Access control method, device and system, electronic equipment and storage medium

Abstract

The invention provides an access control method, device and system, electronic equipment and a storage medium, and relates to the field of network security, the method comprises the following steps: receiving an Nth-level access request initiated by a user for an Nth access level, the Nth-level access request carrying an Nth-level access credential; n is a positive integer greater than or equal to 1; wherein the Nth-level access credential is generated after the (N-1) th-level access request is successfully verified, and comprises a user identifier, an (N-1) th-level completion credential and an Nth-level resource set; on the basis of the Nth-level access credential, verifying the Nth-level access request; in response to successful verification of the Nth-level access request, generating an (N + 1) th-level access credential; wherein the (N + 1) th-level access credential is used for verifying the (N + 1) th-level access request and comprises the user identifier, the Nth-level completion credential and the (N + 1) th-level resource set until the access process is finished. According to the scheme, the security of service access is improved.

Description

Technical Field

[0001] This disclosure relates to the field of network security, and in particular to an access control method, apparatus, system, electronic device, and storage medium. Background Technology

[0002] In many business scenarios, users typically complete login authentication first, followed by multiple sequential business steps executed in a fixed order. For example, let login authentication be scenario A. After logging in, there are subsequent business steps such as scenario B and scenario C, which must be executed in the order of A, B, and C. Only after completing the previous step can the next step be performed. Taking financial payment services as an example, after logging into a mobile banking app using a login password or fingerprint verification to make a large transfer, users usually need to complete facial verification first, then enter a transfer password, and only after all authentications are successful can the transfer be completed.

[0003] However, existing access control mechanisms only perform security checks during the login process and cannot effectively constrain the execution order of subsequent sequential business processes. This poses a risk of unauthorized users skipping scenario A to access scenario B or scenario C, or skipping scenario B to directly access scenario C, making it difficult to guarantee the integrity and security of business processes. Summary of the Invention

[0004] This disclosure provides an access control method, apparatus, system, electronic device, and storage medium to at least solve the above-mentioned technical problems existing in the prior art.

[0005] According to a first aspect of this disclosure, an access control method is provided, the method comprising:

[0006] Receive a user's Nth level access request for the Nth access level, the Nth level access request carrying the Nth level access credential; N is a positive integer greater than or equal to 1; The Nth-level access credential is generated after the N-1th-level access request is successfully verified, and includes a user identifier, an N-1th-level completion credential, and an Nth-level resource set. The Nth level access request is verified based on the Nth level access credential. Upon successful verification of the Nth level access request, an N+1th level access credential is generated. The N+1 level access credential is used to verify the N+1 level access request, including the user identifier, the N level completion credential, and the N+1 level resource set, until the access process ends.

[0007] In one possible implementation, the method further includes: In response to the failure of the verification of the Nth level access request, the user is prohibited from accessing the business resources corresponding to the Nth level access request.

[0008] In one possible implementation, the method further includes: The business systems are traversed and queried to determine the resource cascading relationships corresponding to the business systems. These resource cascading relationships are used to generate corresponding access credentials for each access level.

[0009] In one possible implementation, the step of verifying the Nth-level access request based on the Nth-level access credential includes: Verify whether the N-1 level completion certificate is legal and valid; In response to the validity of the N-1 level completion credential, determine whether the N-level resource set includes the business resource corresponding to the N-level access request; If included, then the Nth level access request is confirmed to have been successfully verified.

[0010] In one possible implementation, the method further includes: The Nth-level access credential is written into a small text file on the business client so that the Nth-level access request carries the Nth-level access credential.

[0011] In one possible implementation, the method further includes: Based on the resource cascading relationship, the N+1 level resource set is determined.

[0012] According to a second aspect of this disclosure, an access control device is provided, the device comprising: The request acquisition module is used to generate and receive the Nth level access request initiated by the user for the Nth access level, wherein the Nth level access request carries the Nth level access credential; N is a positive integer greater than or equal to 1; The Nth-level access credential is generated after the N-1th-level access request is successfully verified, and includes a user identifier, an N-1th-level completion credential, and an Nth-level resource set. The verification module is used to verify the Nth-level access request based on the Nth-level access credential. The credential generation module is used to generate an N+1 level access credential in response to the successful verification of the Nth level access request. The N+1 level access credential is used to verify the N+1 level access request, including the user identifier, the N level completion credential, and the N+1 level resource set, until the access process ends.

[0013] According to a third aspect of this disclosure, an access control system is provided, the system including a control server, the control server being configured to: Receive a user's Nth level access request for the Nth access level, the Nth level access request carrying the Nth level access credential; N is a positive integer greater than or equal to 1; The Nth-level access credential is generated after the N-1th-level access request is successfully verified, and includes a user identifier, an N-1th-level completion credential, and an Nth-level resource set. The Nth level access request is verified based on the Nth level access credential. Upon successful verification of the Nth level access request, an N+1th level access credential is generated. The N+1 level access credential is used to verify the N+1 level access request, including the user identifier, the N level completion credential, and the N+1 level resource set, until the access process ends.

[0014] According to a fourth aspect of this disclosure, an electronic device is provided, comprising: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the methods of this disclosure.

[0015] According to a fifth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions for causing the computer to perform the methods described in this disclosure.

[0016] The access control method, apparatus, system, electronic device, and storage medium disclosed herein, by carrying an access credential containing a user identifier, the previous level completion credential, and the current level resource set in each level of access to a serialized service, and performing step-by-step verification and generation of new credentials, can strictly constrain users to access each service level sequentially according to the preset resource cascading relationship. This fundamentally avoids illegal access behaviors such as skipping levels and jumping steps, thereby improving the security of service access and achieving refined and orderly access control of the business process.

[0017] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0018] The above and other objects, features, and advantages of this disclosure will become readily apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. Several embodiments of this disclosure are illustrated in the drawings by way of example and not limitation, in which: In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts.

[0019] Figure 1 This illustration shows an implementation scenario of an embodiment of the present disclosure. Figure 1 ; Figure 2 A schematic diagram illustrating the implementation flow of the access control method according to an embodiment of this disclosure is shown; Figure 3 This illustration shows an implementation scenario of an embodiment of the present disclosure. Figure 2 ; Figure 4 A schematic diagram of a resource cascading relationship according to an embodiment of this disclosure is shown; Figure 5 This illustration shows a resource cascading relationship according to an embodiment of the present disclosure. Figure 2 ; Figure 6 A schematic diagram of the composition structure of the access control device according to an embodiment of the present disclosure is shown; Figure 7 A schematic diagram of the composition structure of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0020] To make the objectives, features, and advantages of this disclosure more apparent and understandable, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0021] The first aspect of this application provides an access control method applied to scenarios involving the sequential access of multiple business systems. This method requires users to access multiple business processes in a pre-defined, fixed order, where completion of each process is a prerequisite for proceeding to the next, and skipping or unordered access is prohibited. For example, in a financial payment scenario, users must first complete login authentication, then facial recognition, and finally enter a transfer password to complete a large transfer. This method is specifically applied to control the server-side. Figure 1 As shown, the control server is deployed between the business client (or browser) and each business system (such as business system X and business system Y) as a hub for access control.

[0022] in, Figure 1 The business client or browser in the diagram serves as the terminal carrier for users to initiate access requests. Business system X and business system Y are business resources that need to be accessed in a preset order. It is understood that business system X and business system Y here are merely illustrative examples, and this solution can be adapted to any number and type of serialized business systems, and is not limited to the two business systems shown in the diagram.

[0023] like Figure 2 As shown, it includes the following steps: Step 101: Receive the Nth level access request initiated by the user for the Nth access level. The Nth level access request carries the Nth level access credential. N is a positive integer greater than or equal to 1. The Nth level access credential is generated after the N-1th level access request is successfully verified, and includes the user identifier, the N-1th level completion credential, and the Nth level resource set.

[0024] The (N-1)th level access request is an access request initiated by the user for the (N-1)th access level. If the (N-1)th level access request is successfully verified, the business system accesses the business resources corresponding to the (N-1)th access level and displays the entry control corresponding to the next access level through the business client or browser. At this time, if the user selects this entry in the business client or browser, an Nth level access request will be initiated for the Nth access level. This Nth level access request carries an Nth level access credential, which includes a user identifier, an (N-1)th level completion credential, and an Nth level resource set. The control server receives and processes this Nth level access request.

[0025] Among them, the user identifier is a unique identifier for the current user, used to distinguish access sessions of different users and ensure that access behavior corresponds one-to-one with user identity; the N-1 level completion credential is used to verify whether the user has legally completed access to the N-1 access level, as a prerequisite for allowing access to the N access level; the N level resource set is used to limit the range of resources that the user is allowed to access in the N access level.

[0026] Step 102: Verify the Nth level access request based on the Nth level access credential.

[0027] Specifically, the control server first verifies the legitimacy of the current access request based on the user identifier, confirming that the request source matches the user to whom the credentials belong. Secondly, it verifies whether the user has already legally completed access at the (N-1)th access level based on the credentials verified at level N-1, confirming that the current access has a legitimate prerequisite. Finally, it determines whether the resource requested in this access request falls within the preset allowed range based on the resource set at level N, ensuring that the access behavior conforms to the resource cascading relationship.

[0028] Step 103: In response to the successful verification of the Nth level access request, generate the N+1th level access credential; wherein, the N+1th level access credential is used to verify the N+1th level access request, including the user identifier, the Nth level completion credential, and the N+1th level resource set, until the access process ends.

[0029] If the identity verification, pre-authentication verification, and resource permission verification all pass, it indicates that the Nth-level access request has been successfully verified, allowing the user to access the business resources corresponding to the Nth access level. Simultaneously, the control server generates an N+1th-level access credential and returns it to the client. This credential is used for subsequent legitimacy verification when the user accesses the N+1th level.

[0030] The N-1, N, and N+1 access levels are sequential access levels executed in a pre-defined order within the business process. They represent the hierarchical relationships of sequential dependency and non-skipping between business resources. N is only used to uniformly number and distinguish each access level to clearly describe the process of accessing and verifying at each level, and does not constitute a limitation on the specific number of levels.

[0031] This solution, by carrying access credentials containing the user identifier, the previous level's completion credentials, and the current level's resource set in each level of access to the serialized business, and by performing step-by-step verification and generating new credentials at each level, can strictly constrain users to access each business level in sequence according to the preset resource cascading relationship. This fundamentally avoids illegal access behaviors such as skipping levels and jumping steps, thereby improving the security of business access and achieving refined and orderly access control of business processes.

[0032] The following example illustrates this embodiment: In this example, N is 1. Assume that access level 0 is the user login level, access level 1 is the system homepage level, and access level 2 is the business function page level. After the user completes login verification at access level 0, the control server generates a level 1 access credential, which includes the user identifier, the level 0 completion credential, and a level 1 resource set. The user initiates an access request for access level 1, carrying this level 1 access credential. The server verifies the level 0 completion credential and resource permissions. If the verification passes, the user is allowed to access the system homepage, and a level 2 access credential containing the user identifier, the level 1 completion credential, and a level 2 resource set is generated. When the user further initiates an access request for access level 2, the control server verifies it again using the same logic. If the verification passes, access to the corresponding business function page is allowed. This process of verification and authorization continues level by level until the entire business access process ends, thereby achieving strict and orderly access control over interconnected business resources and effectively preventing unauthorized access.

[0033] In another embodiment of this disclosure, the method further includes: in response to the failure of the verification of the Nth level access request, prohibiting the user from accessing the business resources corresponding to the Nth level access request.

[0034] If the user identifier is invalid, the N-1 level completion credential is invalid or tampered with, or the resource currently requested does not belong to the N-level resource set, then the N-level access request verification fails. In this case, the control server directly rejects the access request and does not grant the user access to any business resources under the N-level access hierarchy. This effectively intercepts unauthorized access, unauthorized access, and privilege-breaking access, thereby improving the overall access security of the business system.

[0035] In another embodiment of this disclosure, the method further includes: performing a traversal query on the business system to determine the resource cascading relationship corresponding to the business system, wherein the resource cascading relationship is used to generate corresponding access credentials for each access level.

[0036] The resource cascading relationship corresponding to the business system is a pre-defined resource access chain that reflects the sequence of business processes. Its core function is to clarify the access rules and structural relationships between various accessed resources, providing a basis for the generation of access credentials. Specifically, this can be achieved through methods such as... Figure 3 The control client shown uses methods such as automatic crawling, historical access log analysis, or manual configuration to perform cascading access to the pages of the business system, thereby obtaining and constructing resource cascading relationships. The constructed resource cascading relationships are then configured to the control server, enabling the control server to generate access credentials containing corresponding resource sets for different access levels based on these resource cascading relationships.

[0037] For example, Figure 4 In the resource cascading relationship shown, "User Login" is the entry point for the entire business process, followed by branch nodes such as the homepage, Business A entry point, Business B entry point, and Business C entry point. These branch nodes correspond to the access entry points of different business lines. Each business entry point contains multiple page nodes, such as pages A1, A2, and A3. These page nodes can only be accessed after the access and verification of their corresponding preceding nodes are completed, thus forming a clear hierarchy and a well-defined sequence of resource access constraints.

[0038] In another embodiment of this disclosure, the step of verifying the Nth-level access request based on the Nth-level access credential includes: verifying whether the (N-1)th-level completion credential is valid; in response to the validity of the (N-1)th-level completion credential, determining whether the Nth-level resource set includes the business resource corresponding to the Nth-level access request; if it does, then determining that the Nth-level access request has been successfully verified.

[0039] First, the validity of the N-1 level completion credential is verified. Specifically, the control server verifies the integrity, validity, and signature authenticity of the N-1 level completion credential, determining whether it has expired, been forged, or illegally altered. If the credential is invalid, the N-1 level access request is deemed to have failed verification, and the current access is denied. If the N-1 level completion credential is valid, it indicates that the user has legally completed the N-1 access level according to the business process, meeting the prerequisites for entering the N-1 access level. Further verification is then conducted to determine whether the N-1 resource set contains the business resource pointed to by the N-1 level access request. For example, if the N-1 resource set only contains pages A1, A2, and A3, access is only permitted to these resources. If the resource requested is not within this set, it is considered an unauthorized or excessive access, and service is denied. If the requested resource is within the set, it indicates that the user's access is legitimate and compliant, and the N-1 level access request verification is successful.

[0040] The verification scheme in this embodiment uses a two-level verification logic that first verifies the pre-existing credentials and then verifies the resource permissions. This effectively blocks unauthorized access, access beyond authorized levels, and access beyond permitted rights, further improving the access security and process standardization of the business system.

[0041] In another embodiment of this disclosure, the method further includes: writing the Nth level access credential into a small text file of the business client, so that the Nth level access request carries the Nth level access credential.

[0042] After generating the Nth-level access credential, the control server writes it to a small text file (cookie) on the corresponding business client and stores it locally on the client. When the user subsequently initiates an Nth-level access request for the Nth access level, the business client automatically reads the Nth-level access credential from the small text file and includes it in the access request, sending it to the control server. This achieves automatic transmission and carrying of access credentials, ensuring the smooth execution of the hierarchical access and verification process.

[0043] In another embodiment of this disclosure, the method further includes: determining the N+1th level resource set based on the resource cascading relationship.

[0044] The control client obtains and constructs resource cascading relationships from the business system through automated web crawling and log analysis. This resource cascading relationship is then configured on the server-side. After configuration on the back-end management platform, the server can maintain and use this resource cascading relationship. Based on this configured resource cascading relationship, the control server generates a corresponding next-level resource set for each access level, used to generate access credentials.

[0045] by Figure 4Taking the resource cascading relationship shown as an example, after obtaining the relationship, the control server configures it as follows: Figure 5 The structured hierarchical relationship is shown. If the Nth level access level is a "Level 1" node, the control server can determine the corresponding N+1th level resource set as a resource set containing three "Level 2" nodes based on its branch structure. If the Nth level access level is a "Level 2" node, the control server can determine the corresponding N+1th level resource set as a resource set containing three "Level 3" nodes based on its child nodes, thus providing accurate permission criteria for generating access credentials.

[0046] To better understand the embodiments of this solution, a specific example is provided below: In this example, the business system is a web business system based on the HTTP / HTTPS protocol, and N is 1. Figure 4 Taking the resource cascading relationship shown as an example, after the user completes the identity authentication at the 0th access level (user login) on the client and the verification is successful, the control server generates the 1st level access credential. This credential includes: user identifier, 0th level completion credential and 1st level resource set (homepage resources), and returns the 1st level access credential to the client's local storage.

[0047] When a user clicks to enter the "Homepage" on the client, the client automatically sends a Level 1 access request, carrying Level 1 access credentials. Upon receiving this request, the control server verifies the Level 1 access credentials: it checks the validity of the Level 0 completion credentials and determines whether the requested homepage resource belongs to the Level 1 resource set. If both verifications pass, the user is allowed to access the homepage resource, and a Level 2 access credential is generated. This credential includes the user identifier, the Level 1 completion credentials, and the Level 2 resource set (Business A Entry Point, Business B Entry Point, and Business C Entry Point).

[0048] When a user clicks on a specific service entry point (e.g., service entry point A), the client initiates a Level 2 access request carrying the Level 2 access credentials. The control server performs the verification according to the same logic. If the verification passes, the user is allowed to access the corresponding service entry page, and the next level access credential is generated, thus verifying and authorizing at each level.

[0049] The access process ends normally after the user visits the target business page and exits the system or the session times out. During this process, if there are any issues such as an invalid user identifier, invalid pre-completion credentials, or the requested resource not being in the corresponding resource set, the control server will directly deny access.

[0050] In this solution, the control server uses a reverse proxy mechanism to uniformly capture and process all access requests, strictly ensuring that each page in the business system must be accessed sequentially according to a preset serial logic, without skipping any levels. Furthermore, this implementation requires no code modification to the original business system, exhibiting loose coupling and easy adaptability to different business systems, and possessing strong versatility and scalability.

[0051] A second aspect of this embodiment provides an access control device, such as... Figure 6 As shown, the device includes: a request acquisition module 601, used to generate and receive an Nth-level access request initiated by a user for the Nth access level, wherein the Nth-level access request carries an Nth-level access credential; N is a positive integer greater than or equal to 1; wherein the Nth-level access credential is generated after the N-1th-level access request is successfully verified, and includes a user identifier, an N-1th-level completion credential, and an Nth-level resource set; a verification module 602, used to verify the Nth-level access request based on the Nth-level access credential; and a credential generation module 603, used to generate an N+1th-level access credential in response to the successful verification of the Nth-level access request; wherein the N+1th-level access credential is used to verify the N+1th-level access request, including a user identifier, an Nth-level completion credential, and an N+1th-level resource set, until the access process ends.

[0052] A third aspect of this embodiment provides an access control system, the system including a control server, the control server being configured to: receive an Nth-level access request initiated by a user for an Nth access level, the Nth-level access request carrying an Nth-level access credential; N being a positive integer greater than or equal to 1; wherein the Nth-level access credential is generated after the N-1th-level access request is successfully verified, including a user identifier, an N-1th-level completion credential, and an Nth-level resource set; verify the Nth-level access request based on the Nth-level access credential; and generate an N+1th-level access credential in response to the successful verification of the Nth-level access request; wherein the N+1th-level access credential is used to verify the N+1th-level access request, including a user identifier, an Nth-level completion credential, and an N+1th-level resource set, until the access process ends.

[0053] refer to Figure 1 or Figure 3 The architecture shown places the control server between the business client or browser and the business system. It can uniformly intercept, parse, and verify all access requests, implementing hierarchical access control based on resource cascading relationships. Simultaneously, it provides services externally as a reverse proxy, without requiring modifications to existing business systems. (Reference) Figure 3 As shown in the architecture, the system may also include a control client for traversing the business systems and obtaining the resource cascading relationships corresponding to the business systems.

[0054] According to embodiments of this disclosure, this disclosure also provides an electronic device and a readable storage medium.

[0055] Figure 7 A schematic block diagram of an example electronic device that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0056] like Figure 7 As shown, device 800 includes a computing unit 801, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 802 or a computer program loaded from storage unit 808 into random access memory (RAM) 803. RAM 803 may also store various programs and data required for the operation of device 800. The computing unit 801, ROM 802, and RAM 803 are interconnected via bus 804. Input / output (I / O) interface 805 is also connected to bus 804.

[0057] Multiple components in device 800 are connected to I / O interface 805, including: input unit 806, such as keyboard, mouse, etc.; output unit 807, such as various types of monitors, speakers, etc.; storage unit 808, such as disk, optical disk, etc.; and communication unit 809, such as network card, modem, wireless transceiver, etc. Communication unit 809 allows device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0058] The computing unit 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as access control methods. For example, in some embodiments, the access control method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the access control method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform access control methods by any other suitable means (e.g., by means of firmware).

[0059] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transferring data and instructions to the storage system, the at least one input device, and the at least one output device.

[0060] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0061] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0062] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0063] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0064] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0065] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this disclosure can be achieved, and this is not limited herein.

[0066] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this disclosure, "a plurality of" means two or more, unless otherwise explicitly specified.

[0067] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. An access control method, characterized in that, The method includes: Receive a user's Nth level access request for the Nth access level, the Nth level access request carrying the Nth level access credential; N is a positive integer greater than or equal to 1; The Nth-level access credential is generated after the N-1th-level access request is successfully verified, and includes a user identifier, an N-1th-level completion credential, and an Nth-level resource set. The Nth level access request is verified based on the Nth level access credential. Upon successful verification of the Nth level access request, an N+1th level access credential is generated. The N+1 level access credential is used to verify the N+1 level access request, including the user identifier, the N level completion credential, and the N+1 level resource set, until the access process ends.

2. The method according to claim 1, characterized in that, The method further includes: In response to the failure of the verification of the Nth level access request, the user is prohibited from accessing the business resources corresponding to the Nth level access request.

3. The method according to claim 1, characterized in that, The method further includes: The business systems are traversed and queried to determine the resource cascading relationships corresponding to the business systems. These resource cascading relationships are used to generate corresponding access credentials for each access level.

4. The method according to claim 1, characterized in that, The verification of the Nth-level access request based on the Nth-level access credential includes: Verify whether the N-1 level completion certificate is legal and valid; In response to the validity of the N-1 level completion credential, determine whether the N-level resource set includes the business resource corresponding to the N-level access request; If included, then the Nth level access request is confirmed to have been successfully verified.

5. The method according to claim 1, characterized in that, The method further includes: The Nth-level access credential is written into a small text file on the business client so that the Nth-level access request carries the Nth-level access credential.

6. The method according to claim 3, characterized in that, The method further includes: Based on the resource cascading relationship, the N+1 level resource set is determined.

7. An access control device, characterized in that, The device includes: The request acquisition module is used to generate and receive the Nth level access request initiated by the user for the Nth access level, wherein the Nth level access request carries the Nth level access credential; N is a positive integer greater than or equal to 1; The Nth-level access credential is generated after the N-1th-level access request is successfully verified, and includes a user identifier, an N-1th-level completion credential, and an Nth-level resource set. The verification module is used to verify the Nth-level access request based on the Nth-level access credential. The credential generation module is used to generate an N+1 level access credential in response to the successful verification of the Nth level access request. The N+1 level access credential is used to verify the N+1 level access request, including the user identifier, the N level completion credential, and the N+1 level resource set, until the access process ends.

8. An access control system, characterized in that, The system includes a control server, which is used for: Receive a user's Nth level access request for the Nth access level, the Nth level access request carrying the Nth level access credential; N is a positive integer greater than or equal to 1; The Nth-level access credential is generated after the N-1th-level access request is successfully verified, and includes a user identifier, an N-1th-level completion credential, and an Nth-level resource set. The Nth level access request is verified based on the Nth level access credential. Upon successful verification of the Nth level access request, an N+1th level access credential is generated. The N+1 level access credential is used to verify the N+1 level access request, including the user identifier, the N level completion credential, and the N+1 level resource set, until the access process ends.

9. An electronic device, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

Images