information carried in the access request based on the target authentication policy and the subscription message of the first API, and obtain an authentication result, which indicates whether the access request has permission to access the first API; and perform access control on the access request based on the authentication result. This allows for dynamic adjustment according to different access control requirements, improving system security and flexibility, and simplifying the complexity of access management. Attached Figure Description

[0037] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0038] Figure 1This is a schematic diagram illustrating an application scenario of the access control method provided in the embodiments of this application;

[0039] Figure 2 A flowchart illustrating the access control method provided in this application embodiment;

[0040] Figure 3 A schematic diagram of the access control device provided in the embodiments of this application;

[0041] Figure 4 This is a schematic diagram of the structure of an electronic device applicable to the access control method provided in the embodiments of this application.

[0042] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0043] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0044] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0045] In related technologies, there is no unified authentication template for managing authentication policies of various API gateways. This leads to inconsistencies and complexities in the implementation and management of different authentication policies. Administrators need to switch between multiple tools and platforms and manually synchronize and coordinate different permission policies. This not only increases the workload but also easily introduces human error, affecting the security and stability of the system. Furthermore, existing systems lack dynamic adaptability to authentication methods of different APIs and cannot be flexibly adjusted according to specific authentication requirements.

[0046] To address the aforementioned technical problems, this application aims to propose an access control method, apparatus, device, and storage medium. The core concept of the method is as follows: Based on the user-selected authentication method and the input authentication key, corresponding authentication templates are generated. These templates contain the required authentication information and format. Then, based on the target authentication policy and the subscription message of the first API, authentication is performed on the authentication information carried in the access request to obtain the authentication result. Based on the authentication result, access control is applied to the access request. This improves system security and flexibility while simplifying the complexity of access management.

[0047] To better understand the solutions of the embodiments of this application, an application scenario involved in the embodiments of this application will be introduced below.

[0048] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating an application scenario of the access control method provided in the embodiments of this application, such as... Figure 1 As shown, the system includes a client 100 and a server 200. The client 100 allows the user to select an authentication method and input an authentication key, and generates an access request by sending this information to the server 200. The server 200 can determine the first API corresponding to the received access request, then determine the target authentication policy corresponding to the first API from multiple authentication policies, authenticate the authentication information carried in the access request based on the target authentication policy and the subscription message of the first API, obtain the authentication result, and finally perform access control on the access request based on the authentication result.

[0049] The technical solution of this application and how it solves the above-mentioned technical problems will be described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0050] Figure 2 A flowchart illustrating the access control method provided in this application embodiment. For example... Figure 2 As shown, the method in this embodiment includes:

[0051] S201: Determine the first API corresponding to the access request based on the request information carried in the access request.

[0052] The execution entity in this application embodiment can be a server or a permission control system within the server, wherein the permission control system can be implemented through software.

[0053] Understandably, when a system receives an access request, it first needs to parse the request information to determine which API interface the request is targeting. Request information typically includes the HTTP method (such as GET or POST), the request URL, request headers, and the request body. For example, when the access control system receives an HTTP request with the URL "https: / / api.example.com / v1 / resource" and the HTTP method GET, parsing this request allows the extraction of the request path and method, thus determining that the request is a GET operation targeting the API interface " / v1 / resource". In this way, the API interface corresponding to the access request can be accurately identified.

[0054] S202: Based on the first API and the pre-configured mapping relationship between APIs and authentication policies, determine the target authentication policy corresponding to the first API from multiple authentication policies.

[0055] Understandably, the system will find the authentication policy corresponding to the API interface based on the pre-configured mapping relationship between APIs and authentication policies. The authentication policy defines how to control access to the API interface. For example, when the system determines that the access request corresponds to the API interface " / v1 / resource", it will look up the mapping table and find the corresponding authentication policy as OAuth2. In this way, the system can dynamically select the authentication policy applicable to the API interface.

[0056] S203: Based on the target authentication policy and the subscription message of the first API, authenticate the authentication information carried in the access request and obtain the authentication result. The authentication result is used to indicate whether the access request has the permission to access the first API.

[0057] In this step, the system verifies the authentication information carried in the access request based on the determined target authentication policy and the API subscription message to obtain the authentication result. The authentication information may include tokens, usernames, and passwords.

[0058] Assuming the target authentication policy is OAuth2, the system extracts the access token from the access request header and verifies its validity and permissions. The system also checks whether the user has subscribed to the API. For example, if the user includes an OAuth2 access token in the request header, the system calls the OAuth2 server to verify the token's validity and check if it has permission to access " / v1 / resource". If the token is valid and the user has subscribed to the API, the authentication is successful; otherwise, the authentication fails.

[0059] S204: Based on the authentication result, perform access control on the access request.

[0060] As is understandable, the authentication result indicates whether an access request is authorized to access the specified API interface. The authentication result can be a Boolean value (pass or fail) or more detailed status information. The system determines how to handle the access request based on the authentication result. If the authentication result is successful, the system forwards the request to the backend service for processing and returns the processing result to the client. If the authentication result is unsuccessful, the system generates an error response and returns it to the client.

[0061] The access control method provided in this embodiment determines the first application programming interface (API) corresponding to the access request based on the request information carried in the access request; determines the target authentication policy corresponding to the first API from multiple authentication policies based on the first API and a pre-configured mapping relationship between APIs and authentication policies; authenticates the authentication information carried in the access request based on the target authentication policy and the subscription message of the first API, and obtains an authentication result, which indicates whether the access request has permission to access the first API; and controls the access request based on the authentication result. This method can dynamically select and apply appropriate authentication policies to effectively control access requests, ensuring the security and flexibility of the system.

[0062] The technical solution of the above-mentioned access control method will be described in detail below.

[0063] In one possible implementation, the access control method provided in this embodiment authenticates the authentication information carried in the access request according to the target authentication policy and the subscription message of the first API respectively, and obtains the authentication result.

[0064] Specifically, according to the target authentication policy and the subscription message of the first API, the authentication information carried in the access request is authenticated to obtain an authentication result, including: authenticating the authentication information carried in the access request according to the target authentication policy to obtain a first sub-authentication result; authenticating the access request according to the subscription message of the first API and the first user identifier carried in the access request to obtain a second sub-authentication result, wherein both the first sub-authentication result and the second sub-authentication result belong to the authentication result.

[0065] Specifically, the step of authenticating the authentication information carried in the access request according to the target authentication strategy and obtaining a first sub-authentication result includes: determining a target authentication template corresponding to the target authentication strategy, wherein the target authentication template includes initial code for implementing the target authentication strategy; assigning the authentication information carried in the access request to the corresponding position in the initial code to generate an authentication script; and executing the authentication script to generate a first sub-authentication result.

[0066] Specifically, the authentication of the access request based on the subscription message of the first API and the first user identifier carried in the access request, and the acquisition of a second sub-authentication result, includes: determining whether the first user identifier has subscribed to the first API based on the subscription message of the first API; if it is determined that the first user identifier has subscribed to the first API, then generating a second sub-authentication result indicating that the access request has the permission to access the first API; if it is determined that the first user identifier has not subscribed to the first API, then generating a second sub-authentication result indicating that the access request does not have the permission to access the first API.

[0067] Understandably, the access request may include the authentication strategy selected by the user and the corresponding authentication key, such as an OAuth2 access token, a JWT key, or a BasicAuth username and password. The system will perform preliminary validation on these inputs to ensure that the format and content meet expectations. The system has a series of built-in authentication templates, each corresponding to an authentication strategy, containing all the information and format requirements needed for authentication. Based on the target authentication strategy, the system will automatically match the corresponding template and populate it with the user's input data. For example, for OAuth2 authentication, the template may include an access token field; for BasicAuth, the template may include username and password fields. After the template is populated, Lua scripts can be generated.

[0068] Understandably, the generated Lua script can be encapsulated or transmitted through the Kong gateway's management interface. The Kong API gateway provides the " / kong-admin / consumers / " interface for managing consumer permission information. Through this interface, administrators can dynamically manage user and consumer permissions. The request contains the user's authentication information and configuration data. Upon receiving the request, the Kong gateway creates or updates the corresponding consumer configuration based on the request content. The consumer configuration includes the user's identity information and corresponding authentication method; the Kong gateway manages API access permissions based on these configurations.

[0069] Furthermore, upon receiving a request, the Kong gateway parses the request content and creates or updates the corresponding authentication policy for each API interface. For example, if a user selects OAuth2 authentication, the Kong gateway configures the OAuth2 plugin for the specified API interface and associates the user's access token with that interface. Thus, when a user requests that API interface, the Kong gateway verifies the user's access token, ensuring that only authorized users can access the interface. Different authentication methods can be configured for different API interfaces to meet varying security requirements.

[0070] In this embodiment, the user identifier carried in the access request can be determined based on the subscription message of the first API. If the user has subscribed to the API, a second sub-authentication result indicating that the access request has access rights is generated; if the user has not subscribed to the API, a second sub-authentication result indicating that the access request does not have access rights is generated.

[0071] In this embodiment, the authentication information carried in the access request is verified according to the target authentication policy to generate a first sub-authentication result; the access request is verified according to the subscription message of the first API and the user identifier to generate a second sub-authentication result. The first and second sub-authentication results jointly determine the final authentication result, indicating whether the access request has access rights. Based on the final authentication result, access control is performed on the access request to determine whether the request is allowed to continue. This ensures that the system can dynamically authenticate and control access requests according to various policies and rules, thereby improving the system's security and flexibility.

[0072] In one possible implementation, the authorization strategy provided in this embodiment includes at least two of the following: JSON network token, Open Authorization (OAuth), and API key.

[0073] As is understandable, JSON network tokens are an open standard based on JSON (RFC7519) used to securely transmit information between parties. Open Authorization (OAuth) is an open standard authorization protocol that allows third-party applications to access user resources on another service with user authorization, without exposing the user's credentials. API keys are a simple authentication mechanism that verifies the legitimacy of a request by including a unique key in the request. Authentication strategies, including JWT, OAuth, and API keys, are primarily designed to meet different application scenarios and security requirements. Each authentication strategy has its unique advantages and applicable scenarios; by combining these strategies, a system can achieve flexible, efficient, and secure access control.

[0074] In one possible implementation, the access control method provided in this embodiment further includes, before determining whether the first user identifier has subscribed to the first API based on the subscription message of the first API: obtaining a subscription request, the subscription request including a second user identifier and a second API; establishing a subscription relationship between the second user identifier and the second API based on the subscription request, and updating the subscription information of the second API.

[0075] In this embodiment, subscribers can subscribe by calling the `subscribe()` method of the `KongRemote` class. The system can manage the subscription relationship between users and API interfaces through the `subscription` class. By extending the `subscribe` method, the system can record which API interfaces a user has subscribed to. Whenever a user subscribes to a new API interface, the system records the subscription relationship in its internal database, including information such as the user ID, API interface ID, and subscription time. These subscription relationships can be used for subsequent permission control and access management.

[0076] In other words, the system calls the Kong gateway's " / kong-admin / consumers / " interface via an HTTP request, transmitting the user's subscription information and permission configuration. The Kong gateway then updates the user's access permissions based on this information. Specifically, the Kong gateway configures access control policies for users, ensuring that they can only access API interfaces they have subscribed to. For unsubscribed API interfaces, the Kong gateway denies the user's access request and returns an appropriate error message. This mechanism effectively controls user access permissions and prevents unauthorized access.

[0077] By combining the " / kong-admin / consumers / " interface of the Kong API gateway with the KongRemote class, the system implements dynamic permission management for users and consumers. Administrators can flexibly configure permission information, and the KongRemote class dynamically applies authentication policies and subscription rules based on these configurations, ensuring system security and flexibility. This not only improves system management efficiency but also ensures that users and consumers can only access authorized APIs and services.

[0078] In one possible implementation, the access control method provided in this embodiment controls the access request based on the authentication result, including: if both the first sub-authentication result and the second sub-authentication result indicate that the access request has the access permission to the first API, then the access request is authorized.

[0079] The final authentication result is determined jointly by the first and second sub-authentication results. Only when both sub-authentication results pass will the access request have permission. The system implements multi-level authentication for access requests, including dual verification of the target authentication policy and the subscribed message.

[0080] "Capability integration" likely refers to combining different authentication methods and subscription mechanisms to achieve access control and management for interfaces and users. This integration can improve system security and flexibility, enabling it to adapt to different business needs and scenarios. Through this integration, the system can more effectively manage user permissions, ensuring that only authorized users can access specific functions or data.

[0081] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0082] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0083] Figure 3 This is a schematic diagram of the access control device provided in an embodiment of this application. Figure 3 As shown, the access control device includes:

[0084] The first API acquisition module 31 is used to determine the first API corresponding to the access request based on the request information carried in the access request.

[0085] The target authentication strategy confirmation module 32 is used to determine the target authentication strategy corresponding to the first API from multiple authentication strategies based on the first API and the pre-configured mapping relationship between API and authentication strategy.

[0086] The authentication module 33 is used to authenticate the authentication information carried in the access request according to the target authentication strategy and the subscription message of the first API, and obtain the authentication result. The authentication result is used to indicate whether the access request has the permission to access the first API.

[0087] The access control module 34 is used to control the access request based on the authentication result.

[0088] In one possible design, the authentication module 33 is specifically used for:

[0089] According to the target authentication strategy, the authentication information carried in the access request is authenticated to obtain the first sub-authentication result;

[0090] Based on the subscription message of the first API and the first user identifier carried in the access request, the access request is authenticated to obtain a second sub-authentication result. Both the first sub-authentication result and the second sub-authentication result belong to the authentication result.

[0091] In one possible design, the authentication module 33 is specifically used for:

[0092] Based on the target authentication strategy, a target authentication template corresponding to the target authentication strategy is determined, and the target authentication template includes initial code for implementing the target authentication strategy;

[0093] The authentication information carried in the access request is assigned to the corresponding position in the initial code to generate an authentication script;

[0094] Execute the authentication script to generate the first sub-authentication result.

[0095] In one possible design, the authentication module 33 is specifically used for:

[0096] Based on the subscription message of the first API, determine whether the first user identifier has subscribed to the first API;

[0097] If it is determined that the first user identifier has subscribed to the first API, a second sub-authentication result is generated indicating that the access request has the permission to access the first API;

[0098] If it is determined that the first user identifier has not subscribed to the first API, a second sub-authentication result is generated indicating that the access request does not have the permission to access the first API.

[0099] In one possible design, the authentication strategy includes at least two of the following: JSON Web Token (JWT), Open Authorization (OAuth), and API Key.

[0100] In one possible design, the access control module 34 is specifically used for:

[0101] Obtain a subscription request, the subscription request including a second user identifier and a second API;

[0102] Based on the subscription request, establish a subscription relationship between the second user identifier and the second API, and update the subscription information of the second API.

[0103] In one possible design, the access control module 34 is specifically used for:

[0104] If both the first sub-authentication result and the second sub-authentication result indicate that the access request has the permission to access the first API, then the access request is authorized.

[0105] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0106] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0107] Figure 4 This is a schematic diagram of the structure of an electronic device applicable to the access control method provided in an embodiment of this application. For example... Figure 4 As shown, the electronic device of this embodiment includes: at least one processor 40 ( Figure 4 (Only one is shown in the diagram) a processor, a memory 41, and a computer program stored in the memory 41 and executable on at least one processor 40, which, when executing the computer program, implements the steps in any of the above method embodiments.

[0108] The electronic device may include, but is not limited to, a processor 40 and a memory 41. Those skilled in the art will understand that... Figure 4 This is merely an example of an electronic device and does not constitute a limitation on electronic devices. It may include more or fewer components than shown in the illustration, or combinations of certain components, or different components. For example, it may also include input / output devices, network access devices, etc.

[0109] The processor 40 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0110] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0111] In some embodiments, memory 41 may be an internal storage unit of an electronic device, such as the memory of the electronic device. In other embodiments, memory 41 may be an external storage device of the electronic device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc. Furthermore, memory 41 may include both internal and external storage units of the electronic device. Memory 41 is used to store operating systems, applications, bootloaders, data, and other programs, such as program code for computer programs. Memory 41 can also be used to temporarily store data that has been output or will be output.

[0112] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps described in the various method embodiments above.

[0113] The aforementioned computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0114] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an application-specific integrated circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the aforementioned electronic device.

[0115] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0116] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0117] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0118] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for access control, characterized in that, include: Based on the request information carried in the access request, determine the first application programming interface (API) corresponding to the access request; Based on the first API and the pre-configured mapping relationship between APIs and authentication policies, the target authentication policy corresponding to the first API is determined from multiple authentication policies. Based on the target authentication policy and the subscription message of the first API, the authentication information carried in the access request is authenticated, and the authentication result is obtained. The authentication result is used to indicate whether the access request has the permission to access the first API. Based on the authentication result, access control is applied to the access request.

2. The method according to claim 1, characterized in that, The step of authenticating the authentication information carried in the access request based on the target authentication policy and the subscription message of the first API, and obtaining the authentication result, includes: According to the target authentication strategy, the authentication information carried in the access request is authenticated to obtain the first sub-authentication result; Based on the subscription message of the first API and the first user identifier carried in the access request, the access request is authenticated to obtain a second sub-authentication result. Both the first sub-authentication result and the second sub-authentication result belong to the authentication result.

3. The method according to claim 2, characterized in that, The step of authenticating the authentication information carried in the access request according to the target authentication policy and obtaining the first sub-authentication result includes: Based on the target authentication strategy, a target authentication template corresponding to the target authentication strategy is determined, and the target authentication template includes initial code for implementing the target authentication strategy; The authentication information carried in the access request is assigned to the corresponding position in the initial code to generate an authentication script; Execute the authentication script to generate the first sub-authentication result.

4. The method according to claim 2, characterized in that, The step of authenticating the access request based on the subscription message of the first API and the first user identifier carried in the access request, and obtaining the second sub-authentication result, includes: Based on the subscription message of the first API, determine whether the first user identifier has subscribed to the first API; If it is determined that the first user identifier has subscribed to the first API, a second sub-authentication result is generated indicating that the access request has the permission to access the first API; If it is determined that the first user identifier has not subscribed to the first API, a second sub-authentication result is generated indicating that the access request does not have the permission to access the first API.

5. The method according to claim 1 or 2, characterized in that, The authentication strategy includes at least two of the following: JSON Web Token (JWT), Open Authorization (OAuth), and API Key.

6. The method according to claim 4, characterized in that, Before determining whether the first user identifier has subscribed to the first API based on the subscription message of the first API, the method further includes: Obtain a subscription request, the subscription request including a second user identifier and a second API; Based on the subscription request, establish a subscription relationship between the second user identifier and the second API, and update the subscription information of the second API.

7. The method according to claim 2, characterized in that, The step of controlling access requests based on the authentication result includes: If both the first sub-authentication result and the second sub-authentication result indicate that the access request has the permission to access the first API, then the access request is authorized.

8. An access control device, characterized in that, include: The first API acquisition module is used to determine the first application programming interface (API) corresponding to the access request based on the request information carried in the access request. The target authentication strategy confirmation module is used to determine the target authentication strategy corresponding to the first API from multiple authentication strategies based on the first API and the pre-configured mapping relationship between APIs and authentication strategies. The authentication module is used to authenticate the authentication information carried in the access request according to the target authentication policy and the subscription message of the first API, and obtain the authentication result. The authentication result is used to indicate whether the access request has the permission to access the first API. The access control module is used to control the access request based on the authentication result.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 7.

Images