Multi-user system authority management method and system applied to micro-service architecture, medium and computer program product

Abstract

The invention provides a multi-user system authority management method and system applied to a micro-service architecture, a medium and a computer program product, belongs to the field of authority management, and solves the problem of how to perform multi-user system authority management under the condition of not modifying an authority system. The method comprises the following steps: receiving a micro-service login request sent by at least one user system through an account password for the first time after registering a login interface as a micro-service by modifying configuration file information; annotating role information generated by the user system in the micro-service through the configuration file information; after the account password is verified to be correct, marking the annotated role information as legal information, and allocating role permission; generating and returning a token for requesting resource data to the user system; and when the user system requests to access the resource data through the token, the user system can only request the resource data corresponding to the role permission carried by the token. The authority system of the user system does not need to be modified during authority management of the multi-user system.

Description

Technical Field

[0001] This invention relates to the field of access control, and in particular to a method, system, medium, and computer program product for access control of multi-user systems in a microservice architecture. Background Technology

[0002] When conducting system simulation evaluation, it is often necessary to support various user systems such as simulation system, evaluation system, and environment system. During business operation, a large amount of resource data is involved, including simulation model component data, evaluation index model data, evaluation operator model data, typical model component data, environment model data, entity data, environmental data, action plan data, action plan data, evaluation result data, evaluation report data, as well as various events and intermediate data generated during the simulation process.

[0003] Without modifying the permission systems of other user systems, unified identity authentication can be performed for different user systems, and user systems can be granted the permissions specified by the user system. Unified permission management can be performed based on user system level and resource data level.

[0004] In existing technologies, this is achieved by integrating JWT authentication technology with Spring Security.

[0005] Spring Security integrates JWT authentication technology, a technique based on the Spring Boot microservice architecture that uses tokens for authentication and authorization. JWT stands for JSON Web Token. The principle of JWT is as follows: after server authentication, a JSON object is generated and sent back to the user. The user sends this JSON object back to the server every time they communicate. The server relies solely on this JSON object to verify the user's identity. To prevent user data tampering, the server adds a signature when generating this JSON object.

[0006] During their research, the inventors discovered that the general Spring Security JWT authentication technology has poor scalability for multi-user system authentication and cannot meet the requirements for fine-grained resource access control or security control of various simulation and evaluation data. Summary of the Invention

[0007] To address the aforementioned technical problems, this invention provides a method, system, medium, and computer program product for multi-user system permission management applied to a microservice architecture. Without modifying the permission systems of other user systems, it performs unified identity authentication for different user systems and grants user systems the permissions specified therein, enabling unified permission management based on user system level and resource data level.

[0008] To achieve the above objectives, the technical solution provided by the present invention is as follows:

[0009] A method for managing permissions in a multi-user system applied to a microservice architecture includes:

[0010] Receive at least one login microservice request sent by a user system for the first time after the user system has registered the user system's login interface as a microservice by modifying the configuration file information;

[0011] The configuration file information carried in the login microservice request is used to annotate the role information generated by the user system in the microservice, and the configuration file information is bound to the role information.

[0012] After verifying that the account and password are correct, the annotated role information is marked as valid information, and role permissions for accessing resource data stored in the microservice are assigned to the role information marked as valid information.

[0013] Generate and return a token to the user system for requesting access to resource data, the token carrying role permissions;

[0014] When a user system requests access to resource data using a token, it can only request resource data corresponding to the role permissions carried by the token.

[0015] Furthermore, the configuration file information includes port information, database configuration information, and / or system configuration information.

[0016] Furthermore, the role permissions include resource data level and user system level;

[0017] The resource data level and user system level are associated through corresponding tags; after the resource data is modified, it is automatically mapped to the corresponding user system level through the tags; when a user system requests access to resource data, it can only request access to data resources at the same level or lower than the user system level.

[0018] Furthermore, the labels for resource data levels include: access identifier, sharing identifier, and resource data level identifier;

[0019] The user system level label includes: User System Level Identifier.

[0020] Furthermore, the resource data is distributed and stored according to data type, and a request interface corresponding to the resource data is provided. The user system requests the resource data through the request interface based on the role permissions carried by the token.

[0021] Furthermore, the request interface includes access to and / or sharing of resource data.

[0022] Furthermore, the resource data includes model resource data, data resource data, and business application resource data;

[0023] Model resource data includes simulation model data, model component data, evaluation index data, operator model data, model validation algorithm data, and / or adjudication algorithm data;

[0024] Data resources include environmental data, entity attribute data, target information data, and / or model validation data;

[0025] Business application resource data includes assessment scheme data, action plan data, simulation scenario data, action plan data, events and data during the simulation process, assessment result data and / or assessment report data.

[0026] This invention also provides a multi-user system permission management system applied to a microservice architecture, comprising:

[0027] The receiving module is used to receive the first login microservice request sent by at least one user system after it has registered the user system's login interface as a microservice by modifying the configuration file information;

[0028] The annotation module is used to annotate the role information generated by the user system in the microservice by the configuration file information carried in the login microservice request, and bind the configuration file information with the role information;

[0029] The allocation module is used to mark the annotated role information as valid information after verifying the correct account password, and to assign role permissions for accessing resource data stored in the microservice to the marked role information.

[0030] The generation module is used to generate and return to the user system a token for requesting access to resource data, the token carrying role permissions;

[0031] The access module is used to ensure that when a user system requests access to resource data via a token, it can only provide the resource data corresponding to the role permissions carried by the token.

[0032] The present invention also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the method.

[0033] The present invention also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the method.

[0034] Beneficial effects:

[0035] This invention provides a solution by receiving a login request to a microservice sent by at least one user system after registering its login interface as a microservice by modifying its configuration file information; annotating the role information generated by the user system in the microservice using the configuration file information carried in the login request, thus binding the configuration file information with the role information; after verifying the correctness of the account and password, marking the annotated role information as valid information, and assigning role permissions for accessing resource data stored in the microservice to the marked role information; generating and returning a token to the user system for requesting access to resource data, the token carrying role permissions; and ensuring that when the user system requests access to resource data using the token, it can only request the resource data corresponding to the role permissions carried by the token. This solution achieves identity authentication based on user system information and grants specified role permissions to different user systems without modifying the user system's permission system. It enables unified permission management based on user system level and resource data level, realizing multi-dimensional cross-permission identification and access control of data resources, ensuring the access security of system simulation resource data across multiple user systems; it greatly reduces the workload of administrators, improves work efficiency, and provides support for subsequent horizontal system upgrades. Attached Figure Description

[0036] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0037] Figure 1 This is a flowchart of a multi-user system permission management method applied to a microservice architecture, provided by the present invention.

[0038] Figure 2 This is a schematic diagram of the hierarchical access control provided by the present invention. Detailed Implementation

[0039] First, it should be noted that the embodiments of the present invention are merely preferred implementations and should not be construed as limiting the implementation of the present invention. The scope of protection of the present invention shall still be determined by the contents disclosed in the claims.

[0040] Example 1

[0041] like Figure 1 As shown, Embodiment 1 of the present invention provides a method for managing permissions in a multi-user system applied to a microservice architecture, including:

[0042] Step 1: Receive the first login request to the microservice sent by at least one user system after it has registered the user system's login interface as a microservice by modifying the configuration file information, using an account and password.

[0043] The user system includes multiple user systems such as simulation systems, evaluation systems, and / or environment systems. The configuration file information includes port information, database configuration information, and / or system configuration information.

[0044] Step 2: Annotate the role information generated by the user system in the microservice using the configuration file information carried in the login microservice request, and bind the configuration file information with the role information.

[0045] Since account information in multi-user systems may conflict, such as multiple user systems having the same ID, role-based access authentication in multi-user systems requires separate authorization. First, each user system needs to register as a microservice by modifying its configuration file, registering the existing login interface as a microservice. The backend automatically annotates the role information generated by the user system in the microservice according to the configuration file information, binding the configuration file information with the role information, thereby realizing the function of separate authorization.

[0046] Step 3: After verifying that the account and password are correct, mark the annotated role information as valid information, and assign role permissions for accessing resource data stored in the microservice to the marked role information.

[0047] Step four: Generate and return a token to the user system for requesting access to resource data, the token carrying role permissions.

[0048] The Token is a string generated by the server to serve as a token for the user system to make requests. After the first login, the server generates a Token and returns it to the user system. In the future, the user system only needs to bring this Token to request data, without having to bring the username and password again.

[0049] Step 5: When a user system requests access to resource data via a token, it can only request resource data corresponding to the role permissions carried by the token.

[0050] For example, when a user system accesses resource data, it can only access resource data at the same or lower level as its own role permission level, thereby controlling the use of resource data based on the user system's confidentiality qualifications; at the same time, when a user system shares resource data, it can only share resource data of the corresponding level according to its own user system's confidentiality role permission, and cannot exceed its own permission scope, ensuring that resource data is not accessed or shared beyond its boundaries.

[0051] This invention adopts a permission authentication method based on Spring Cloud microservice architecture. Multi-user system permission authentication only requires registering the original login interface as a microservice. The microservice registration function is completed by modifying the configuration file information. After registration, users can log in directly using the original account and password. Corresponding role permissions will be assigned to each user system to provide role-based access control for resource access.

[0052] The role permissions include resource data level and user system level;

[0053] The resource data level and user system level are associated through corresponding tags; after the resource data is modified, it is automatically mapped to the corresponding user system level through the tags; when a user system requests access to resource data, it can only request access to data resources at the same level or lower than the user system level.

[0054] Resource data level labels include: access identifier, sharing identifier, and resource data level identifier;

[0055] The user system level label includes: User System Level Identifier.

[0056] For example, resource data security levels can be set to three levels: Level 1, Level 2, and Level 3. System administrators can flexibly manage and edit resource data levels according to business needs, and the modified resource data level settings can be automatically mapped to user system level permission information. User system levels can be set to four personnel security levels: None, General, Important, and Core, corresponding to the resource data levels. When a user's system level is None, they do not have any resource data query or download permissions and can only use basic functions. General, Important, and Core correspond to resource levels 1, 2, and 3, respectively. Figure 2 As shown, system administrators can manage and edit user system levels, enabling the linkage between resource data level management and user system permissions.

[0057] For example, when a user system performs a query and download operation, it filters the resource data based on the user system and resource data tags to achieve access control over the resource data.

[0058] Only shared resource data can be accessed by other user systems. User systems can submit shared resource data for approval by the system administrator. Once the approval is complete, the sharing is finished.

[0059] The resource data is distributed and stored according to data type, and a request interface corresponding to the resource data is provided. The user system requests the resource data through the request interface based on the role permissions carried by the token.

[0060] The request interface includes access to and / or sharing of resource data.

[0061] The resource data includes model resource data, data resource data, and business application resource data;

[0062] Model resource data includes simulation model data, model component data, evaluation index data, operator model data, model validation algorithm data, and / or adjudication algorithm data;

[0063] Data resources include environmental data, entity attribute data, target information data, and / or model validation data;

[0064] Business application resource data includes assessment scheme data, action plan data, simulation scenario data, action plan data, events and data during the simulation process, assessment result data and / or assessment report data.

[0065] Example 2

[0066] Embodiment 2 of the present invention provides a multi-user system permission management system applied to a microservice architecture, comprising:

[0067] The receiving module is used to receive the first login microservice request sent by at least one user system after it has registered the user system's login interface as a microservice by modifying the configuration file information;

[0068] The annotation module is used to annotate the role information generated by the user system in the microservice by the configuration file information carried in the login microservice request, and bind the configuration file information with the role information;

[0069] The allocation module is used to mark the annotated role information as valid information after verifying the correct account password, and to assign role permissions for accessing resource data stored in the microservice to the marked role information.

[0070] The generation module is used to generate and return to the user system a token for requesting access to resource data, the token carrying role permissions;

[0071] The access module is used to ensure that when a user system requests access to resource data via a token, it can only provide the resource data corresponding to the role permissions carried by the token.

[0072] The present invention provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the method.

[0073] The present invention provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the method.

[0074] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, media, and computer program products described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0075] Beneficial effects:

[0076] This invention provides a solution that receives a login request to a microservice from at least one user system after the user system has registered its login interface as a microservice by modifying its configuration file information. The system annotates the role information generated by the user system within the microservice using the configuration file information carried in the login request, binding the configuration file information to the role information. After verifying the correctness of the account and password, the annotated role information is marked as valid, and role permissions for accessing resource data stored in the microservice are assigned to the marked role information. A token carrying role permissions is generated and returned to the user system for requesting access to resource data is generated and returned. When the user system requests access to resource data using the token, it can only request the resource data corresponding to the role permissions carried by the token. This solution achieves identity authentication based on user system information and grants specified role permissions to different user systems without modifying the user system's permission system. It enables unified permission management based on user system level and resource data level, achieving multi-dimensional cross-permission identification and access control for data resources, ensuring the security of access to system simulation resource data across multiple user systems. This significantly reduces the workload of administrators, improves work efficiency, and provides support for subsequent horizontal system upgrades.

[0077] Finally, it should be pointed out that any use or implementation of the technical solution of this invention by any entity or individual constitutes an infringement of this invention, and no entity or individual may implement this patent independently without the permission of the applicant. Any implementation by any entity or individual inspired by or with simple modifications to this invention should also be considered within the scope of protection of this patent.

Claims

1. A method for managing permissions in a multi-user system applied to a microservice architecture, characterized in that, include: Receive at least one login microservice request sent by a user system for the first time after the user system has registered the user system's login interface as a microservice by modifying the configuration file information; The configuration file information carried in the login microservice request is used to annotate the role information generated by the user system in the microservice, and the configuration file information is bound to the role information. After verifying that the account and password are correct, the annotated role information is marked as valid information, and role permissions for accessing resource data stored in the microservice are assigned to the role information marked as valid information. Generate and return a token to the user system for requesting access to resource data, the token carrying role permissions; When a user system requests access to resource data using a token, it can only request resource data corresponding to the role permissions carried by the token.

2. The method as described in claim 1, characterized in that, The configuration file information includes port information, database configuration information, and / or system configuration information.

3. The method as described in claim 1, characterized in that, The role permissions include resource data level and user system level; The resource data level and user system level are associated through corresponding tags; after the resource data is modified, it is automatically mapped to the corresponding user system level through the tags; when a user system requests access to resource data, it can only request access to data resources at the same level or lower than the user system level.

4. The method as described in claim 3, characterized in that, Resource data level labels include: access identifier, sharing identifier, and resource data level identifier; The user system level label includes: User System Level Identifier.

5. The method as described in claim 1, characterized in that, The resource data is distributed and stored according to data type, and a request interface corresponding to the resource data is provided. The user system requests the resource data through the request interface based on the role permissions carried by the token.

6. The method as described in claim 5, characterized in that, The request interface includes access to and / or sharing of resource data.

7. The method according to any one of claims 1-6, characterized in that, The resource data includes model resource data, data resource data, and business application resource data; Model resource data includes simulation model data, model component data, evaluation index data, operator model data, model validation algorithm data, and / or adjudication algorithm data; Data resources include environmental data, entity attribute data, target information data, and / or model validation data; Business application resource data includes evaluation scheme data, action plan data, simulation scenario data, action plan data, simulation process event and intermediate data, evaluation result data and / or evaluation report data.

8. A permission management system for a multi-user system applied to a microservice architecture, characterized in that, include: The receiving module is used to receive the first login microservice request sent by at least one user system after it has registered the user system's login interface as a microservice by modifying the configuration file information; The annotation module is used to annotate the role information generated by the user system in the microservice by the configuration file information carried in the login microservice request, and bind the configuration file information with the role information; The allocation module is used to mark the annotated role information as valid information after verifying the correct account password, and to assign role permissions for accessing resource data stored in the microservice to the marked role information. The generation module is used to generate and return to the user system a token for requesting access to resource data, the token carrying role permissions; The access module is used to ensure that when a user system requests access to resource data via a token, it can only provide the resource data corresponding to the role permissions carried by the token.

9. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method described in any one of claims 1-7.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method described in any one of claims 1-7.

Images