WO2017114210A1

WO2017114210A1 - Apparatus and method for security control of data processing system

Info

Publication number: WO2017114210A1
Application number: PCT/CN2016/110715
Authority: WO
Inventors: 李杨
Original assignee: 阿里巴巴集团控股有限公司; 李杨
Priority date: 2015-12-31
Filing date: 2016-12-19
Publication date: 2017-07-06
Also published as: CN106934300A

Abstract

An apparatus and a method for security control of a data processing system, said apparatus for security control comprising a user permission management module, a vertical permission verification module and a horizontal permission verification module. According to said method for security control, a permission point list acquisition request sent, after a user logs in by means of a user terminal, by a backend server is first received; according to the permission points pre-configured for the user, a corresponding permission point list is returned to the user; and vertical verification and horizontal verification are performed according to tasks to be carried out by the user. The apparatus and method for security control are able to ensure data security by means of segmenting vertical permissions, and isolating horizontal permissions. At the same time, the user terminal operating interface selectively displays operation buttons, according to the current permission of the user, and further verification can be performed at the backend system to ensure the robustness of permission control.

Description

Safety control device and method for data processing system

Technical field

The invention belongs to the technical field of system security, and in particular relates to a security control device and method for a data processing system.

Background technique

With the advent of the era of big data, data has become an important strategic resource for enterprise development. The potential value of data represents the core competitiveness of enterprises to some extent. The data development based on the second generation data warehouse further explored the value of data, and the big data development system came into being. However, as the amount of data continues to increase, the security risks of data will gradually increase. How to ensure data security will become the focus of attention.

The big data development system can help users to easily develop data and shield out processes and concepts that are difficult for users to understand during use. However, due to the logical centralized storage of the user's data by the big data development system, this poses a security risk for the user's data protection. If the security mechanism of the system is not perfect, in the case of malicious attacks by users or improper operation of data, data leakage may occur, resulting in serious data security problems.

The security of data protection requires restrictions on user rights. At present, the implementation of security control for most known big data development systems is to verify whether users have permission to use the system, such as the account password system. The user enters the system by entering an account and performing password verification, and obtains all the usage rights of the system function, and can use any function provided by the system.

However, the security control scheme of the existing big data development system has a single privilege control. Most systems can use the system after being authenticated by user name and password, that is, having all the operations provided by the system, and all the functions provided by the operating system are not specific details. The operation is controlled. There is no permission control for business processes. Once you have obtained the system's usage rights, you can do whatever you want, which brings security risks to some operations. At the same time, the permission control is relatively rigid, and after obtaining the permission, the basic It will not change and it will not be able to control dynamically according to demand.

Summary of the invention

The object of the present invention is to provide a security control device and method for a data processing system, which provides an integrated control scheme for data security in the case of convenient use of the system, and solves the problem of single control of the prior art.

In order to achieve the above object, the technical solution of the present invention is as follows:

A security control device for a data processing system, the data processing system comprising a user terminal, a background server, and a task execution server, wherein the security control device comprises a user rights management module, a vertical rights verification module, and a horizontal authority school. Module, where:

The user rights management module is configured to pre-configure a permission point corresponding to the user, and receive a request for obtaining a permission point list sent by the background server after the user logs in through the user terminal, and return a list of the permission points corresponding to the user according to the pre-configuration;

The vertical right verification module is configured to perform vertical verification according to a task to be performed by the user, and verify whether the permission point corresponding to the task to be executed by the user is consistent with the user permission point pre-configured by the user rights management module, if they are consistent The verification passes, otherwise the verification does not pass;

The horizontal right verification module is configured to perform level verification according to the meta information of the task to be performed by the user, and verify whether the meta information of the task is consistent with the meta information of the task that the user can operate, and if the consistency is met, the verification is passed; otherwise, The verification failed.

Further, the user rights management module is further configured to configure a role corresponding to the user. After receiving the permission point list request sent by the user after the user logs in through the user terminal, the receiving background server returns a corresponding permission point list to the user according to the permission point corresponding to the role pre-configured by the user. Thereby assigning different permissions to different roles, further limiting the data content accessed by the user.

In an implementation manner of the present invention, when the vertical right verification module performs vertical verification according to a task to be performed by the user, the following operations are performed:

Receiving the background server sent after the user selects the task to be performed through the user terminal Vertical verification request;

According to the permission point corresponding to the task to be executed by the user in the vertical verification request, it is verified whether the permission point corresponding to the task to be executed by the user is consistent with the user permission point pre-configured by the user rights management module, and if yes, the verification passes, otherwise The verification failed.

Further, the horizontal rights verification module performs the following operations when performing level verification according to the meta information of the task to be performed by the user:

Receiving a horizontal verification request sent by the background server after learning that the vertical authority verification is successful;

According to the meta-information of the task to be executed by the user in the vertical verification request, it is verified whether the meta-information of the task to be performed by the user is consistent with the meta-information of the task that the user can operate, and if they are consistent, the verification is passed, otherwise the verification fails.

In another implementation manner of the present invention, when the vertical right verification module performs vertical verification according to a task to be performed by the user, the following operations are performed:

Receiving, by the background management server, a task to be performed by the user after the user selects the task to be performed through the user terminal;

Verify that the permission point corresponding to the task to be executed by the user is consistent with the user permission point pre-configured by the user rights management module. If they are consistent, the verification is passed, otherwise the verification fails.

Receiving a task that the vertical permission verification module sends after the vertical authority verification succeeds;

Verify that the meta-information of the task to be performed by the user is consistent with the meta-information of the task that the user can operate. If they are consistent, the verification is passed, otherwise the verification fails.

The present invention also provides a security control method for a data processing system. The data processing system includes a user terminal, a background server, and a task execution server. The security control method includes:

Receiving a request point list request sent by the background server after the user logs in through the user terminal, and returning a corresponding permission point list to the user according to the permission point preconfigured for the user;

Perform a vertical check according to the task to be performed by the user, and verify whether the permission point corresponding to the task to be executed by the user is consistent with the pre-configured user permission point. If they are consistent, the verification is passed, otherwise the verification fails;

The level check is performed according to the meta-information of the task to be performed by the user, and the meta-information of the verification task is consistent with the meta-information of the task that the user can operate. If they are consistent, the verification is passed, otherwise the verification fails.

Further, the pre-configuration further includes configuring a role corresponding to the user, and after receiving the permission point list request sent by the user after the user logs in through the user terminal, the user is configured according to the permission point corresponding to the role pre-configured by the user. Returns a list of corresponding permission points.

According to an implementation manner of the present invention, the vertical verification is performed according to the task to be performed by the user, and whether the permission point corresponding to the task to be executed by the user is consistent with the pre-configured user permission point, and if they are consistent, the verification is passed. Otherwise the verification fails, including:

Receiving a vertical verification request sent by the background server after the user selects the task to be performed through the user terminal;

According to the permission point corresponding to the task to be executed by the user in the vertical verification request, it is verified whether the permission point corresponding to the task to be executed by the user is consistent with the pre-configured user permission point, and if they are consistent, the verification is passed, otherwise the verification fails. .

Further, the level verification is performed according to the meta information of the task to be performed by the user, and the meta information of the verification task is consistent with the meta information of the task that the user can operate. If the information is consistent, the verification is passed, otherwise the verification fails. include:

According to another implementation manner of the present invention, the vertical verification is performed according to the task to be performed by the user, and whether the permission point corresponding to the task to be executed by the user is consistent with the pre-configured user permission point, and if they are consistent, the verification is passed. Otherwise the verification fails, including:

The invention provides a security control device and method for a data processing system. By subdividing vertical rights, a corresponding permission point is defined for each user's possible operation process, so that fine-grained permissions are achieved. Control; control of horizontal permissions, in fact, is to isolate the user's permissions, so that it can not manipulate other people's data, so that users can not succeed in operating other people's data through exhaustive means, ensuring data security The role division of the user is performed, and the rights possessed by each role can be configured, so that the operation authority that a user can have can be flexibly controlled according to the need; the user terminal operation interface of the present invention selectively displays the operation button according to the authority of the current user. Even if the user bypasses the user terminal, the background system will still perform verification to ensure the robustness of the authority control and ensure that the security control is reliable.

DRAWINGS

1 is a connection manner of a security control device according to an embodiment of the present invention;

2 is another connection manner of a security control device according to an embodiment of the present invention;

3 is a schematic structural view of a safety control device according to the present invention;

4 is a flow chart of a security control method of the present invention.

detailed description

The technical solutions of the present invention are further described in detail below with reference to the accompanying drawings and embodiments. The following embodiments are not to be construed as limiting.

Users of big data development systems are often an organization. Different departments within an organization usually create different projects under one organization to complete the corresponding tasks in order to complete data development tasks. Each project represents a collection of work that contains the data, workflow, results, etc. required for the job. There may be multiple tasks under each project, and the task marks a small part of the work, completing a specific work content, such as data extraction, data conversion, and so on.

Since a person in an organization may work in a number of different projects, without the control of user rights, all users in the organization can operate on the data, which may easily lead to leakage or destruction of data and affect data security. In order to solve the data security problem of the big data development system, the present invention realizes security management by controlling the vertical permission of the user, the control of the user's horizontal authority, and the control of the user's role authority. This embodiment is described in detail by taking a big data development system as an example, and is applicable to any data processing system that needs to centrally perform data storage, such as a financial system, an electronic process system, and the like.

Among them, the control of the user's vertical authority: that is, the user's vertical use of the system's permission control, including the login system, whether it has the right to verify the operation of a process. For example: Is there permission to use the system, whether there is permission to operate a certain process, whether there is permission to view the data content, whether there is permission to change the data, and so on. In this embodiment, each operation of the process defines a corresponding permission point, and the permission points that the user can have are configured, so that fine-grained authority control is performed, that is, even if the user logs in to the system, if not The corresponding permission point is also unable to operate on the corresponding process.

User level authority control: that is, the user level uses the system's permission control. For example, if a user has a certain permission for a project, then using this existing permission to operate on another project requires permission control. Ensure that users can only operate on their own data, and can not do anything with other people's data resources, even in the same organization or the same project. Ensure that users only operate under a licensed project. For example: the user only has the use of item one Permissions, then operations on other projects should be rejected, data using the permissions of project one to operate other projects should also be rejected, and so on. In this way, users can only do their own things, and any behavior that attempts to smash data of other users will be rejected, which ensures the security of the data.

User role permission control: In order to facilitate and flexibly control the user's usage rights, the user is divided into system administrators, project administrators, development, operation and maintenance, testing, and visitors. Each role has different permissions. For example, the system administrator role has all the permissions provided by the system, including creating an organization, creating a project, deleting data, data calculations, etc.; the project administrator role has the ability to create projects, delete projects, Modify the permissions of the project team members; the development role has the authority to create data tables, access data, data calculations, view logs, etc.; the operation and maintenance role has the authority to view logs, create applications, delete applications, etc.; test roles have view data, data calculations, etc. Permissions; guest roles only have partial permissions, including viewing data structures, viewing organizational categories, viewing project categories, and more. Each user is assigned a different role, and each role has different permissions, so that through the combination of roles and permissions, you can flexibly control user permissions based on changes in requirements.

The big data development system generally includes a user terminal, a background server, and a task execution server. As shown in FIG. 1 and FIG. 2, the security control device of the embodiment is connected to the background server, or is connected between the background server and the task execution server, and is used for Security control of data based on user permissions.

In this embodiment, a security control device for a data processing system, as shown in FIG. 3, includes a user rights management module, a vertical rights verification module, and a horizontal rights verification module. Described separately as follows:

The user rights management module is configured to pre-configure a permission point corresponding to the user, and receive a request for obtaining a permission point list sent by the background server after the user logs in through the user terminal, and return a list of the permission points corresponding to the user according to the pre-configuration.

The vertical right verification module is configured to perform vertical verification according to the task to be performed by the user, and verify whether the permission point corresponding to the task to be executed by the user is consistent with the user permission point pre-configured by the user rights management module, and if they are consistent, the verification is performed. Pass, otherwise the verification will not pass;

Horizontal authority verification module for leveling according to meta information of tasks to be performed by the user Check whether the meta-information of the verification task is consistent with the meta-information of the task that the user can operate. If they are consistent, the verification is passed, otherwise the verification fails.

Specifically, in the user rights management module, the following configurations may be performed in advance, such as configuration of a user role and configuration of a user permission point, that is, a user name, a user role, and a permission point list are configured in the user rights management module. relationship. Therefore, after the user logs in with the user name and password, for the legitimate user, after the user logs in successfully, the background server sends a request for obtaining a permission point list to the security control device, and the user rights management module sets the pre-configured permission point after receiving the request. The list is returned to the background server, which in turn sends it to the user terminal to display the operation interface on the user terminal. As a client operated by the user, the user terminal has a user login interface, and the user inputs a user name and password through the login interface to log in. After logging in, get a list of permission points that the user has permission to. The permission point list is displayed through the operation interface, and each permission point corresponds to an operation button that the user can operate, that is, a corresponding task option. When the operation interface displays the system function to the user, it is selectively displayed according to the permission point list, and the function without the permission is hidden, and the user cannot see it, so that the first layer is intuitively controlled.

At the same time, one user can correspond to multiple roles, and the permissions of each role can be dynamically changed. The dynamic configuration can flexibly control the permissions of users, thereby satisfying the permission requirements of different users and ensuring the flexibility of system security control. Dynamic configuration of user rights can be done through the portal provided by the User Rights Management module. For example, if you want to remove an execution permission of a user, you can remove the permission point corresponding to the user from the permission configuration management.

As mentioned earlier, user role configuration is to divide the roles of users into system administrators, project administrators, development, operation and maintenance, testing, and visitors. Each role has different permissions. When users log in, Also select your corresponding user role to log in. After receiving the request for obtaining the permission point list, the user rights management module returns the list of the permission points to the background server according to the pre-configured user role of the user.

For example, if the user role of the user 1 is a guest, the user 1 can only obtain a list of the permission points corresponding to the visitor, such as viewing. If the user role of the user is a system administrator, after the user 1 logs in successfully, the user can obtain a list of permission points corresponding to the system administrator, such as editing, deleting, and the like.

For the vertical right verification module and the horizontal authority verification module, since the connection mode of the safety control device is different, the working process is slightly different. The following description is respectively made by the embodiments of FIG. 1 and FIG. 2:

Embodiment 1 As shown in FIG. 1, the security control device is connected to the background server.

The vertical right verification module of the embodiment is configured to receive a vertical verification request sent by the background server after the user selects the task to be performed by the user terminal, and performs verification according to the permission point corresponding to the task to be executed by the user in the vertical verification request. Whether the permission point corresponding to the task to be executed by the user is consistent with the user permission point pre-configured by the user rights management module. If they are consistent, the verification is passed, otherwise the verification fails.

After the user selects a specific operation task according to the displayed permission point list on the user terminal, the user terminal sends the selected task to the background server, and the background server initiates a vertical permission verification request to the vertical right verification module, and the vertical permission verification module After receiving the request, a vertical permission check is required.

The vertical right authority verification in this embodiment compares the user and the tasks performed by the user with the pre-configured tasks corresponding to the user's permission points and permission points. If the vertical authority verification is passed, the task is sent to the task. Execute the control server. Otherwise, the vertical permission check fails, the task request is rejected, and the error message is returned.

It is easy to understand that the vertical permission check is performed after the user selects a specific operation task, and is a further security control when the user performs the task. Even if someone bypasses the user terminal and attempts to access the system data, it will be denied access because it does not have a pre-configured permission point, thus ensuring system data security.

The horizontal privilege check module of the embodiment is configured to receive a horizontal check request sent by the background server after the vertical privilege check succeeds, and verify the user to perform according to the meta information of the task to be executed by the user in the vertical check request. The meta-information of the task is consistent with the meta-information of the task that the user can operate. If they are consistent, the verification is passed, otherwise the verification fails.

Since there are many projects in an organization, the data of different users operating under the same project is different. In order to prevent users from operating other people's data, this embodiment uses horizontal permission verification to perform security. Full control. After receiving the horizontal verification request, the horizontal permission verification module obviously has passed the vertical permission check, and needs to perform the horizontal permission check further. The horizontal permission check is mainly to verify whether the current user's data of this operation is owned by the user and prevent unauthorized data from being manipulated by others. If the verification fails, the request is rejected and the error message is returned. If the verification is successful, the appropriate task execution server is selected according to the policy, and the task is delivered to the task execution server, and the task execution server is responsible for the specific execution of the task.

When the horizontal authority check is performed, the meta information of the task needs to be extracted, and the meta information of the task is compared with the meta information of the task that the user can operate. If the same, the horizontal check is allowed to pass.

The meta-information of the task is recorded in the database, and the horizontal permission check depends on the meta-information, and the meta-information of the task that the same user can operate is the same. The meta-information of the task includes: the ID of the task (taskId), and the application to which the task belongs (projectId) , the tenant (idantId) to which the application belongs, and the owner (ownerId) of the task.

Embodiment 2 As shown in FIG. 2, the security control device is connected between the background server and the task execution server.

Different from the first embodiment, the security control device of the second embodiment, such as a bayonet, is released for the task that passes the verification, and is rejected for the task that fails the verification.

Therefore, the vertical right authority verification module of the embodiment is configured to receive a task that the background management server forwards after the user selects the task to be executed by the user terminal, and verifies whether the permission point corresponding to the task to be executed by the user is The user permission points pre-configured by the user rights management module are consistent. If they are consistent, the verification is passed, otherwise the verification fails.

Similarly, the horizontal right authority verification module of the embodiment is configured to receive a task to be executed by the vertical identity verification module after the vertical authority verification succeeds, and verify the meta information of the task to be performed by the user and the user can operate. Whether the meta-information of the task is consistent, if it is consistent, the verification is passed, otherwise the verification fails.

It can be seen that the background server directly forwards the tasks to be performed by the user, and the vertical permission verification module and the horizontal permission verification module perform vertical authority verification and horizontal authority verification according to the tasks to be performed by the user respectively, and the user is to perform the verification after the verification is passed. Task sent to task execution server Processing, otherwise the task is rejected.

As shown in FIG. 4, this embodiment further provides a security control method for a data processing system, where the security control method includes:

The pre-configuration of the embodiment further includes: configuring the role corresponding to the user, and then receiving the corresponding permission point list sent by the user after the user logs in through the user terminal, and returning the corresponding information to the user according to the permission point corresponding to the role pre-configured by the user. A list of permission points.

According to the two connection modes of FIG. 1 and FIG. 2, the security control method of this embodiment also has the following two embodiments:

Embodiment 3 As shown in FIG. 1, the security control device is connected to the background server.

According to the task to be performed by the user, the vertical check is performed to verify whether the permission point corresponding to the task to be executed by the user is consistent with the pre-configured user permission point. If the check is the same, the verification fails. Otherwise, the verification fails.

Then, according to the meta information of the task to be performed by the user, the level check is performed, and the letter of the task is verified. Whether the information is consistent with the meta-information of the task that the user can operate. If they are consistent, the verification is passed, otherwise the verification fails, including:

Embodiment 4 As shown in FIG. 2, the security control device is connected between the background server and the task execution server.

Then, according to the meta-information of the task to be performed by the user, the level information is verified, and the meta-information of the task is consistent with the meta-information of the task that the user can operate. If the information is consistent, the verification is passed, otherwise the verification fails, including:

The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to be limiting, and those skilled in the art can make various corresponding changes according to the present invention and without departing from the spirit and scope of the present invention. Modifications, but such corresponding changes and modifications are intended to be included within the scope of the appended claims.

Claims

A security control device for a data processing system, the data processing system comprising a user terminal, a background server, and a task execution server, wherein the security control device comprises a user rights management module, a vertical rights verification module, and a horizontal authority school. Module, where:

The user rights management module is configured to pre-configure a permission point corresponding to the user, and receive a request for obtaining a permission point list sent by the background server after the user logs in through the user terminal, and return a list of the permission points corresponding to the user according to the pre-configuration;

The vertical right verification module is configured to perform vertical verification according to a task to be performed by the user, and verify whether the permission point corresponding to the task to be executed by the user is consistent with the user permission point pre-configured by the user rights management module, if they are consistent The verification passes, otherwise the verification does not pass;

The horizontal right verification module is configured to perform level verification according to the meta information of the task to be performed by the user, and verify whether the meta information of the task is consistent with the meta information of the task that the user can operate, and if the consistency is met, the verification is passed; otherwise, The verification failed.
The security control device according to claim 1, wherein the user rights management module is further configured to configure a role corresponding to the user.
The security control apparatus according to claim 1, wherein the vertical right verification module performs the following operations when performing vertical verification according to a task to be performed by the user:

Receiving a vertical verification request sent by the background server after the user selects the task to be performed through the user terminal;

According to the permission point corresponding to the task to be executed by the user in the vertical verification request, it is verified whether the permission point corresponding to the task to be executed by the user is consistent with the user permission point pre-configured by the user rights management module, and if yes, the verification passes, otherwise The verification failed.
The security control apparatus according to claim 3, wherein the horizontal authority verification module performs the following operations when performing level verification according to meta information of a task to be performed by the user:

Receiving a horizontal verification request sent by the background server after learning that the vertical authority verification is successful;

According to the meta-information of the task to be executed by the user in the vertical verification request, it is verified whether the meta-information of the task to be performed by the user is consistent with the meta-information of the task that the user can operate, and if they are consistent, the verification is passed, otherwise the verification fails.
The security control apparatus according to claim 1, wherein the vertical right verification module performs the following operations when performing vertical verification according to a task to be performed by the user:

Receiving, by the background management server, a task to be performed by the user after the user selects the task to be performed through the user terminal;

Verify that the permission point corresponding to the task to be executed by the user is consistent with the user permission point pre-configured by the user rights management module. If they are consistent, the verification is passed, otherwise the verification fails.
The security control apparatus according to claim 5, wherein the horizontal authority verification module performs the following operations when performing level verification according to meta information of a task to be performed by the user:

Receiving a task that the vertical permission verification module sends after the vertical authority verification succeeds;

Verify that the meta-information of the task to be performed by the user is consistent with the meta-information of the task that the user can operate. If they are consistent, the verification is passed, otherwise the verification fails.
A security control method for a data processing system, the data processing system includes a user terminal, a background server, and a task execution server, wherein the security control method includes:

Receiving a request point list request sent by the background server after the user logs in through the user terminal, and returning a corresponding permission point list to the user according to the permission point preconfigured for the user;

Perform a vertical check according to the task to be performed by the user, and verify whether the permission point corresponding to the task to be executed by the user is consistent with the pre-configured user permission point. If they are consistent, the verification is passed, otherwise the verification fails;

Perform level verification according to the meta-information of the task to be performed by the user, and verify whether the meta-information of the task is consistent with the meta-information of the task that the user can operate. If they are consistent, the verification is passed, otherwise the school is The test will not pass.
The security control method according to claim 7, wherein the pre-configuration further comprises: configuring a role corresponding to the user, and then receiving, after receiving the permission point list request sent by the user after the user logs in through the user terminal, The permission point corresponding to the pre-configured role of the user returns a corresponding permission point list to the user.
The security control method according to claim 7, wherein the vertical verification is performed according to a task to be performed by the user, and whether the permission point corresponding to the task to be executed by the user is consistent with the pre-configured user permission point. If they are consistent, the verification is passed, otherwise the verification fails, including:

Receiving a vertical verification request sent by the background server after the user selects the task to be performed through the user terminal;

According to the permission point corresponding to the task to be executed by the user in the vertical verification request, it is verified whether the permission point corresponding to the task to be executed by the user is consistent with the pre-configured user permission point, and if they are consistent, the verification is passed, otherwise the verification fails. .
The security control method according to claim 9, wherein the level verification is performed according to the meta information of the task to be executed by the user, and whether the meta information of the task is consistent with the meta information of the task that the user can operate, if If the check is consistent, the check is passed, otherwise the check fails, including:

Receiving a horizontal verification request sent by the background server after learning that the vertical authority verification is successful;

According to the meta-information of the task to be executed by the user in the vertical verification request, it is verified whether the meta-information of the task to be performed by the user is consistent with the meta-information of the task that the user can operate, and if they are consistent, the verification is passed, otherwise the verification fails.
The security control method according to claim 7, wherein the vertical verification is performed according to a task to be performed by the user, and whether the permission point corresponding to the task to be executed by the user is consistent with the pre-configured user permission point. If they are consistent, the verification is passed, otherwise the verification fails, including:

Receiving the background management server after the user selects the task to be performed through the user terminal The task to be performed by the user;

Verify that the permission point corresponding to the task to be executed by the user is consistent with the user permission point pre-configured by the user rights management module. If they are consistent, the verification is passed, otherwise the verification fails.
The security control method according to claim 11, wherein the level verification is performed according to the meta information of the task to be executed by the user, and whether the meta information of the task is consistent with the meta information of the task that the user can operate, if If the check is consistent, the check is passed, otherwise the check fails, including:

Receiving a task that the vertical permission verification module sends after the vertical authority verification succeeds;

Verify that the meta-information of the task to be performed by the user is consistent with the meta-information of the task that the user can operate. If they are consistent, the verification is passed, otherwise the verification fails.