CN103065074A

CN103065074A - Uniform Resource Locator (URL) authority control method based on fine granularity

Info

Publication number: CN103065074A
Application number: CN2012105445356A
Authority: CN
Inventors: 杨勇
Original assignee: Beijing Si Tech Information Technology Co Ltd
Current assignee: Beijing Si Tech Information Technology Co Ltd
Priority date: 2012-12-14
Filing date: 2012-12-14
Publication date: 2013-04-24
Anticipated expiration: 2032-12-14
Also published as: CN103065074B

Abstract

The invention relates to a Uniform Resource Locator (URL) authority control method based on fine granularity. The URL authority control method includes: step 1 constructing the incidence relation of roles, functional information corresponding to the roles and URLs corresponding to the functional information, and loading the incidence relation to a cache to be stored; step 2 obtaining URL request addresses and login information which are submitted by users and determining the roles of the users according to the login information; step 3 loading the incidence relation in the cache and respectively matching the functional information corresponding to the roles of the users and the functional information corresponding to the URL request addresses; and step 4 accessing pages corresponding to the URL request addresses if the functional information corresponding to the roles of the users is matched with the functional information corresponding to the URL request addresses, otherwise intercepting the URL request addresses. The URL authority control method achieves authority configuration, is strong in extendibility, is applicable to various service authority controls of a portal system, and achieves efficient authority management and complete background authority uniform configuration.

Description

A kind of method of carrying out the URL control of authority based on fine granularity

Technical field

The present invention relates to computer authorizing administrative skill field, particularly relate to and a kind ofly carry out URL(Uniform/Universal Resource Locator, URL(uniform resource locator) based on fine granularity) method of control of authority.

Background technology

Along with the development of telecommunications industry electronic channel, different customer groups requires differentiation increasing to business, and customer group is different, determine the user electronic channel handle professional different.The space of a whole page such as user's login may be individual and home edition, also may be government and enterprise version, and user's authentication mode has the registered user, encoder client, phone number, landline telephone or broadband etc., also have by different password type logins, such as client password, user cipher or random cipher.Therefore, carry out business handling for the different user login system, during the functions such as telephone expenses inquiry, have corresponding business operation restriction, how when doing business operation, to carry out corresponding business operation control for different customer groups, and do not need each all the mode of new business demand business rule by hard coded to be write in the middle of the program, and how to realize fast, safely and steadly that by technological means the research of rights management and configuration are problem demanding prompt solutions.

Summary of the invention

Technical matters to be solved by this invention provides a kind of method of carrying out the URL control of authority based on fine granularity, is used for solving complicated, low, the inadequate security problems of adaptability of right management method that prior art exists.

The technical scheme that the present invention solves the problems of the technologies described above is as follows: a kind of method of carrying out the URL control of authority based on fine granularity comprises:

Step 1 according to predefined permission match rule, is set up the incidence relation between URL corresponding to function information corresponding to role, role and function information, and described incidence relation is loaded into buffer memory preserves;

Step 2 is obtained URL request address and log-on message that the user submits to, and determines user role according to log-on message;

Step 3 loads the incidence relation in the buffer memory, and the coupling function information corresponding with user role reaches the function information corresponding with URL request address coupling respectively;

Step 4 if the function information function information corresponding with the URL request address corresponding to user role is complementary, then accessed the page corresponding to this URL request address, otherwise the URL request address is carried out intercept process.

On the basis of technique scheme, the present invention can also do following improvement.

Further, the role's who sets up in the described step 1 content comprises: role's title, role's code and role's current state.

The content of the function information that the role who further, sets up in the described step 1 is corresponding comprises: function coding, function title, system banner, operational order and function privilege.

Further, the incidence relation of setting up in the described step 1 is stored in the mode of database.

Further, coupling is mated corresponding function information by the filtrator realization corresponding with user role with the URL request address in the described step 3, and the coupling function information corresponding with URL request address coupling is by the filtrator realization corresponding with the URL request.

Further, in the described step 4 URL being asked to carry out intercept process realizes by authority interception controller.

Further, the described authority interception controller output intercept process page.

The invention has the beneficial effects as follows: the present invention has realized the configuration of authority, has used with web and hang down coupling, and the extensibility of authority configuration is stronger, the miscellaneous service control of authority of the gate systems such as electronic channel be can be applicable to, efficient rights management and the complete unified configuration of backstage authority realized.

Description of drawings

Fig. 1 is the schematic flow sheet that carries out the method for URL control of authority based on fine granularity of the present invention;

Fig. 2 is the control of authority sequential chart in the embodiment of the invention two.

Embodiment

Below in conjunction with accompanying drawing principle of the present invention and feature are described, institute gives an actual example and only is used for explaining the present invention, is not be used to limiting scope of the present invention.

As shown in Figure 1, embodiment one is a kind of method of carrying out the URL control of authority based on fine granularity, comprising:

Step 1 according to predefined permission match rule, is set up the incidence relation between URL corresponding to function information corresponding to role, role and function information, and described incidence relation is loaded into buffer memory preserves.

Wherein, the role's of foundation content comprises: role's title, role's code and role's current state; The content of the function information that the role who sets up is corresponding comprises: function coding, function title, system banner, operational order and function privilege.And the final incidence relation of setting up is stored in the mode of database.

Step 2 is obtained URL request address and log-on message that the user submits to, and determines user role according to log-on message.

Step 3 loads the incidence relation in the buffer memory, and the coupling function information corresponding with user role reaches the function information corresponding with the URL request address respectively.Here, coupling is mated corresponding function information by the filtrator realization corresponding with user role with the URL request address, and the coupling function information corresponding with URL request address coupling is by the filtrator realization corresponding with the URL request.

Step 4 if the function information function information corresponding with the URL request address corresponding to user role is complementary, then accessed the page corresponding to this URL request address, otherwise the URL request address is carried out intercept process.Here, request is carried out intercept process by the realization of authority interception controller to URL, and described authority interception controller can be exported the intercept process page.

Embodiment two analyzes and sums up by each business rule of telecommunications is limited, and has designed the system architecture of a cover URL authority models, and this system architecture designs according to web application access characteristics.// * * .action), function (comprising concrete class of service), role mainly be that composition with authority in user's access process is designed to three parts: the url address of user's access (http:.

For system architecture, carry out role definition according to the feature of current system calling party first, the definition element comprises role id, role's title and role's presence.Define function (authority classification) according to identical privilege feature is gathered again, in the typing background system, determine that simultaneously which role can access corresponding function.At last with the URL reference address (being the page) of all functions, as basic data, in entering background system, the function (acquiescence ownership function was sky when everyone can access when the page) of selecting simultaneously this page to belong to.

After putting up system architecture, mainly finish the work of two aspects:

One, authority models design

Around " role ", " function ", " role is corresponding with function ", the incidence relation of " function is corresponding with URL's " these four factors is related with role and URL, corresponding incidence relation is set up according to predefined permission match rule, and the incidence relation of setting up is loaded in the buffer memory.System gives the user with specific role according to the log-on message of user input, then can realize URL access to corresponding role's function privilege according to the incidence relation of setting up, thereby reaches the purpose of control of authority.Particularly: predefine permission match rule, set up role, function, the triangular incidence relation of URL according to pre-permission match rule.Notice, when starting in system, load incidence relation by a cache controller and enter system that form a set, run duration plays a role always in system.

In the design of authority models, it is the most important to set up role, function, the triangular incidence relation of URL, can adopt the mode that need set up corresponding tables of data to carry out association.For example: set up role function mapping table, foreground menu, Role Information table and page URL information table, the structure that these four tables of data are corresponding and field respectively such as table 1 to shown in the table 4.

Table 1, role function mapping table: TD_PTL_ROLE_FUNC

Name	Code
		Role's code	ROLE_ID
Function coding	FUNC_CODE

Table 2, foreground menu: TD_PTL_FUNCCODE

Table 3, Role Information table: TD_PTL_ROLE

Name	Code
		Authorization code	ROLE_ID
Authority name	ROLE_NAME
		State	STATUS
Describe	NOTE

Table 4, page URL information table: TD_PTL_PAGE_INFO

For above-mentioned four tables of data: the foreground menu is related by " ROLE_ID " (role's code) field that " ROLE_ID " (role's code) field and role function mapping table carry out; The role function mapping table is by " FUNC_CODE " (function coding) Related fields of " FUNC_CODE " (function coding) field and foreground menu; The foreground menu is associated with " FUNC_CODE_REL " (function coding of mapping) field of page URL information table by " FUNC_CODE " (function coding) field of menu.

By this a series of incidence relation, " role's code " is mapped with " function coding " the most at last, and " function coding " associates with URL, forms the complete incidence relation from " role's code " to URL.

Two, realize control of authority by loading incidence relation

When system starts feature list corresponding to each role joined buffer memory, the user is according to different login types, the corresponding corresponding feature list of role, role, the corresponding fine-grained URL of feature list that the initialization such as customer type are corresponding, the user accesses corresponding URL, and by corresponding feature list and the role of filter matching, thereby carry out corresponding service authority control.

The flow process of control of authority comprises as shown in Figure 2:

(1) system begins to start;

(2) system starts Java Virtual Machine, load application;

(3) load application basic content and carry out initialization;

(4) the control of authority blocker loads, initialization miscue page during startup;

(5) application initializes reads buffer memory, and is related by multilist, obtains URL and role's corresponding relation, deposits buffer memory in; Obtain simultaneously the relation of URL and its corresponding function coding, deposit buffer memory in;

(6) user initiates the URL request of access;

Whether (7) authority interception controller interception request is done information wherein and to be checked, check function coding corresponding to the URL function coding corresponding with predefined role and mate, if mate then do not tackle, otherwise carries out intercept process.Here, generally first interception is because the user does not login.

The above only is preferred embodiment of the present invention, and is in order to limit the present invention, within the spirit and principles in the present invention not all, any modification of doing, is equal to replacement, improvement etc., all should be included within protection scope of the present invention.

Claims

1. a method of carrying out the control of authority of URL URL(uniform resource locator) based on fine granularity is characterized in that, comprising:

Step 1 according to predefined permission match rule, is set up the incidence relation between URL corresponding to function information corresponding to role, role and function information, and described incidence relation is loaded in the buffer memory preserves;

Step 3 loads the incidence relation in the buffer memory, and the coupling function information corresponding with user role reaches the function information corresponding with the URL request address respectively;

2. method according to claim 1 is characterized in that, the role's who sets up in the described step 1 content comprises: role's title, role's code and role's current state.

3. method according to claim 1 is characterized in that, the content of the function information that the role who sets up in the described step 1 is corresponding comprises: function coding, function title, system banner, operational order and function privilege.

4. method according to claim 1 is characterized in that, the incidence relation of setting up in the described step 1 is stored in the mode of database.

5. method according to claim 1, it is characterized in that, mate the function information corresponding with user role in the described step 3 by the filtrator realization corresponding with user role, the coupling function information corresponding with URL request address coupling is by the filtrator realization corresponding with the URL request.

6. method according to claim 1 is characterized in that, in the described step 4 URL is asked to carry out intercept process and realizes by authority interception controller.

7. method according to claim 6 is characterized in that, the described authority interception controller output intercept process page.