Access permission control method and device, equipment, storage medium and computer program product
By dynamically generating access permissions and validating them before interface access, the lack of flexibility in existing access control schemes is resolved, achieving fine-grained access control, preventing unauthorized access, and improving system security and adaptability.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-10
- Publication Date
- 2026-04-07
AI Technical Summary
Existing access control schemes lack flexibility and are difficult to adapt to dynamic changes in business scenarios and temporary permission adjustments. This can lead to users accessing unauthorized menu interfaces without authorization, resulting in security risks such as data leakage, information tampering, or abuse of system functions.
By determining the role and behavior of users, access permissions are dynamically generated, and precise validation is performed before interface access to prevent unauthorized requests, thus achieving dynamic and real-time access control.
The increased flexibility of the access control module enables rapid response to organizational restructuring and changes in business rules, achieving fine-grained management, preventing data leaks and unauthorized operations, and enhancing system security.
Smart Images
Figure CN121808756A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of computer, in particular to an access permission control method and device, equipment, storage medium and computer program product. BACKGROUND
[0002] With the wide application of information technology in the field of health management, various health management business systems have appeared in various industries, such as health management general service center, health record system, health mall system, etc. With the development of business and the use of users, these health management business systems often save a large amount of sensitive user data and business operations.
[0003] In order to ensure user privacy and data security, these systems currently usually provide function access entry to users through menu interface, and ensure that users can only access menu interfaces within their permission range, so as to achieve the purpose of protecting system security and data privacy.
[0004] At present, the common permission control scheme usually adopts a role-based access control mechanism, that is, the corresponding relationship between the role and the menu interface is pre-configured statically, and the user obtains the corresponding menu access permission according to the role after logging in. Although this static mapping method realizes permission management to a certain extent, it has poor flexibility and is difficult to adapt to the dynamic changes of business scenarios and temporary permission adjustment requirements. In addition, once the permission configuration deviates or is omitted, it is easy to cause the user to access unauthorized menu interfaces beyond the scope of authorization, and thus may cause security risks such as data leakage, information tampering or system function abuse.
[0005] Therefore, how to realize dynamic, real-time and accurate control of menu interface access permission has become a technical problem to be solved in the field of information security of health management business system. SUMMARY
[0006] The embodiments of the present application provide an access permission control method to solve the problem that the user may access unauthorized menu interfaces beyond the scope of authorization due to the existing access permission control scheme, and thus may cause security risks such as data leakage, information tampering or system function abuse.
[0007] The embodiments of the present application also provide an access permission control device to solve the problem that the user may access unauthorized menu interfaces beyond the scope of authorization due to the existing access permission control scheme, and thus may cause security risks such as data leakage, information tampering or system function abuse.
[0008] The embodiments of the present application also provide an access permission control device to solve the problem that the user may access unauthorized menu interfaces beyond the scope of authorization due to the existing access permission control scheme, and thus may cause security risks such as data leakage, information tampering or system function abuse.
[0009] The embodiment of the present application also provides a computer readable storage medium to solve the problem that the existing access permission control scheme may cause user unauthorized access to an unauthorized menu interface, and further may cause security risks such as data leakage, information tampering or system function abuse.
[0010] The embodiment of the present application adopts the technical scheme as follows: An access permission control method comprises the following steps: determining an access user and a target access interface according to a received access request; determining a role behavior corresponding to the access user, and determining a dynamic access permission corresponding to the access user according to the role behavior, wherein the dynamic access permission corresponds to at least one menu interface; performing access permission verification on the access user according to the dynamic access permission and the target access interface; if the verification is successful, routing the access request to a server corresponding to the target access interface; and if the verification fails, preventing the access request and returning an access prohibition response.
[0011] An access permission control apparatus comprises: a request receiving unit configured to determine an access user and a target access interface according to a received access request; a permission determining unit configured to determine a role behavior corresponding to the access user, and determine a dynamic access permission corresponding to the access user according to the role behavior, wherein the dynamic access permission corresponds to at least one menu interface; a permission verifying unit configured to perform access permission verification on the access user according to the dynamic access permission and the target access interface; a routing unit configured to route the access request to a server corresponding to the target access interface when the permission verifying unit succeeds in the verification; and an intercepting unit configured to prevent the access request and return an access prohibition response when the permission verifying unit fails in the verification.
[0012] An access permission control device comprises: A processor; and a memory arranged to store computer executable instructions which, when executed, cause the processor to perform the following operations: determining an access user and a target access interface according to a received access request; determining a role behavior corresponding to the access user, and determining a dynamic access permission corresponding to the access user according to the role behavior, wherein the dynamic access permission corresponds to at least one menu interface; performing access permission verification on the access user according to the dynamic access permission and the target access interface; if the verification is successful, routing the access request to a server corresponding to the target access interface; and if the verification fails, preventing the access request and returning an access prohibition response.
[0013] A computer-readable storage medium stores one or more programs that, when executed by an electronic device including multiple applications, cause the electronic device to perform the following operations: determining an accessing user and a target access interface based on a received access request; determining a role behavior corresponding to the accessing user, and determining a dynamic access permission corresponding to the accessing user based on the role behavior, wherein the dynamic access permission corresponds to at least one menu interface; performing access permission verification on the accessing user based on the dynamic access permission and the target access interface; if the verification is successful, routing the access request to the server corresponding to the target access interface; if the verification fails, blocking the access request and returning an access denied response.
[0014] The above-described technical solutions adopted in the embodiments of this application can achieve the following beneficial effects: Using the access control method provided in this application embodiment, upon receiving an access request from a user for uploading a menu, the following steps are taken: First, the accessing user and the target access interface are determined based on the received access request; then, the role behavior corresponding to the accessing user is determined, and based on the role behavior, the dynamic access permission corresponding to the accessing user is determined, wherein the dynamic access permission corresponds to at least one menu interface; then, the access permission of the accessing user is verified based on the dynamic access permission and the target access interface; if the verification is successful, the access request is routed to the server corresponding to the target access interface; if the verification fails, the access request is blocked, and an access denied response is returned. The method provided in this application has two advantages. First, the permission control scheme can transform permission determination from static configuration to dynamic real-time calculation based on the current role behavior. Based on this, the system can dynamically generate user access permission sets according to real-time role behavior policies without modifying the underlying code or performing complex static configuration updates. This significantly enhances the flexibility of the permission management module, enabling the system to quickly respond to organizational restructuring, business rule changes, or temporary authorization needs, greatly improving the system's adaptability to complex and ever-changing business environments. Second, by refining the smallest unit of permission control to the "menu interface" level and combining the dynamically determined permission set with the specific "target access interface" for matching and verification, this application achieves fine-grained access control management. This overcomes the permission generalization problem that may exist in traditional coarse-grained role authorization. Furthermore, by completing this precise verification before request routing, any unauthorized requests attempting to access unauthorized interfaces can be effectively intercepted at the request entry point, fundamentally preventing security risks such as data leakage and unauthorized operations. Attached Figure Description
[0015] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a schematic diagram of the specific structure of an access control system provided in an embodiment of this application; Figure 2 A schematic diagram illustrating the specific flow of the access control method provided in this application embodiment; Figure 3 This is a schematic diagram of the specific structure of an access control device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the specific structure of an access control device provided in an embodiment of this application. Detailed Implementation
[0016] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0017] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.
[0018] This application provides an access control method to address the security risks that may arise from existing access control schemes, such as users accessing unauthorized menu interfaces without authorization, leading to data leakage, information tampering, or abuse of system functions.
[0019] The execution subject of the access control method provided in this application embodiment may be, but is not limited to, at least one of a security management server, a permission management server, and an access management server. In addition, the execution subject of the method may also be the system or application (APP) itself running on these servers.
[0020] For ease of description, the following description uses an access control system as the execution subject of this method as an example to introduce its implementation. It should be understood that using an access control system as the execution subject is merely an illustrative example and should not be construed as a limitation of the method.
[0021] In one embodiment, the specific system architecture of the access control system provided in this application is as follows: Figure 1 As shown, it mainly includes the following modules: 1. Client: Users can initiate access requests through a client, such as a browser or mobile app.
[0022] 2. API Gateway: As the unified entry point for the entire system, this embodiment can adopt a microservice API gateway built on Spring Cloud Zuul. A custom authentication filter is integrated within the gateway to intercept all requests and execute the access control method provided in this embodiment.
[0023] 3. Service Registration and Discovery Center: In this embodiment, the Consul solution can be used to implement the service registration and discovery function. The service registration and discovery center is used to register and manage all microservice instances. The gateway can query the real address of the target server through the service registration and discovery center.
[0024] 4. Access Control Service and Database: The access control service provides an access control data query interface; the access control database (such as GaussDB) stores user tables, role tables, behavior tables, menu interface tables, and association tables, such as user-role association tables, role-behavior association tables, and behavior-menu interface association tables. This data provides support for the subsequent implementation of dynamic access control mapping.
[0025] 5. Business microservice cluster: including health record service, health mall order service, etc., each service provides specific menu interface API.
[0026] Based on the aforementioned access control system, a schematic diagram illustrating the specific implementation process of the access control method provided in this application is shown below. Figure 2 As shown, the main steps include the following: Step 11: Based on the received access request, determine the accessing user and the target access interface; In one implementation, when a user initiates an HTTP access request through a client, the request first reaches the API gateway. The authentication filter in the API gateway intercepts the access request, parses it, and then determines the user and target access interface corresponding to the access request.
[0027] Specifically, in this embodiment of the application, the access control system can analyze access requests in the following manner, including: 1. Determine the access user corresponding to the access request: The access control system can extract the pre-issued access token from the request header of the access request. By decrypting and verifying the access token, the user's unique identity identifier (userId) can be parsed out, and then the access user corresponding to the access request can be determined based on the userId.
[0028] Furthermore, in this embodiment of the application, the access control system can also determine the access user corresponding to the access request in the session server by querying the attached session cookie.
[0029] 2. Determine the target access interface corresponding to this access request: Specifically, the access control system can extract the request path and request method from the access request, and determine the target access interface based on the extracted request path and request method.
[0030] For example, the access control system extracts the request path from the access request as " / api / order / queryDetail" and the request method as "GET". Then, based on "GET: / api / order / queryDetail", it can determine that the target access interface corresponding to the access request is the "query order details" interface.
[0031] Step 12: Determine the role behavior of the accessing user, and determine the dynamic access permissions of the accessing user based on the role behavior. In one implementation, the access control system can determine the role behavior corresponding to the accessing user by following the sub-steps: Sub-step 1201: Determine one or more roles corresponding to the accessing user based on the identity identifier corresponding to the accessing user; Specifically, the API gateway in the access control system can determine one or more role IDs of the accessing user by querying the preset user-role association table based on the userId obtained by executing step 11, using methods such as Remote Procedure Call (RPC) or direct querying of the permission database. These roles include "regular user" and "VIP user".
[0032] Sub-step 1202: Determine the set of actions authorized to the role by executing the actions determined in sub-step 1201, as the role actions; Specifically, the access control system can obtain the set of all authorized actionIds for these roles by querying a preset role-behavior association table based on the roleId obtained by executing sub-step 1201, and determine the actionId set as the set of role behaviors corresponding to the current accessing user.
[0033] In one implementation, the access control system can determine the specific dynamic access permissions corresponding to an accessing user by following the following sub-steps: Sub-step 12-1: Based on the role behavior determined by executing the above sub-step 1201, determine the set of menu interfaces associated with the role behavior by querying the preset dynamic permission mapping table; The dynamic permission mapping table stores the association between role behavior and menu interface; In this embodiment of the application, the API gateway in the access control system can obtain the set of all menu interfaces (APIs) that the current user is allowed to access by querying the dynamic permission mapping table based on the obtained set of role behaviors.
[0034] Sub-step 12-2: Based on the set of menu interfaces determined by executing sub-step 12-1, determine the dynamic access permissions corresponding to the accessing user.
[0035] It should be noted that, to meet business needs, in this embodiment, the backend management could originally dynamically update the access permissions of users at any time through the graphical interface of the permission management backend by dynamically adjusting the data in the role-behavior association table or the behavior-menu interface association table. In this embodiment, the update of access permissions will take effect immediately, and the new rules will be used during the next permission verification without restarting any services.
[0036] Additionally, it should be noted that, in order to ensure the intelligence and flexibility of the access control scheme, in this embodiment, the access control system can also intelligently update the access permissions corresponding to each user based on historical behavior. In this embodiment, the specific update method may include: obtaining the historical access logs corresponding to the accessing user; correcting the dynamic access permissions determined based on the role behavior according to the historical access logs to obtain the updated dynamic access permissions.
[0037] For example, by analyzing historical access logs, the access control system can determine that a user U, after performing the "order_view" action, legitimately accessed the interface "GET: / api / order / statistics". Since the typical user action for this interface is "order_analyze", the access control system can determine that user U is highly likely to need "order_analyze" when performing "order_view". In this case, the access control system can generate a temporary, dynamically modified set of permissions, or give such requests an additional "risk score" during verification instead of directly rejecting them.
[0038] Step 13: Verify the access permissions of the accessing user based on the dynamic access permissions and the target access interface; In this embodiment of the application, the API gateway in the access control system can verify the access rights of the accessing user by comparing the target access interface with the dynamic access rights set and determining whether the target access interface exists in the dynamic access rights set.
[0039] If the verification is successful, proceed to step 14; if the verification fails, proceed to step 15.
[0040] Step 14: If the verification is successful, the access request is routed to the server corresponding to the target access interface. The Zuul gateway routes requests to the corresponding business microservices (such as the health e-commerce order service) for processing based on the service information obtained from Consul. The business service receives requests that have passed security verification and does not require re-authentication, so it can directly process the business logic.
[0041] Step 15: If the verification fails, the access request is blocked and an access denied response is returned.
[0042] Specifically, the authentication filter immediately terminates request forwarding and directly returns an HTTP 401 Unauthorized (or 403 Forbidden) status code and error message to the client, thereby effectively preventing this unauthorized access.
[0043] Using the access control method provided in this application embodiment, upon receiving an access request from a user for uploading a menu, the following steps are taken: First, the accessing user and the target access interface are determined based on the received access request; then, the role behavior corresponding to the accessing user is determined, and based on the role behavior, the dynamic access permission corresponding to the accessing user is determined, wherein the dynamic access permission corresponds to at least one menu interface; then, the access permission of the accessing user is verified based on the dynamic access permission and the target access interface; if the verification is successful, the access request is routed to the server corresponding to the target access interface; if the verification fails, the access request is blocked, and an access denied response is returned. The method provided in this application has two advantages. First, the permission control scheme can transform permission determination from static configuration to dynamic real-time calculation based on the current role behavior. Based on this, the system can dynamically generate user access permission sets according to real-time role behavior policies without modifying the underlying code or performing complex static configuration updates. This significantly enhances the flexibility of the permission management module, enabling the system to quickly respond to organizational restructuring, business rule changes, or temporary authorization needs, greatly improving the system's adaptability to complex and ever-changing business environments. Second, by refining the smallest unit of permission control to the "menu interface" level and combining the dynamically determined permission set with the specific "target access interface" for matching and verification, this application achieves fine-grained access control management. This overcomes the permission generalization problem that may exist in traditional coarse-grained role authorization. Furthermore, by completing this precise verification before request routing, any unauthorized requests attempting to access unauthorized interfaces can be effectively intercepted at the request entry point, fundamentally preventing security risks such as data leakage and unauthorized operations.
[0044] In one embodiment, this application also provides an access control device to address the security risks that may arise from existing access control schemes, such as users accessing unauthorized menu interfaces without proper authorization, leading to data leakage, information tampering, or abuse of system functions. A schematic diagram of the specific structure of this access control device is shown below. Figure 3 As shown, it includes: a request receiving unit 31, a permission determination unit 32, a permission verification unit 33, a routing unit 34, and an interception unit 35.
[0045] The request receiving unit 31 is used to determine the accessing user and the target access interface based on the received access request. The permission determination unit 32 is used to determine the role behavior corresponding to the accessing user, and determine the dynamic access permission corresponding to the accessing user based on the role behavior, wherein the dynamic access permission corresponds to at least one menu interface. The permission verification unit 33 is used to verify the access permission of the accessing user based on the dynamic access permission and the target access interface; The routing unit 34 is used to route the access request to the server corresponding to the target access interface after the permission verification unit has successfully verified the access request. The interception unit 35 is used to block the access request and return an access denied response when the permission verification unit fails to verify the access.
[0046] In one implementation, the permission determination unit 32 is specifically used for: obtaining the identity identifier of the accessing user; determining one or more roles corresponding to the accessing user based on the identity identifier; and determining the set of authorized behaviors for the role as the role behaviors.
[0047] In one implementation, the permission determination unit 32 is specifically used to: determine the set of menu interfaces associated with the role behavior by querying a preset dynamic permission mapping table, wherein the dynamic permission mapping table stores the association relationship between role behavior and menu interfaces; and determine the dynamic access permissions corresponding to the accessing user based on the set of menu interfaces.
[0048] In one implementation, a permission update unit is further included, specifically used to: dynamically update the association between role behavior and menu interface in response to permission configuration instructions, so as to adjust the dynamic access permissions.
[0049] In one implementation, the permission update unit is specifically used to: obtain the historical access logs corresponding to the accessing user; and correct the dynamic access permissions determined based on the role behavior according to the historical access logs to obtain the updated dynamic access permissions.
[0050] Using the access control device provided in this application embodiment, upon receiving an access request from a user for uploading a menu, the device first determines the accessing user and the target access interface based on the received access request; determines the role behavior corresponding to the accessing user; and determines the dynamic access permission corresponding to the accessing user based on the role behavior, wherein the dynamic access permission corresponds to at least one menu interface; performs access permission verification on the accessing user based on the dynamic access permission and the target access interface; if the verification is successful, the access request is routed to the server corresponding to the target access interface; if the verification fails, the access request is blocked, and an access denied response is returned. The method provided in this application has two advantages. First, the permission control scheme can transform permission determination from static configuration to dynamic real-time calculation based on the current role behavior. Based on this, the system can dynamically generate user access permission sets according to real-time role behavior policies without modifying the underlying code or performing complex static configuration updates. This significantly enhances the flexibility of the permission management module, enabling the system to quickly respond to organizational restructuring, business rule changes, or temporary authorization needs, greatly improving the system's adaptability to complex and ever-changing business environments. Second, by refining the smallest unit of permission control to the "menu interface" level and combining the dynamically determined permission set with the specific "target access interface" for matching and verification, this application achieves fine-grained access control management. This overcomes the permission generalization problem that may exist in traditional coarse-grained role authorization. Furthermore, by completing this precise verification before request routing, any unauthorized requests attempting to access unauthorized interfaces can be effectively intercepted at the request entry point, fundamentally preventing security risks such as data leakage and unauthorized operations.
[0051] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Please refer to it. Figure 4 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.
[0052] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.
[0053] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.
[0054] The processor reads the corresponding computer program from non-volatile memory into main memory and then executes it, forming an access control mechanism at the logical level. The processor executes the program stored in memory and specifically performs the following operations: Based on the received access request, determine the accessing user and the target access interface; determine the role behavior corresponding to the accessing user, and based on the role behavior, determine the dynamic access permission corresponding to the accessing user, wherein the dynamic access permission corresponds to at least one menu interface; perform access permission verification on the accessing user based on the dynamic access permission and the target access interface; if the verification is successful, route the access request to the server corresponding to the target access interface; if the verification fails, block the access request and return a prohibited access response.
[0055] The above is as stated in this application. Figure 4The access control method for electronic devices disclosed in the illustrated embodiments can be applied to or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.
[0056] Of course, in addition to software implementation, the electronic device of this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.
[0057] This application also proposes a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by a portable electronic device including multiple applications, enable the portable electronic device to perform... Figure 1 The method of the illustrated embodiment is specifically used to perform the following operations: Based on the received access request, determine the accessing user and the target access interface; determine the role behavior corresponding to the accessing user, and based on the role behavior, determine the dynamic access permission corresponding to the accessing user, wherein the dynamic access permission corresponds to at least one menu interface; perform access permission verification on the accessing user based on the dynamic access permission and the target access interface; if the verification is successful, route the access request to the server corresponding to the target access interface; if the verification fails, block the access request and return a prohibited access response.
[0058] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0059] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0060] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0061] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1The steps of the function specified in one or more boxes.
[0062] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0063] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0064] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0065] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0066] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0067] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.
Claims
1. An access control method, characterized in that, include: Based on the received access request, determine the accessing user and the target access interface; Determine the role behavior corresponding to the accessing user, and determine the dynamic access permission corresponding to the accessing user based on the role behavior, wherein the dynamic access permission corresponds to at least one menu interface; Based on the dynamic access permissions and the target access interface, the access permissions of the accessing user are verified. If the verification is successful, the access request will be routed to the server corresponding to the target access interface. If the verification fails, the access request is blocked and an access denied response is returned.
2. The method according to claim 1, wherein determining the role behavior corresponding to the accessing user specifically includes: Based on the identity identifier corresponding to the accessing user, determine one or more roles corresponding to the accessing user; Determine the set of authorized behaviors for the role, which will be defined as the role's behaviors.
3. The method according to claim 1, characterized in that, The step of determining the dynamic access permissions corresponding to the accessing user based on the role behavior specifically includes: Based on the role behavior, a set of menu interfaces associated with the role behavior is determined by querying a preset dynamic permission mapping table, wherein the dynamic permission mapping table stores the association between role behavior and menu interfaces. Based on the menu interface set, determine the dynamic access permissions corresponding to the accessing user.
4. The method according to claim 1, characterized in that, The method further includes: In response to permission configuration instructions, the association between role behavior and menu interface is dynamically updated to adjust the dynamic access permissions.
5. The method according to claim 1, characterized in that, The step of determining the dynamic access permissions corresponding to the accessing user further includes: Obtain the historical access logs corresponding to the accessing user; The dynamic access permissions determined based on the role's behavior are corrected according to the historical access logs to obtain updated dynamic access permissions.
6. An access control device, characterized in that, include: The request receiving unit is used to determine the accessing user and the target access interface based on the received access request. The permission determination unit is used to determine the role behavior corresponding to the accessing user, and to determine the dynamic access permission corresponding to the accessing user based on the role behavior, wherein the dynamic access permission corresponds to at least one menu interface. The permission verification unit is used to verify the access permissions of the accessing user based on the dynamic access permissions and the target access interface. The routing unit is used to route the access request to the server corresponding to the target access interface after the permission verification unit has successfully verified the access request. The interception unit is used to block the access request and return an access denied response when the permission verification unit fails to verify the access.
7. The access control device according to claim 6, characterized in that, The permission determination unit is specifically used for: Obtain the identity identifier of the accessing user; Based on the identity identifier, determine one or more roles corresponding to the accessing user; Determine the set of authorized behaviors for the role, which will be defined as the role's behaviors.
8. An access control device, comprising: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the access control method as described in any one of claims 1 to 5.
9. A computer-readable storage medium storing one or more programs, which, when executed by an electronic device including a plurality of applications, cause the electronic device to perform the access control method as described in any one of claims 1-6.
10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the access control method as described in any one of claims 1-6.