WO2018133721A1 - 鉴权系统、方法及服务器 - Google Patents

鉴权系统、方法及服务器 Download PDF

Info

Publication number
WO2018133721A1
WO2018133721A1 PCT/CN2018/072119 CN2018072119W WO2018133721A1 WO 2018133721 A1 WO2018133721 A1 WO 2018133721A1 CN 2018072119 W CN2018072119 W CN 2018072119W WO 2018133721 A1 WO2018133721 A1 WO 2018133721A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
server
target
service
service access
Prior art date
Application number
PCT/CN2018/072119
Other languages
English (en)
French (fr)
Inventor
袁哲
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2018133721A1 publication Critical patent/WO2018133721A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
    • G06F11/202—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication

Definitions

  • the embodiments of the present application relate to the field of information security technologies, and in particular, to an authentication system, method, and server.
  • Authentication refers to verifying that a user has some kind of permission.
  • An authentication system refers to a system for providing an authentication service to implement authentication of user operations.
  • FIG. 1 shows a schematic diagram of an authentication system provided by the prior art.
  • the authentication system includes a service access layer 11, an authentication logic layer 12, and a data storage layer 13.
  • the service access layer 11 is configured to provide an authentication interface to the service provider, and the service provider sends an authentication request to the service access layer 11 by calling the authentication interface.
  • the service access layer 11 may include a plurality of service access servers 11a.
  • the service access layer 11 is also used to forward the authentication request to the authentication logic layer 12.
  • the authentication logic layer 12 includes a plurality of authentication logic servers 12a, each of which has a function of processing an authentication request sent by each service access server 11a.
  • the data storage layer 13 is implemented in a distributed database to avoid a large amount of database access operations putting great pressure on the same database.
  • the data storage layer 13 includes a master database 13a and a plurality of slave databases 13b.
  • the master database 13a stores authorization policies, and each slave database 13b synchronizes authorization policies from the master database 13a.
  • the authentication logic server 12a After receiving the authentication request, the authentication logic server 12a reads the authorization policy related to the authentication request from the database 13b connected thereto, and then analyzes and processes the authentication request according to the read authorization policy. The result of the right.
  • the number of authentication logic servers 12a in the authentication logic layer 12 can be increased as needed to avoid a large number of authentication requests being processed by the same server.
  • the number of slave databases 13b in the data storage layer 13 can also be increased as needed to avoid a large amount of database access operations putting tremendous pressure on the same database.
  • each server and database included in the authentication system are deployed in the same equipment room.
  • the equipment room fails, the entire authentication system cannot provide the authentication service.
  • the service provider accesses the authentication system to request the authentication service, the access delay is large and the communication link stability is low, so that the availability of the authentication system cannot be guaranteed.
  • the embodiment of the present application provides an authentication system, a method, and a server.
  • the technical solution is as follows:
  • the first aspect provides an authentication system, where the authentication system includes: a service access layer, an authentication logic layer, and a data storage layer, where the service access layer includes at least two service access servers,
  • the authentication logic layer includes at least two authentication logic servers, the data storage layer including a primary database and at least two secondary databases; wherein the at least two service access servers, the at least two authentication logical servers, and The at least two slave databases are deployed across regions;
  • the target service access server in the service access layer is configured to receive an authentication request sent by the service provider, where the service provider is located in the same area as the target service access server, or the service Providing, by the provider, that the service access server is located in a different area from the target service access server and the service provider is located; sending the authentication request to the target authentication logic server in the authentication logic layer ;
  • the target authentication logic server is configured to obtain, from the target, an authorization policy related to the authentication request, where the target is used by the database to store an authorization policy related to the service provided by the service provider;
  • the authorization policy related to the authentication request analyzes and processes the authentication request to obtain an authentication result; and sends the authentication result to the target service access server;
  • the target service access server is further configured to send the authentication result to the service provider.
  • an authentication method is provided, where the authentication method is applied to an authentication system, where the authentication system includes: a service access layer, an authentication logic layer, and a data storage layer, where the service access The layer includes at least two service access servers, the authentication logic layer includes a plurality of at least two authentication logic servers, the data storage layer includes a primary database and at least two secondary databases; wherein the at least two services The access server, the at least two authentication logic servers, and the at least two slave databases are deployed across a geographic area;
  • the authentication method includes:
  • the target service access server in the service access layer receives an authentication request sent by the service provider, where the service provider is located in the same area as the target service access server, or the service provider and the service provider The service access server is located in a different area and the service access server in the area where the service provider is located is unavailable; and the authentication request is sent to the target authentication logic server in the authentication logic layer;
  • the authorization request related to the authentication request analyzes and processes the authentication request to obtain an authentication result; and sends the authentication result to the target service access server;
  • the target service access server sends the authentication result to the service provider.
  • an authentication method is provided, where the authentication method is applied to a target service access server in an authentication system, where the authentication system includes: a service access layer, an authentication logic layer, and a data storage.
  • the service access layer includes at least two service access servers
  • the authentication logic layer includes at least two authentication logic servers
  • the data storage layer includes a primary database and at least two secondary databases; Dedicating at least two service access servers, the at least two authentication logic servers, and the at least two slave databases are deployed across a geographic area;
  • the authentication method includes:
  • the target authentication logic server is configured to obtain an authorization policy related to the authentication request from a target from a database, the target An authentication policy related to the service provided by the service provider is stored in the database, and the authentication request is analyzed and processed according to an authorization policy related to the authentication request, to obtain an authentication result;
  • a server is provided, where the server is a target service access server in an authentication system, and the authentication system includes: a service access layer, an authentication logic layer, and a data storage layer, where the service is connected.
  • the ingress layer includes at least two service access servers, the authentication logic layer includes at least two authentication logic servers, the data storage layer includes a primary database and at least two secondary databases; wherein the at least two service connections
  • the server, the at least two authentication logic servers, and the at least two slave databases are deployed across a geographic area;
  • the server includes:
  • a request receiving module configured to receive an authentication request sent by a service provider, where the service provider is located in the same area as the target service access server, or the service provider and the target service access server Service access servers located in different areas and in the geographical location of the service provider are not available;
  • a request sending module configured to send the authentication request to a target authentication logic server in the authentication logic layer;
  • the target authentication logic server is configured to obtain, from the target, a database related to the authentication request An authorization policy, the target is used by the database to store an authorization policy related to the service provided by the service provider, and the target authentication logic server is further configured to use the authorization policy according to the authorization policy related to the authentication request Perform analysis and processing to obtain an authentication result;
  • a result receiving module configured to receive the authentication result sent by the target authentication logic server
  • a result sending module configured to send the authentication result to the service provider.
  • a server is provided, where the server is a target service access server in an authentication system, and the authentication system includes: a service access layer, an authentication logic layer, and a data storage layer, where the service is connected.
  • the ingress layer includes at least two service access servers, the authentication logic layer includes at least two authentication logic servers, the data storage layer includes a primary database and at least two secondary databases; wherein the at least two service connections
  • the server, the at least two authentication logic servers, and the at least two slave databases are deployed across a geographic area;
  • the server includes:
  • One or more processors are One or more processors; and,
  • the memory stores one or more programs, the one or more programs being configured to be executed by the one or more processors, the one or more programs including instructions for performing the following operations:
  • the target authentication logic server is configured to obtain an authorization policy related to the authentication request from a target from a database, the target An authentication policy related to the service provided by the service provider is stored in the database, and the authentication request is analyzed and processed according to an authorization policy related to the authentication request, to obtain an authentication result;
  • a computer readable storage medium having stored thereon a computer program executable by a processor and implementing the authentication method described above.
  • Each layer in the authentication system adopts a distributed deployment method across regions, and each layer supports on-demand increase and decrease and cross-regional deployment and invocation.
  • each layer supports on-demand increase and decrease and cross-regional deployment and invocation.
  • the server or database in the equipment room of a certain area fails, the servers and databases in the equipment room in other areas are still available, effectively solving the problem that the entire authentication system cannot provide the authentication service due to a failure of one equipment room.
  • cross-regional deployment can effectively solve the problems of remote access, improve the availability of the authentication system, and reduce the access delay, thereby improving the overall authentication service quality.
  • FIG. 1 is a schematic diagram of an authentication system provided by the prior art
  • FIG. 2 is a schematic diagram of an authentication system provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of an authentication system provided by another embodiment of the present application.
  • FIG. 4 is a schematic diagram of a data synchronization process provided by an embodiment of the present application.
  • FIG. 5 is a flowchart of an authentication method provided by an embodiment of the present application.
  • FIG. 6 is a flowchart of an authentication method provided by another embodiment of the present application.
  • FIG. 7 is a flowchart of a data synchronization method provided by an embodiment of the present application.
  • FIG. 9 is a block diagram of a server provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a server according to an embodiment of the present application.
  • Authorization is to give a user some kind of permission.
  • the service provider grants the user permission to perform an operation
  • the service provider grants the user access to a resource
  • the service provider grants the user permission to perform an operation on a resource.
  • service providers can help service providers securely control their users' access to their resources. For example, control which users can access resources, and control which resources these users can access and how they are accessed. Among them, access methods include reading, writing, and modifying.
  • Authentication refers to verifying that a user has some kind of permission.
  • the user is authenticated based on the permissions granted to the user.
  • the user is authenticated, and the user is allowed to perform the requested operation only if the authentication is passed. For example, the user requests access to a certain resource, determines the authority that the user already has according to the authorization status of the user, and determines whether the user has the right to access the resource. If yes, the authentication is passed.
  • the authentication system provided by the embodiment of the present application is applicable to any system that needs to provide an authentication service.
  • cloud service systems can provide many different services such as computing, storage, downloading, and security.
  • the cloud service system needs to authenticate the user, and allows the user to perform the operation requested by the user if the authentication is passed.
  • the authentication system provided by the embodiment of the present application can be deployed in the cloud service system, and the user is authenticated by the authentication system.
  • each server and database included in the authentication system is deployed in a distributed manner, and is deployed across regions.
  • the servers and databases in the equipment room in other areas are still available, effectively solving the problem that the entire authentication system cannot provide the authentication service due to a failure of one equipment room.
  • cross-regional deployment can effectively solve the problems of remote access, improve the availability of the authentication system, and reduce the access delay, thereby improving the overall authentication service quality.
  • FIG. 2 shows a schematic diagram of an authentication system provided by an embodiment of the present application.
  • the authentication system includes a service access layer 21, an authentication logic layer 22, and a data storage layer 23.
  • each layer adopts a distributed deployment manner across regions, and each layer supports on-demand increase and decrease and cross-regional deployment and calling.
  • the service access layer 21 is configured to provide an authentication interface to the service provider, and the service provider sends an authentication request to the service access layer 21 by calling the authentication interface.
  • a service provider is a device or system that points to a user's business.
  • the authentication system may establish a connection with a service provider to provide an authentication service for the service provider. Alternatively, the authentication system may establish a connection with multiple service providers to provide authentication services for the multiple service providers.
  • the authentication service is provided by the authentication system for the cloud service system introduced above.
  • the cloud service system may include a cloud computing subsystem, a cloud storage subsystem, a cloud download subsystem, and a cloud security subsystem.
  • Each subsystem is used to provide multiple different services such as computing, storage, download, and security.
  • the devices used to provide services to users in each subsystem may adopt a distributed deployment method across regions. When any one of the subsystems receives the operation request of the user, the device sends an authentication request to the service access layer 11 by calling the authentication interface provided by the service access layer 21.
  • the authentication request is used to request authentication of the user operation.
  • the authentication request includes a user identifier, and the user identifier is used to uniquely identify the user identity, and different users correspond to different user identifiers.
  • the authentication request also includes operational information and/or resource information.
  • the operation information is used to indicate the operation requested by the user.
  • the resource information is used to indicate the resource that the user requested to access. In an example, if the authentication request includes the user identifier “123”, the operation information “read”, and the resource information “abc”, the authentication request is used to request whether the user whose user identifier is “123” has read. Permissions for the "abc" resource.
  • the service access layer 21 is deployed in a distributed manner.
  • the service access layer 21 includes a plurality of service access servers 21a.
  • the plurality of service access servers 21a are deployed across regions, and at least one service access server 21a is deployed in each region.
  • the service access server 21a is configured to provide an authentication interface to the service provider.
  • the authentication logic layer 22 is configured to receive an authentication request from the service access layer 21, and process the authentication request by executing the authentication logic to complete the authentication operation.
  • the authentication logic layer 22 adopts a distributed deployment mode.
  • the authentication logic layer 22 includes a plurality of authentication logic servers 22a.
  • the plurality of authentication logic servers 22a are deployed across regions, and at least one authentication logic server 22a is deployed in each region.
  • each of the authentication logic layers 22a is configured to process authentication requests associated with respective services.
  • Each of the above services refers to various services provided by the system accessed by the authentication system.
  • At least one authentication logic server 22a in the authentication logic layer 22 is configured to process an authentication request related to a first service, where the first service refers to a service volume greater than a preset.
  • the service of the threshold; and the at least one authentication logic server 22a of the authentication logic layer 22 is configured to process the authentication request related to the plurality of second services, where the second service refers to the service whose traffic is less than a preset threshold .
  • the preset threshold may be set according to the processing capability of the authentication logic server 22a and the traffic volume of each service.
  • An authentication request related to a certain service refers to an authentication request sent by a service provider for providing the service.
  • the authentication request related to the cloud computing service refers to an authentication request sent by the device in the cloud computing subsystem
  • the authentication request related to the cloud storage service refers to the cloud storage device.
  • the services have a cross-effect.
  • the services with a large amount of access will occupy a large amount of processing resources of the authentication logical server 22a, resulting in other services.
  • Authentication performance is affected.
  • a separate authentication logic server 22a is used to process the related authentication request; for a service with a small amount of access, the multiplexing authentication logic server 22a processes the relevant The authentication request, in order to achieve the purpose of separation of light and heavy business, to avoid cross-effects between businesses.
  • the authentication logic server 22a in the authentication logic layer 22 is deployed in the second possible implementation manner described above, for a certain area, if the system served by the authentication system provides the target service in the area, then The authentication logic server 22a for processing the authentication request related to the target service is deployed geographically, and the authentication logic server 22a for processing the authentication request related to other services than the target service may not need to be deployed in the area.
  • the cloud service system provides cloud computing services, cloud storage services, cloud download services, and cloud security services in the area 1.
  • the cloud service system provides only cloud computing services in the area 2, assuming that the first authentication logical server is used for processing and cloud computing.
  • the second authentication logic server is configured to process an authentication request related to the cloud storage and the cloud download service
  • the third authentication logic server is configured to process an authentication request related to the cloud security service
  • the data storage layer 23 is used to provide an authorization policy to the authentication logic layer 22.
  • the authorization policy is used to indicate the permissions granted to the user.
  • the authorization policy includes a user identity, and the authorization policy also includes operation information and/or resource information.
  • the authorization policy indicates that the user whose user ID is "001" has the right to read all resources.
  • the authorization policy includes the user identifier “002” and the resource information “abc”
  • the authorization policy indicates that the user with the user identifier “002” has access rights to the “abc” resource, including reading and writing. Enter, modify and other operational permissions.
  • the authorization policy includes the user identifier "003", the operation information "read”, and the resource information "abc”, the user indicating that the user identifier is "123" has the right to read the "abc” resource.
  • the data storage layer 23 includes a main database 23a and a plurality of slave databases 23b.
  • the number of primary databases 23a may be one.
  • the plurality of slave databases 23b adopt a distributed deployment manner, and the plurality of slave databases 23b are deployed across regions, and at least one slave database 23b is deployed in each region.
  • the primary database 23a stores an authorization policy related to each service provided by the system served by the authentication system, that is, the primary database 23a stores the processing with each authentication logical server 22a.
  • Business-related authorization strategy The respective slave databases 23b synchronize the authorization policies from the master database 23a, that is, the authorization policies stored in the respective slave databases 23b are identical to the authorization policies stored in the master database 23a.
  • the primary database 23a stores an authorization policy related to each service provided by the system served by the authentication system, that is, the primary database 23a stores the processing processed by each authentication logical server 22a.
  • Business-related authorization strategy Each authentication logical server 22a corresponds to a slave database 23b, and an slave database 23b stores an authorization policy related to the service processed by the corresponding authentication logic server 22a.
  • the authorization logic server 22a stores the authorization policy related to the service A in the slave database 23b.
  • an authentication logic server 22a is configured to process the authentication request related to the service B and the service C
  • the authorization logic server 22a stores the authorization policy related to the service B and the service C in the slave database 23b.
  • the authentication logic server 22a can preferentially obtain the authorization policy related to the service it processes from the corresponding database 23b, which helps to improve the efficiency of obtaining the authorization policy.
  • the service access layer includes a service access server A and a service access server B, and the service access server A and the service access server B are deployed in the area 1 and the area 2, respectively.
  • the service access server A is mainly used to process the authentication request initiated by the service provider in the area 1.
  • the service access server B is mainly used to process the authentication request initiated by the service provider in the area 2.
  • the authentication logic layer includes the authentication logic server A, the authentication logic server B, and the authentication logic server C.
  • the authentication logic server A and the authentication logic server B are deployed in the area 1, and the authentication logic server C is deployed in the area 2. .
  • the authentication logic server A is configured to process an authentication request related to the service A
  • the authentication logic server B is configured to process the authentication request related to the service B and the service C
  • the authentication logic server C is configured to process the service A related to the service A.
  • the data storage layer includes a primary database, a secondary database A, a secondary database, and a secondary database C, and a database A and a secondary database are deployed in the region 1 and the database C is deployed in the region 2.
  • the database A and the authentication logic server A are correspondingly deployed for storing the authorization policy related to the service A; and the database B and the authentication logic server B are correspondingly deployed for storing the authorization policies related to the service B and the service C; The database C and the authentication logic server C are correspondingly deployed for storing the authorization policy related to the service A.
  • the primary database stores authorization policies related to Service A, Service B, and Service C.
  • the area where the primary database is deployed is not limited, and may be deployed in the same area as any of the slave databases, or may be deployed in an area different from the area deployed by each slave database.
  • the target service access server in the service access layer 21 receives the authentication request of the service provider, and the processing flow of processing the authentication request is taken as an example.
  • the target service access server is denoted by reference numeral 21a1. It can be understood that the target service access server 21a1 can be any one of the service access layers 21 of the service access layer 21.
  • the target service access server 21a1 is configured to receive an authentication request sent by the service provider.
  • the authentication system provides an authentication service for the cloud service system.
  • the service provider is a device in the cloud storage system that provides the cloud storage service.
  • the target user requests the device to read the device.
  • the device When the "xxx" resource in the cloud storage subsystem is taken, the device generates an authentication request, where the authentication request includes the user identifier of the target user (assumed to be 123), the operation information "read”, and the resource information "xxx", the device An authentication request is sent to the target service access server 21a1.
  • the service access server 21a located in the same area as the service provider is preferentially selected as the target service access server 21a1, and the target service is delivered to the target service.
  • the access server 21a1 transmits an authentication request. If the service access server 21a in the same geographical area as the service provider is unavailable (for example, a failure occurs), the service provider selects the service access server 21a of the other area as the target service access server 21a1 and connects to the target service access server. 21a1 sends an authentication request. That is, the service provider is located in the same area as the target service access server 21a1, or the service provider and the target service access server 21a1 are located in different regions and the service access server 21a in the region where the service provider is located is unavailable.
  • the target service access server 21a1 is further configured to send an authentication request to the target authentication logic server in the authentication logic layer 22.
  • the target authentication logic server is labeled with the number 22a1.
  • the target authentication logic server 22a1 is an authentication logic server deployed in the same area as the target service access server 21a1. By selecting the nearest authentication logic server to process the authentication request, the data transmission delay can be reduced. Of course, the cross-regional call is also supported between the service access layer 21 and the authentication logic layer 22. If the authentication logic server deployed in the same area as the target service access server 21a1 is unavailable, the authentication logic server of the other area may be selected as the target authentication logic server 22a1.
  • the target service access server 21a1 is specifically configured to: according to the quality of service of each authentication logic server 22a, select the authentication logic server 22a with the best quality of service as the target authentication logic server 22a1; An authentication request is sent to the target authentication logic server 22a1.
  • the quality of service of each authentication logic server 22a may be determined according to at least one of the following parameters: the traffic volume of the authentication logic server 22a, the connectivity rate between the authentication logic server 22a and the target service access server 21a1, and the authentication. The processing efficiency of the logical server 22a, and the like.
  • the target service access server 21a1 is specifically configured to: according to each authentication logical server when selecting the target authentication logical server 22a1
  • the quality of service of 22a from the authentication logic server 22a for processing the authentication request related to the service provided by the service provider, selects the authentication logic server 22a having the highest quality of service as the target authentication logic server 22a1.
  • the service provider is a cloud storage subsystem
  • the service provided by the cloud storage service is a cloud storage service
  • the target service access server 21a1 selects the quality of service from the authentication logic server 22a for processing the authentication request related to the cloud storage service.
  • the optimal authentication logic server 22a serves as the target authentication logic server 22a1.
  • the service access server B after receiving the authentication request, preferentially sends an authentication request to the authentication logic server C, and the authentication request is sent to the authentication logic server C for processing, if the authentication is performed. If the logical server C is unavailable due to the failure, the service access server B may call the authentication logical server A across the area, and send the authentication request to the authentication logical server A for processing.
  • the target authentication logic server 22a1 is configured to obtain an authorization policy related to the authentication request from the target from the database after receiving the authentication request.
  • the target is labeled from the database by reference numeral 23b1.
  • the target slave database 23b1 is used to store an authorization policy related to the service provided by the service provider.
  • the target slave database 23b1 is a slave database deployed in the same region as the target authentication logic server 22a1, and the efficiency of obtaining the authorization policy can be improved by reading the authorization policy from the nearest slave database.
  • the cross-regional call is also supported between the authentication logic layer 22 and the data storage layer 23. If the slave database deployed in the same area as the target authentication logic server 22a1 is not available, the slave database of the other region may be selected as the target slave database 23b1.
  • the target secondary database 23b1 is a secondary database deployed corresponding to the target authentication logical server 22a1.
  • the target authentication logic server 22a1 can read the authorization policy related to the target user from the target database 23b1 according to the user identifier of the target user carried in the authentication request, and use the authorization policies related to the target user as authentication and authentication. Request the relevant authorization policy. These authorization policies related to the target user record the permissions that the target user already has.
  • each authentication logical server 22a correspondingly deploys a secondary database 23b
  • the target authentication logical server 22a1 selects the eligible conditions from other secondary databases.
  • the slave database as the target slave database 23b1 the above-mentioned eligible slave database refers to the slave database in which the authorization policy related to the service processed by the target authentication logical server 22a1 is stored. If there is no eligible slave database in the other slave database, the target authentication logic server 22a1 may select a slave database as the target slave database 23b1 and obtain the authorization associated with the authentication request from the master database 23a from the database 23b1 through the target. Strategy.
  • the target authentication logic server 22a1 is further configured to analyze and process the authentication request according to the authorization policy related to the authentication request, to obtain an authentication result.
  • the target authentication logic server 22a1 verifies whether the target user has the authority to perform the requested operation based on the authority that the target user already has. For example, comparing the rights already possessed by the target user with the rights requested by the target user, if the target user already has the rights that include the requested rights, the description is provided; otherwise, if the target user already has the rights that are not included in the target user The requested permission indicates that it is not available. If yes, the authentication result is determined to be passed; if not, the authentication result is determined to be unsuccessful.
  • the target authentication logic server 22a1 is further configured to send an authentication result to the target service access server 21a1.
  • the target service access server 21a1 is further configured to send an authentication result to the service provider. After receiving the authentication result, the service provider can determine whether to allow the target user to perform the requested operation according to the authentication result. If the authentication result is a pass, the service provider allows the target user to perform the operation it requested; if the authentication result is fail, the service provider does not allow the target user to perform the operation it requested.
  • the target service access server 21a1 is further configured to: after receiving the authentication request, determine whether the authentication result corresponding to the authentication request is stored in the cache of the target service access server 21a1; if the authentication is stored Requesting the corresponding authentication result, obtaining the authentication result corresponding to the authentication request from the cache, and performing the step of sending the authentication result to the service provider; if the authentication result corresponding to the authentication request is not stored, performing the authentication The step of the target authentication logic server 22a1 in the right logical layer transmitting an authentication request.
  • the service access server 21a caches the authentication result corresponding to the authentication request. After receiving the authentication request, the service access server 21a first determines whether the authentication result corresponding to the authentication request has been stored in the local cache. If the authentication result corresponding to the authentication request has been stored, the authentication result is directly obtained. And feedback to the service provider, the authentication request is not sent to the authentication logic layer 22 for processing, the response efficiency is improved, and the request processing amount of the authentication logic layer 22 is reduced.
  • the authentication result cached in the target service access server 21a1 of the service access layer 21 is the authentication result obtained by processing the authentication request through the authentication logic layer 22.
  • the target service access server 21a1 receives the authentication request again.
  • the corresponding authentication result can be obtained directly from the cache without being repeatedly processed by the authentication logic layer 22.
  • the time for the authentication result to be cached in the service access server 21a is not limited, and may be set according to the storage performance of the service access server 21a.
  • the better the storage performance of the service access server 21a is the longer the authentication result is cached in the service access server 21a; otherwise, the worse the storage performance of the service access server 21a is, the authentication result is received in the service.
  • the service access server 21a deletes the authentication result corresponding to the authentication request related to the changed authorization policy in the cache, so as to avoid the update of the authentication result is not timely. The wrong authentication result is fed back to the service provider.
  • the target service access server 21a1 is further configured to: when each of the authentication logic servers 22a is unavailable, analyze and process the authentication request according to the default authorization policy, to obtain an authentication result.
  • the default authorization policy is a general authorization policy that is established for all users.
  • the default authorization policy does not consider the differentiation feature between users, which can be set in combination with user attributes, operation types, and resource types.
  • the default authorization policy can be that all users have permission to read a certain type of resource.
  • the default authorization policy can be that all users have the right to perform certain operations on certain types of resources.
  • the default authorization policy may be that a user who meets certain preset conditions has the right to perform read and modify operations on a certain type of resource.
  • the default authorization policy includes all users having only the right to read the "xxx” resource and not the ability to modify the "xxx” resource. It is assumed that the authentication request received by the target service access server 21a1 is used to request whether the target user has the right to read the "xxx” resource, and the target service access server 21a1 preferentially sends the authentication request to the authentication logic layer 22. If the authentication logic server 22a in the authentication logic layer 22 is unavailable, the target service access server 21a1 obtains the authentication result according to the default authorization policy, that is, the authentication result is passed.
  • the default authorization policy is invalid only in the cache of the service access server 21a1 (such as the authentication result corresponding to the uncached authentication request, or the authentication result corresponding to the authentication request has expired), and the authentication logic layer 22 In the case where each of the authentication logic servers 22a is unavailable, the solution for providing flexible disaster tolerance is implemented by setting a default authorization policy.
  • each layer in the authentication system adopts a distributed deployment manner across regions, and each layer supports on-demand increase and decrease and cross-regional deployment and calling.
  • each layer supports on-demand increase and decrease and cross-regional deployment and calling.
  • the server or database in the equipment room of a certain area fails, the servers and databases in the equipment room in other areas are still available, effectively solving the problem that the entire authentication system cannot provide the authentication service due to a failure of one equipment room.
  • cross-regional deployment can effectively solve the problems of remote access, improve the availability of the authentication system, and reduce the access delay, thereby improving the overall authentication service quality.
  • the response efficiency of the authentication request can be improved, and the request processing amount of the authentication logic layer is reduced. It is possible to avoid the impact of the basic authentication service exception (for example, the authentication logic server of each domain is unavailable), so that the authentication system can provide the authentication service as normal as possible.
  • the basic authentication service exception for example, the authentication logic server of each domain is unavailable
  • a separate authentication logic server is used to process the relevant authentication request; for a service with a small amount of access, the multiplexing authentication logic server processes the relevant authentication request, thereby achieving a separation of light and heavy services.
  • the purpose is to avoid cross-effects between services, so that the service performance of the entire authentication system is guaranteed.
  • the data storage layer includes a primary database server and at least two secondary database servers.
  • the primary database is deployed in the primary database server, and each of the at least one secondary database is deployed from the database server. From the database server adopts the distributed deployment method across regions, at least one slave database server can be deployed in one region.
  • a cross-regional data synchronization scheme is provided to synchronize the authorization policies stored in the primary database to the secondary database.
  • the main database server 41 includes a main database 41a, a log file 41b, a management module 41c, and an IO (Input Output) server 41d.
  • the log file 41b is used to record an operation log corresponding to an update operation performed on data (that is, an authorization policy) stored in the main database 41a.
  • the above update operations include operations such as adding, deleting, and modifying.
  • the update operation to the database can be referred to as SQL (Structured Query Language) operations.
  • the log file 41b can be a binary log file binlog.
  • the management module 41c is for performing an update operation on data stored in the main database 41a, and the management module may be referred to as a Manager module.
  • the IO server 41d is for reading the log file 41b and synchronizing the read log file 41b to the IO client.
  • the slave database server 42 includes a slave database 42a, a log file 42b, an execution module 42c, and an IO client 42d.
  • the log file 42b is used to record an operation log corresponding to an update operation performed on data (i.e., an authorization policy) stored in the database 42a.
  • the above update operations include operations such as adding, deleting, and modifying.
  • the log file 42b can be a binary log file binlog.
  • the execution module 42c is used to read and execute SQL operations that are not performed in the log file 42b, and the execution module may be referred to as an SQL executor module.
  • the IO client 41d is for receiving an operation log from the IO server and writing the received operation log to the log file 42b.
  • the primary database server 41 and the secondary database server 42 are deployed in different regions, and the data synchronization process between the primary database server 41 and the secondary database server 42 is described below.
  • the primary database server 41 is for adding an operation log to the log file 41b of the primary database server 41 in accordance with the update operation to the authorization policy stored in the primary database 41a.
  • the log file 41b can be generated by the application layer of the primary database server 41.
  • the management module 41c performs an update operation on the authorization policy stored in the primary database 41a, for example, an authorization policy, and adds an operation log in the log file 41b, the operation log recording the above-described update operation performed.
  • the primary database server 41 is also configured to, for each of the secondary database servers 42, send an operational log of the primary database server 41 that is not synchronized to the secondary database server 42 to the secondary database server 42.
  • the primary database server 41 actively sends an operation log to the secondary database server 42.
  • the primary database server 41 actively synchronizes the log file 41b to the secondary database server 42 after each update of the log file 41b.
  • the operation log is sent to the slave database server 42.
  • the primary database server 41 sends an operational log to the secondary database server 42 upon receiving the update request sent from the database server 42.
  • an update request is periodically sent from the database server 42 to the primary database server 41 for requesting the primary database server 41 to send the log of the log file 41b to the slave database server 42 that is not synchronized to the slave database server 42.
  • the main database server 41 receives the update request, if the confirmation log file 41b has been updated, the log of the log file 41b is not synchronized to the slave database server 42 from the operation log of the database server 42.
  • the primary database server 41 sends the authorization policy that is not synchronized to the secondary database 42a and required from the database 42a in the log file 41b.
  • the slave database server 42 wherein if the authorization policy related to the target service is stored from the database 42, the authorization policy required from the database 42a refers to the authorization policy related to the target service.
  • the IO server 41d transmits the log of the log file 41b to the slave database server 42 that is not synchronized to the slave database server 42.
  • the IO client 42d receives the operation log sent by the IO server 41d and writes the received operation log to the log file 42b.
  • the database server 42 From the database server 42, it is also used to execute an operation log that is not executed from the log file 42b of the database server 42 to update the authorization policy stored in the slave database 42a from the database server 42.
  • the execution module 42c reads the unexecuted operation log from the log file 42b, and executes these unexecuted operation logs to update the authorization policy stored in the database 42a, thereby implementing the authorization policy in the master-slave Synchronization between databases.
  • the database server 42 re-requests the operation log that has not been successfully executed from the primary database server 41, and re-executes.
  • a cross-regional data synchronization scheme is provided to synchronize the authorization policies stored in the primary database to the secondary database.
  • FIG. 5 shows a flowchart of an authentication method provided by an embodiment of the present application.
  • the authentication method is applied to the authentication system provided in the embodiment shown in FIG. 2, and the description of the authentication system is described above, and details are not described herein again.
  • the authentication method can include the following steps.
  • Step 501 The target service access server in the service access layer receives an authentication request sent by the service provider.
  • Step 502 The target service access server sends an authentication request to the target authentication logic server in the authentication logic layer.
  • the target authentication logic server receives the authentication request sent by the target service access server.
  • the target authentication logical server is an authentication logical server deployed in the same area as the target service access server, and the data transmission delay can be reduced by selecting the nearest authentication logical server to process the authentication request.
  • step 502 includes the following sub-steps:
  • the target service access server selects an authentication logical server with the best service quality as the target authentication logical server according to the service quality of each authentication logical server;
  • the target service access server sends an authentication request to the target authentication logical server.
  • the quality of service of each authentication logical server may be determined according to at least one of the following parameters: the service volume of the authentication logical server, the connection rate between the authentication logical server and the target service access server, and the processing of the authentication logical server. Efficiency, and so on.
  • the target service access server selects the target authentication logical server, and specifically includes: according to the service quality of each authentication logical server, The authentication logic server for processing the authentication request related to the service provided by the service provider selects the authentication logic server with the best quality of service as the target authentication logic server.
  • Step 503 The target authentication logic server obtains an authorization policy related to the authentication request from the target from the database.
  • the target slave database is used to store authorization policies related to the services provided by the service provider. Under normal circumstances, the target slave database is a slave database deployed in the same geographical area as the target authentication logic server. By reading the authorization policy from the nearest slave database, the efficiency of obtaining the authorization policy can be improved.
  • the target secondary database is a secondary database deployed corresponding to the target authentication logical server.
  • the target authentication logic server may read the authorization policy related to the target user from the target according to the user identifier of the target user carried in the authentication request, and associate the authorization policies related to the target user with the authentication request. Authorization strategy. These authorization policies related to the target user record the permissions that the target user already has.
  • Step 504 The target authentication logic server analyzes and processes the authentication request according to the authorization policy related to the authentication request, and obtains an authentication result.
  • the target authentication logic server verifies whether the target user has the right to perform the operation requested by the target user according to the rights that the target user already has. If yes, the authentication result is determined to be passed; if not, the authentication result is determined to be unsuccessful.
  • Step 505 The target authentication logic server sends an authentication result to the target service access server.
  • the target service access server receives the authentication result sent by the target authentication logic server.
  • Step 506 The target service access server sends an authentication result to the service provider.
  • the service provider can determine whether to allow the target user to perform the requested operation according to the authentication result. If the authentication result is a pass, the service provider allows the target user to perform the operation it requested; if the authentication result is fail, the service provider does not allow the target user to perform the operation it requested.
  • step 501 further includes the following steps:
  • Step 507 the target service access server determines whether the authentication result corresponding to the authentication request has been stored in the cache of the target service access server; if yes, the following step 508 is performed, and after step 508, the above step 506 is performed; Then, the above step 502 is performed.
  • Step 508 The target service access server obtains an authentication result corresponding to the authentication request from the cache.
  • the service access server caches the authentication result corresponding to the authentication request. After receiving the authentication request, the service access server first determines whether the authentication result corresponding to the authentication request is stored in the local cache. If the authentication result corresponding to the authentication request has been stored, the authentication result is directly obtained. The feedback is sent to the service provider, and the authentication request is not sent to the authentication logic layer for processing, the response efficiency is improved, and the request processing amount of the authentication logic layer is reduced.
  • the time for the authentication result to be cached in the service access server is not limited, and may be set according to the storage performance of the service access server.
  • the service access server deletes the authentication result corresponding to the authentication request related to the changed authorization policy in the cache, so as to avoid the update to the service due to the update of the authentication result. The provider gives incorrect feedback to the authentication result.
  • the method further includes the following steps: when each of the authentication logic servers is unavailable, the target service access server analyzes and processes the authentication request according to the default authorization policy, to obtain an authentication result.
  • the default authorization policy is a general authorization policy that is established for all users.
  • the default authorization policy does not consider the differentiation feature between users, which can be set in combination with user attributes, operation types, and resource types.
  • the default authorization policy can be that all users have permission to read a certain type of resource.
  • the default authorization policy can be that all users have the right to perform certain operations on certain types of resources.
  • the default authorization policy may be that a user who meets certain preset conditions has the right to perform read and modify operations on a certain type of resource.
  • the default authorization policy is invalid only in the cache of the service access server (such as the authentication result corresponding to the uncached authentication request, or the authentication result corresponding to the authentication request has expired), and the authentication logic layer The solution is effective when the authentication servers are unavailable.
  • the default authorization policy is set to provide a flexible disaster recovery solution.
  • each layer in the authentication system adopts a distributed deployment manner across regions, and each layer supports parallel expansion and deployment and calling across regions.
  • each layer supports parallel expansion and deployment and calling across regions.
  • the server or database in the equipment room of a certain area fails, the servers and databases in the equipment room in other areas are still available, effectively solving the problem that the entire authentication system cannot provide the authentication service due to a failure of one equipment room.
  • cross-regional deployment can effectively solve the problems of remote access, improve the availability of the authentication system, and reduce the access delay, thereby improving the overall authentication service quality.
  • the response efficiency of the authentication request can be improved, and the request processing amount of the authentication logic layer is reduced. It is possible to avoid the impact of the basic authentication service exception (for example, the authentication logic server of each domain is unavailable), so that the authentication system can provide the authentication service as normal as possible.
  • the basic authentication service exception for example, the authentication logic server of each domain is unavailable
  • the data storage layer includes a primary database server and at least two secondary database servers.
  • the primary database is deployed in the primary database server, and each of the at least one secondary database is deployed from the database server.
  • a cross-regional data synchronization scheme is provided to synchronize the authorization policies stored in the primary database to the secondary database.
  • the data synchronization method can include the following steps:
  • Step 701 The primary database server adds an operation log to the log file of the primary database server according to the update operation of the authorization policy stored in the primary database.
  • Step 702 For each slave database server, the primary database server sends the log of the primary database server to the slave database server that is not synchronized to the slave database server.
  • Step 703 adding the received operation log from the database server to the log file from the database server.
  • Step 704 executing an operation log that is not executed from the database server's log file from the database server to update the authorization policy stored in the slave database from the database server.
  • FIG. 8 is a flowchart of an authentication method provided by another embodiment of the present application.
  • the authentication method is applied to a target service access server in the authentication system.
  • the target service access server is any service access server in the service access layer.
  • the authentication method can include the following steps.
  • Step 801 Receive an authentication request sent by a service provider.
  • the service provider and the target service access server are located in the same area, or the service provider and the target service access server are located in different regions, and the service access server in the service provider region is unavailable.
  • Step 802 Send an authentication request to a target authentication logic server in the authentication logic layer.
  • the target authentication logic server is configured to obtain an authorization policy related to the authentication request from the database, and the target from the database is used to store an authorization policy related to the service provided by the service provider.
  • the target authentication logic server is further configured to analyze and process the authentication request according to the authorization policy related to the authentication request, to obtain an authentication result.
  • Step 803 Receive an authentication result sent by the target authentication logic server.
  • Step 804 sending an authentication result to the service provider.
  • the method further includes: determining, by the target service access server, whether the authentication result corresponding to the authentication request is stored in the cache of the target service access server; if yes, obtaining the authentication result corresponding to the authentication request from the cache, and executing Step 804; if no, step 802 is performed.
  • the method further includes: when each authentication logic server is unavailable, analyzing and processing the authentication request according to the default authorization policy, and obtaining an authentication result; wherein, the default authorization policy is a pointer defined for all users.
  • a general authorization strategy when each authentication logic server is unavailable, analyzing and processing the authentication request according to the default authorization policy, and obtaining an authentication result; wherein, the default authorization policy is a pointer defined for all users.
  • step 802 includes the following sub-steps:
  • Step 802a selecting, according to the service quality of each authentication logical server, an authentication logic server with the best quality of service as the target authentication logic server;
  • Step 802b sending an authentication request to the target authentication logic server.
  • FIG. 9 shows a block diagram of a server provided by an embodiment of the present application.
  • the server is a target service access server in the authentication system.
  • the target service access server is any service access server in the service access layer.
  • the server may include a request receiving module 910, a request sending module 920, a result receiving module 930, and a result sending module 940.
  • the request receiving module 910 is configured to perform the above step 801.
  • the request sending module 920 is configured to perform the above step 802.
  • the result receiving module 930 is configured to perform the above step 803.
  • the result sending module 940 is configured to perform the above step 804.
  • the server further includes: a determining module and a result obtaining module.
  • the determining module is configured to determine whether the authentication result corresponding to the authentication request has been stored in the cache of the target service access server.
  • the result obtaining module is configured to obtain an authentication result corresponding to the authentication request from the cache if the authentication result corresponding to the authentication request has been stored.
  • the result sending module 940 is further configured to send the authentication result obtained by the result obtaining module to the service provider.
  • the request sending module 920 is further configured to: if the authentication result corresponding to the authentication request is not stored, send an authentication request to the target authentication logic server in the authentication logic layer.
  • the server further includes: a request processing module.
  • the request processing module is configured to analyze and process the authentication request according to the default authorization policy when each authentication logic server is unavailable, and obtain an authentication result; wherein the default authorization policy is a general authorization policy formulated by the user for all users.
  • the request sending module 920 includes: a selecting unit and a sending unit.
  • a selection unit is configured to perform the above step 802a.
  • the sending unit is configured to perform the above step 802b.
  • the server provided by the foregoing embodiment implements its function, it only exemplifies the division of each functional module.
  • the function distribution may be completed by different functional modules according to requirements, that is, the server
  • the internal structure is divided into different functional modules to perform all or part of the functions described above.
  • FIG. 10 is a schematic structural diagram of a server provided by an embodiment of the present application.
  • the server can be implemented as any one of the above authentication systems. Specifically:
  • the server 1000 includes a central processing unit (CPU) 1001, a system memory 1004 including a random access memory (RAM) 1002 and a read only memory (ROM) 1003, and a system bus 1005 that connects the system memory 1004 and the central processing unit 1001.
  • the server 1000 also includes a basic input/output system (I/O system) 1006 that facilitates transfer of information between various devices within the computer, and mass storage for storing the operating system 1013, applications 1014, and other program modules 1015.
  • I/O system basic input/output system
  • the basic input/output system 1006 includes a display 1008 for displaying information and an input device 1009 such as a mouse, a keyboard for inputting information by a user.
  • the display 1008 and the input device 1009 are both connected to the central processing unit 1001 via an input/output controller 1010 connected to the system bus 1005.
  • the basic input/output system 1006 can also include an input output controller 1010 for receiving and processing input from a plurality of other devices, such as a keyboard, mouse, or electronic stylus.
  • input-output controller 1010 also provides output to a display screen, printer, or other type of output device.
  • the mass storage device 1007 is connected to the central processing unit 1001 by a mass storage controller (not shown) connected to the system bus 1005.
  • the mass storage device 1007 and its associated computer readable medium provide non-volatile storage for the server 1000. That is, the mass storage device 1007 may include a computer readable medium (not shown) such as a hard disk or a CD-ROM drive.
  • the computer readable medium can include computer storage media and communication media.
  • Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.
  • Computer storage media include RAM, ROM, EPROM, EEPROM, flash memory or other solid state storage technologies, CD-ROM, DVD or other optical storage, tape cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices.
  • RAM random access memory
  • ROM read only memory
  • EPROM Erasable programmable read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • the server 1000 may also be operated by a remote computer connected to the network through a network such as the Internet. That is, the server 1000 can be connected to the network 1012 through the network interface unit 1011 connected to the system bus 1005, or can also be connected to other types of networks or remote computer systems (not shown) using the network interface unit 1011. .
  • the memory also includes one or more programs, the one or more programs being stored in a memory and configured to be executed by one or more processors.
  • the one or more programs include instructions for performing the above method.
  • An exemplary embodiment of the present application also provides a computer readable storage medium having stored thereon a computer program executable by a processor and implementing the authentication method described above.
  • the authentication system includes a service access server and an authentication logic server.
  • a computer readable storage medium is included in both the service access server and the authentication logic server.
  • different computer programs can be stored thereon.
  • the computer storage medium may be referred to as a first computer readable storage medium having a first computer program stored thereon.
  • the computer readable storage medium may be referred to as a second computer readable storage medium, and the second computer readable storage medium stores a second computer program.
  • An exemplary embodiment of the present application provides a first computer readable storage medium, located in a service access server, on which a first computer program is stored, the first computer program being capable of being serviced
  • the processor of the access server executes to implement the step procedure of the service access server side in the above method example.
  • Another exemplary embodiment of the present application provides a second computer readable storage medium, which is located in an authentication logic server, on which a second computer program is stored, and the second computer program can be
  • the processor of the authentication logic server executes to implement the step flow on the authentication logic server side in the above method example.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种鉴权系统、方法及服务器（1000）。所述鉴权系统包括：业务接入层（21）、鉴权逻辑层（22）和数据存储层（23），业务接入层（21）包括多个业务接入服务器（21a），鉴权逻辑层（22）包括多个鉴权逻辑服务器（22a），数据存储层（23）包括主数据库（23a）和多个从数据库（23b）；各层服务器和数据库均跨地域部署。目标业务接入服务器（21a1）用于接收业务提供方发送的鉴权请求（501，801），向目标鉴权逻辑服务器（22a1）发送鉴权请求；目标鉴权逻辑服务器（22a1）用于从目标从数据库（23b1）中获取与鉴权请求相关的授权策略（503），根据获取的授权策略对鉴权请求进行分析处理得到鉴权结果（504），向目标业务接入服务器（21a1）发送鉴权结果（505）；目标业务接入服务器（21a1）还用于向业务提供方发送鉴权结果（506，804）。方法提高了鉴权系统的可用性，降低了访问延迟，从而提升整体的鉴权服务质量。

Description

鉴权系统、方法及服务器
本申请要求于2017年01月19日提交中国专利局、申请号为201710046587.3、发明名称为“鉴权系统和方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及信息安全技术领域，特别涉及一种鉴权系统、方法及服务器。
背景技术
鉴权是指验证用户是否拥有某种权限。鉴权系统是指用于提供鉴权服务以实现对用户操作进行鉴权的系统。
请参考图1，其示出了现有技术提供的一种鉴权系统的示意图。该鉴权系统包括：业务接入层11、鉴权逻辑层12和数据存储层13。业务接入层11用于向业务提供方提供鉴权接口，业务提供方通过调用鉴权接口向业务接入层11发送鉴权请求。业务接入层11可以包括多个业务接入服务器11a。业务接入层11还用于将鉴权请求转发给鉴权逻辑层12。鉴权逻辑层12包括多个鉴权逻辑服务器12a，每一个鉴权逻辑服务器12a均具备处理各个业务接入服务器11a发来的鉴权请求的功能。数据存储层13采用分布式数据库实现，以避免大量的数据库访问操作对同一数据库带来巨大压力。数据存储层13包括一个主数据库13a和多个从数据库13b，主数据库13a中存储授权策略，各个从数据库13b从主数据库13a中同步授权策略。鉴权逻辑服务器12a在接收到鉴权请求之后，从与其相连的从数据库13b中读取与上述鉴权请求相关的授权策略，而后根据读取的授权策略对鉴权请求进行分析处理，得到鉴权结果。
在现有技术中，鉴权逻辑层12中的鉴权逻辑服务器12a的数量可按需增加，以避免大量的鉴权请求由同一服务器处理。数据存储层13中的从数据库13b的数量也可按需增加，以避免大量的数据库访问操作对同一数据库带来巨大压力。
现有技术提供的鉴权系统，虽然采用分布式部署方式，但鉴权系统中包括的各个服务器和数据库部署在同一机房内，当机房出现故障时，会导致整个鉴权系统无法提供鉴权服务。另外，当业务提供方异地访问鉴权系统请求鉴权服务时，访问延迟较大且通信链路稳定性较低，导致鉴权系统的可用性无法得到保障。
发明内容
为了解决现有技术中鉴权系统的可用性无法得到保障的问题，本申请实施例提供了一种鉴权系统、方法及服务器。所述技术方案如下：
第一方面，提供了一种鉴权系统，所述鉴权系统包括：业务接入层、鉴权逻辑层和数据存储层，所述业务接入层包括至少两个业务接入服务器，所述鉴权逻辑层包括至少两个鉴权逻辑服务器，所述数据存储层包括主数据库和至少两个从数据库；其中，所述至少两个业务接入服务器、所述至少两个鉴权逻辑服务器和所述至少两个从数据库均跨地域部署；
所述业务接入层中的目标业务接入服务器，用于接收业务提供方发送的鉴权请求，其中，所述业务提供方与所述目标业务接入服务器位于同一地域，或者，所述业务提供方与所述目标业务接入服务器位于不同地域且所述业务提供方所处地域的业务接入服务器不可用；向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求；
所述目标鉴权逻辑服务器，用于从目标从数据库中获取与所述鉴权请求相关的授权策略，所述目标从数据库用于存储与所述业务提供方提供的业务相关的授权策略；根据与所述鉴权请求相关的授权策略对所述鉴权请求进行分析处理，得到鉴权结果；向所述目标业务接入服务器发送所述鉴权结果；
所述目标业务接入服务器，还用于向所述业务提供方发送所述鉴权结果。
第二方面，提供了一种鉴权方法，所述鉴权方法应用于鉴权系统中，所述鉴权系统包括：业务接入层、鉴权逻辑层和数据存储层，所述业务接入层包括至少两个业务接入服务器，所述鉴权逻辑层包括多个至少两个鉴权逻辑服务器，所述数据存储层包括主数据库和至少两个从数据库；其中，所述至少两个业务接入服务器、所述至少两个鉴权逻辑服务器和所述至少两个从数据库均跨地域部署；
所述鉴权方法包括：
所述业务接入层中的目标业务接入服务器接收业务提供方发送的鉴权请求，其中，所述业务提供方与所述目标业务接入服务器位于同一地域，或者，所述业务提供方与所述目标业务接入服务器位于不同地域且所述业务提供方所处地域的业务接入服务器不可用；向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求；
所述目标鉴权逻辑服务器从目标从数据库中获取与所述鉴权请求相关的授权策略，所述目标从数据库用于存储与所述业务提供方提供的业务相关的授权策略；根据与所述鉴权请求相关的授权策略对所述鉴权请求进行分析处理，得到鉴权结果；向所述目标业务接入服务器发送所述鉴权结果；
所述目标业务接入服务器向所述业务提供方发送所述鉴权结果。
第三方面，提供了一种鉴权方法，所述鉴权方法应用于鉴权系统中的目标业务接入服务器中，所述鉴权系统包括：业务接入层、鉴权逻辑层和数据存储层，所述业务接入层包括至少两个业务接入服务器，所述鉴权逻辑层包括至少两个鉴权逻辑服务器，所述数据存储层包括主数据库和至少两个从数据库；其中，所述至少两个业务接入服务器、所述至少两个鉴权逻辑服务器和所述至少两个从数据库均跨地域部署；
所述鉴权方法包括：
接收业务提供方发送的鉴权请求；其中，所述业务提供方与所述目标业务接入服务器位于同一地域，或者，所述业务提供方与所述目标业务接入服务器位于不同地域且所述业务提供方所处地域的业务接入服务器不可用；
向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求；所述目标鉴权逻辑服务器用于从目标从数据库中获取与所述鉴权请求相关的授权策略，所述目标从数据库用于存储与所述业务提供方提供的业务相关的授权策略，根据与所述鉴权请求相关的授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
接收所述目标鉴权逻辑服务器发送的所述鉴权结果；
向所述业务提供方发送所述鉴权结果。
第四方面，提供了一种服务器，所述服务器为鉴权系统中的目标业务接入服务器，所述鉴权系统包括：业务接入层、鉴权逻辑层和数据存储层，所述业务接入层包括至少两个业务接入服务器，所述鉴权逻辑层包括至少两个鉴权逻辑服务器，所述数据存储层包括主数据库和至少两个从数据库；其中，所述至 少两个业务接入服务器、所述至少两个鉴权逻辑服务器和所述至少两个从数据库均跨地域部署；
所述服务器包括：
请求接收模块，用于接收业务提供方发送的鉴权请求；其中，所述业务提供方与所述目标业务接入服务器位于同一地域，或者，所述业务提供方与所述目标业务接入服务器位于不同地域且所述业务提供方所处地域的业务接入服务器不可用；
请求发送模块，用于向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求；所述目标鉴权逻辑服务器用于从目标从数据库中获取与所述鉴权请求相关的授权策略，所述目标从数据库用于存储与所述业务提供方提供的业务相关的授权策略，目标鉴权逻辑服务器还用于根据与所述鉴权请求相关的授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
结果接收模块，用于接收所述目标鉴权逻辑服务器发送的所述鉴权结果；
结果发送模块，用于向所述业务提供方发送所述鉴权结果。
第五方面，提供了一种服务器，所述服务器为鉴权系统中的目标业务接入服务器，所述鉴权系统包括：业务接入层、鉴权逻辑层和数据存储层，所述业务接入层包括至少两个业务接入服务器，所述鉴权逻辑层包括至少两个鉴权逻辑服务器，所述数据存储层包括主数据库和至少两个从数据库；其中，所述至少两个业务接入服务器、所述至少两个鉴权逻辑服务器和所述至少两个从数据库均跨地域部署；
所述服务器包括：
一个或多个处理器；和，
存储器；
所述存储器存储有一个或多个程序，所述一个或多个程序被配置成由所述一个或多个处理器执行，所述一个或多个程序包含用于执行以下操作的指令：
接收业务提供方发送的鉴权请求；其中，所述业务提供方与所述目标业务接入服务器位于同一地域，或者，所述业务提供方与所述目标业务接入服务器位于不同地域且所述业务提供方所处地域的业务接入服务器不可用；
向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求；所述目标鉴权逻辑服务器用于从目标从数据库中获取与所述鉴权请求相关的授权策略，所述目标从数据库用于存储与所述业务提供方提供的业务相关的授权策略，根 据与所述鉴权请求相关的授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
接收所述目标鉴权逻辑服务器发送的所述鉴权结果；
向所述业务提供方发送所述鉴权结果。
第六方面，提供了一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序能够被一处理器执行并实现上述鉴权方法。
本申请实施例提供的技术方案带来的有益效果包括：
鉴权系统中各层均采用跨地域的分布式部署方式，每层都支持按需增减以及跨地域的部署和调用。这样，当某一地域的机房内的服务器或数据库出现故障时，其它地域的机房内的服务器和数据库仍然可用，有效解决因一个机房出现故障而导致整个鉴权系统无法提供鉴权服务的问题，而且跨地域部署也可有效解决异地访问所存在的问题，提高鉴权系统的可用性，降低访问延迟，从而提升整体的鉴权服务质量。
附图说明
图1是现有技术提供的一种鉴权系统的示意图；
图2是本申请一个实施例提供的鉴权系统的示意图；
图3是本申请另一实施例提供的鉴权系统的示意图；
图4是本申请一个实施例提供的数据同步过程的示意图；
图5是本申请一个实施例提供的鉴权方法的流程图；
图6是本申请另一实施例提供的鉴权方法的流程图；
图7是本申请一个实施例提供的数据同步方法的流程图；
图8是本申请另一实施例提供的鉴权方法的流程图；
图9是本申请一个实施例提供的服务器的框图；
图10是本申请一个实施例提供的服务器的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
在对本申请实施例进行介绍之前，首先对本申请实施例中涉及的“授权”和 “鉴权”进行解释说明。
授权是指向用户授予某种权限。例如，业务提供方向用户授予执行某项操作的权限，业务提供方向用户授予对某个资源的访问权限，业务提供方向用户授予对某个资源执行某项操作的权限。业务提供方通过授予给用户权限，能够帮助业务提供方安全地控制其用户对其资源的访问权限。例如，控制哪些用户可以访问资源，以及控制这些用户可以访问的资源以及访问的方式。其中，访问的方式包括读取、写入、修改等操作。
鉴权是指验证用户是否拥有某种权限。根据向用户授予的权限来对用户进行鉴权。当某一用户向业务提供方请求执行某项操作时，对该用户进行鉴权，只有在鉴权通过的情况下允许用户执行其所请求的操作。例如，用户请求对某个资源进行访问，根据向该用户的授权情况确定该用户已经拥有的权限，进而确定该用户是否拥有对上述资源进行访问的权限，如果拥有则鉴权通过。
本申请实施例提供的鉴权系统，适用于任何需要提供鉴权服务的系统中。例如，云服务系统、通信系统、交易系统等。以云服务系统为例，云服务系统可提供计算、存储、下载、安全等多项不同的业务。用户在访问云服务系统请求执行操作时，云服务系统需要对用户进行鉴权，在鉴权通过的情况下允许用户执行其所请求的操作。云服务系统中可部署本申请实施例提供的鉴权系统，通过该鉴权系统对用户进行鉴权。
本申请实施例提供的鉴权系统，鉴权系统中包括的各个服务器和数据库除采用分布式部署方式之外，而且跨地域部署。这样，当某一地域的机房内的服务器或数据库出现故障时，其它地域的机房内的服务器和数据库仍然可用，有效解决因一个机房出现故障而导致整个鉴权系统无法提供鉴权服务的问题，而且跨地域部署也可有效解决异地访问所存在的问题，提高鉴权系统的可用性，降低访问延迟，从而提升整体的鉴权服务质量。
下面将基于上面所述的本申请实施例涉及的共性方面，对本申请实施例进行进一步详细说明。
请参考图2，其示出了本申请一个实施例提供的鉴权系统的示意图。该鉴权系统包括：业务接入层21、鉴权逻辑层22和数据存储层23。在本申请实施例中，上述各层均采用跨地域的分布式部署方式，每层都支持按需增减以及跨地域的部署和调用。
业务接入层21用于向业务提供方提供鉴权接口，业务提供方通过调用鉴 权接口向业务接入层21发送鉴权请求。业务提供方是指向用户提供业务的设备或系统。鉴权系统可以与一个业务提供方建立连接，为该业务提供方提供鉴权服务；或者，鉴权系统也可以与多个业务提供方建立连接，为该多个业务提供方提供鉴权服务。
示例性地，以鉴权系统为上文介绍的云服务系统提供鉴权服务为例，云服务系统可包括云计算子系统、云存储子系统、云下载子系统和云安全子系统等，上述各个子系统分别用于提供计算、存储、下载、安全等多项不同的业务。每一个子系统中用于向用户提供业务的设备可采用跨地域的分布式部署方式。当任一子系统中的任一设备接收到用户的操作请求时，该设备通过调用业务接入层21提供的鉴权接口向业务接入层11发送鉴权请求。
鉴权请求用于请求对用户操作进行鉴权。鉴权请求中包括用户标识，用户标识用于唯一标识用户身份，不同的用户对应不同的用户标识。鉴权请求中还包括操作信息和/或资源信息。操作信息用于指示用户所请求执行的操作。资源信息用于指示用户所请求访问的资源。在一个示例中，假设鉴权请求中包括用户标识“123”、操作信息“读”和资源信息“abc”，则该鉴权请求用于请求验证用户标识为“123”的用户是否具备读取“abc”资源的权限。
业务接入层21采用分布式部署方式，业务接入层21包括多个业务接入服务器21a，该多个业务接入服务器21a跨地域部署，每一个地域部署有至少一个业务接入服务器21a。业务接入服务器21a用于向业务提供方提供鉴权接口。
鉴权逻辑层22用于从业务接入层21接收鉴权请求，通过执行鉴权逻辑处理鉴权请求，完成鉴权操作。鉴权逻辑层22采用分布式部署方式，鉴权逻辑层22包括多个鉴权逻辑服务器22a，该多个鉴权逻辑服务器22a跨地域部署，每一个地域部署有至少一个鉴权逻辑服务器22a。
在第一种可能的实施方式中，鉴权逻辑层22中的每一个鉴权逻辑服务器22a用于对与各个业务相关的鉴权请求进行处理。上述各个业务是指鉴权系统所接入的系统提供的各项业务。
在第二种可能的实施方式中，鉴权逻辑层22中的至少一个鉴权逻辑服务器22a用于对与一个第一业务相关的鉴权请求进行处理，第一业务是指业务量大于预设阈值的业务；以及，鉴权逻辑层22中的至少一个鉴权逻辑服务器22a用于对与多个第二业务相关的鉴权请求进行处理，第二业务是指业务量小于预设阈值的业务。在实际应用中，预设阈值可根据鉴权逻辑服务器22a的处理能 力和各项业务的业务量进行设定。与某一个业务相关的鉴权请求是指用于提供该业务的业务提供方发送的鉴权请求。以上述云服务系统为例，与云计算业务相关的鉴权请求即是指由云计算子系统中的设备发送的鉴权请求，与云存储业务相关的鉴权请求即是指由云存储子系统中的设备发送的鉴权请求。
如果所有的业务共用一个鉴权逻辑服务器22a来处理相关的鉴权请求，则业务之间存在交叉影响，访问量较大的业务会占用这个鉴权逻辑服务器22a的大量处理资源，导致其它业务的鉴权性能受到影响。通过上述第二种可能的实施方式，对于访问量较大的业务，使用单独的鉴权逻辑服务器22a处理相关的鉴权请求；对于访问量较小的业务，复用鉴权逻辑服务器22a处理相关的鉴权请求，从而达到轻重业务分离的目的，避免业务间的交叉影响。
另外，当鉴权逻辑层22中的鉴权逻辑服务器22a采用上述第二种可能的实施方式部署时，对于某一地域，如果鉴权系统所服务的系统在该地域提供目标业务，则在该地域部署用于处理与目标业务相关的鉴权请求的鉴权逻辑服务器22a，而用于处理与除目标业务之外的其它业务相关的鉴权请求的鉴权逻辑服务器22a可不必在该地域部署。例如，云服务系统在地域1提供云计算业务、云存储业务、云下载业务和云安全业务，云服务系统在地域2仅提供云计算业务，假设第一鉴权逻辑服务器用于处理与云计算业务相关的鉴权请求，第二鉴权逻辑服务器用于处理与云存储和云下载业务相关的鉴权请求，第三鉴权逻辑服务器用于处理与云安全业务相关的鉴权请求，则在地域1中部署第一鉴权逻辑服务器、第二鉴权逻辑服务器和第三鉴权逻辑服务器，在地域2中仅需部署第一鉴权逻辑服务器即可。通过上述方式，能够更加合理地在各个地域部署鉴权逻辑服务器，避免资源浪费。
数据存储层23用于向鉴权逻辑层22提供授权策略。授权策略用于指示授予给用户的权限。授权策略包括用户标识，授权策略还包括操作信息和/或资源信息。在一个示例中，假设授权策略包括用户标识“001”和操作信息“读”，则该授权策略表示用户标识为“001”的用户具备读取所有资源的权限。在另一个示例中，假设授权策略包括用户标识“002”和资源信息“abc”，则该授权策略表示用户标识为“002”的用户具备对“abc”资源的访问权限，包括读取、写入、修改等各项操作权限。在又一个示例中，假设授权策略包括用户标识“003”、操作信息“读”和资源信息“abc”，则表示用户标识为“123”的用户具备读取“abc”资源的权限。
数据存储层23包括主数据库23a和多个从数据库23b。主数据库23a的数量可以是一个。多个从数据库23b采用分布式部署方式，且该多个从数据库23b跨地域部署，每一个地域部署有至少一个从数据库23b。
在第一种可能的实施方式中，主数据库23a中存储与鉴权系统所服务的系统提供的各项业务相关的授权策略，也即主数据库23a中存储与各个鉴权逻辑服务器22a所处理的业务相关的授权策略。各个从数据库23b从主数据库23a中同步授权策略，也即各个从数据库23b中存储的授权策略与主数据库23a中存储的授权策略完全相同。
在第二种可能的实施方式中，主数据库23a中存储与鉴权系统所服务的系统提供的各项业务相关的授权策略，也即主数据库23a中存储与各个鉴权逻辑服务器22a所处理的业务相关的授权策略。每一个鉴权逻辑服务器22a对应部署一个从数据库23b，一个从数据库23b中存储与其对应的鉴权逻辑服务器22a所处理的业务相关的授权策略。例如，某一个鉴权逻辑服务器22a用于处理与业务A相关的鉴权请求，则该鉴权逻辑服务器22a对应的从数据库23b中存储与业务A相关的授权策略。又例如，某一个鉴权逻辑服务器22a用于处理与业务B和业务C相关的鉴权请求，则该鉴权逻辑服务器22a对应的从数据库23b中存储与业务B和业务C相关的授权策略。通过上述方式，鉴权逻辑服务器22a可以优先从其对应的从数据库23b中获取与其所处理的业务相关的授权策略，有助于提高获取授权策略的效率。
示例性地，如图3所示，业务接入层包括业务接入服务器A和业务接入服务器B，业务接入服务器A和业务接入服务器B分别部署在地域1和地域2中。业务接入服务器A主要用于处理由地域1中的业务提供方发起的鉴权请求，业务接入服务器B主要用于处理由地域2中的业务提供方发起的鉴权请求。鉴权逻辑层包括鉴权逻辑服务器A、鉴权逻辑服务器B和鉴权逻辑服务器C，鉴权逻辑服务器A和鉴权逻辑服务器B部署在地域1中，鉴权逻辑服务器C部署在地域2中。鉴权逻辑服务器A用于处理与业务A相关的鉴权请求，鉴权逻辑服务器B用于处理与业务B和业务C相关的鉴权请求，鉴权逻辑服务器C用于处理与业务A相关的鉴权请求。数据存储层包括主数据库、从数据库A、从数据库B和从数据库C，从数据库A和从数据库B部署在地域1中，从数据库C部署在地域2中。从数据库A和鉴权逻辑服务器A对应部署，用于存储与业务A相关的授权策略；从数据库B和鉴权逻辑服务器B对应部署，用 于存储与业务B和业务C相关的授权策略；从数据库C和鉴权逻辑服务器C对应部署，用于存储与业务A相关的授权策略。主数据库中存储与业务A、业务B和业务C相关的授权策略。
另外，在本申请实施例中，对主数据库所部署的地域不作限定，其可以与任一从数据库部署在同一地域，也可以部署在一个与各个从数据库所部署的地域均不同的地域。
上文对鉴权系统的各个部分进行了介绍说明，下面对鉴权系统提供鉴权服务的处理流程进行介绍说明。在本申请实施例中，仅以业务接入层21中的目标业务接入服务器接收到业务提供方的鉴权请求，对该鉴权请求进行处理的处理流程为例进行举例说明。如图2所示，目标业务接入服务器以标号21a1标注。可以理解的是，目标业务接入服务器21a1可以是业务接入层21中的任意一个业务接入服务器22a。
目标业务接入服务器21a1，用于接收业务提供方发送的鉴权请求。以鉴权系统为云服务系统提供鉴权服务为例，假设业务提供方是云服务系统中的云存储子系统中的一台用于提供云存储业务的设备，当目标用户向该设备请求读取云存储子系统中的“xxx”资源时，该设备生成鉴权请求，该鉴权请求包括目标用户的用户标识(假设为123)、操作信息“读”和资源信息“xxx”，该设备向目标业务接入服务器21a1发送鉴权请求。
业务提供方在向业务接入层21中的业务接入服务器21a发送鉴权请求时，优先选择与业务提供方位于同一地域的业务接入服务器21a作为目标业务接入服务器21a1，并向目标业务接入服务器21a1发送鉴权请求。如果与业务提供方位于同一地域的业务接入服务器21a不可用(例如出现故障)，则业务提供方选择其它地域的业务接入服务器21a作为目标业务接入服务器21a1，并向目标业务接入服务器21a1发送鉴权请求。也即，业务提供方与目标业务接入服务器21a1位于同一地域，或者，业务提供方与目标业务接入服务器21a1位于不同地域且业务提供方所处地域的业务接入服务器21a不可用。
目标业务接入服务器21a1，还用于向鉴权逻辑层22中的目标鉴权逻辑服务器发送鉴权请求。如图2所示，目标鉴权逻辑服务器以标号22a1标注。在通常情况下，目标鉴权逻辑服务器22a1是与目标业务接入服务器21a1部署在同一地域的鉴权逻辑服务器，通过选择就近的鉴权逻辑服务器处理鉴权请求，可以减少数据传输时延。当然，业务接入层21和鉴权逻辑层22之间同样支持 跨地域调用。如果与目标业务接入服务器21a1部署在同一地域的鉴权逻辑服务器不可用，则可以选择其它地域的鉴权逻辑服务器作为目标鉴权逻辑服务器22a1。
在一种可能的实施方式中，目标业务接入服务器21a1，具体用于：根据各个鉴权逻辑服务器22a的服务质量，选择服务质量最优的鉴权逻辑服务器22a作为目标鉴权逻辑服务器22a1；向目标鉴权逻辑服务器22a1发送鉴权请求。其中，每一个鉴权逻辑服务器22a的服务质量可根据以下至少一项参数确定：鉴权逻辑服务器22a的业务量、鉴权逻辑服务器22a与目标业务接入服务器21a1之间的连通率、鉴权逻辑服务器22a的处理效率，等等。
另外，如果鉴权逻辑层22中的鉴权逻辑服务器22a在部署时考虑轻重业务分离，则目标业务接入服务器21a1在选取目标鉴权逻辑服务器22a1时，具体用于：根据各个鉴权逻辑服务器22a的服务质量，从用于处理与业务提供方提供的业务相关的鉴权请求的鉴权逻辑服务器22a中选择服务质量最优的鉴权逻辑服务器22a，作为目标鉴权逻辑服务器22a1。例如，业务提供方为云存储子系统，其提供的业务为云存储业务，则目标业务接入服务器21a1从用于处理与云存储业务相关的鉴权请求的鉴权逻辑服务器22a中选择服务质量最优的鉴权逻辑服务器22a，作为目标鉴权逻辑服务器22a1。
示例性地，结合参考图3，业务接入服务器B接收到鉴权请求之后，优先向鉴权逻辑服务器C发送鉴权请求，将鉴权请求交由鉴权逻辑服务器C进行处理，如果鉴权逻辑服务器C因故障而不可用，则业务接入服务器B可跨地域调用鉴权逻辑服务器A，将鉴权请求发送给鉴权逻辑服务器A进行处理。
目标鉴权逻辑服务器22a1，用于在接收到鉴权请求之后，从目标从数据库中获取与鉴权请求相关的授权策略。如图2所示，目标从数据库以标号23b1标注。目标从数据库23b1用于存储与业务提供方提供的业务相关的授权策略。在通常情况下，目标从数据库23b1是与目标鉴权逻辑服务器22a1部署在同一地域的从数据库，通过从就近的从数据库中读取授权策略，可以提高获取授权策略的效率。当然，鉴权逻辑层22和数据存储层23之间同样支持跨地域调用。如果与目标鉴权逻辑服务器22a1部署在同一地域的从数据库不可用，则可以选择其它地域的从数据库作为目标从数据库23b1。
另外，如果每一个鉴权逻辑服务器22a对应部署一个从数据库23b，则目标从数据库23b1即为与目标鉴权逻辑服务器22a1对应部署的从数据库。
目标鉴权逻辑服务器22a1可以根据鉴权请求中携带的目标用户的用户标识，从目标从数据库23b1中读取与目标用户相关的授权策略，并将这些与目标用户相关的授权策略作为与鉴权请求相关的授权策略。这些与目标用户相关的授权策略记录有目标用户已经具备的权限。
需要说明的是，如果每一个鉴权逻辑服务器22a对应部署一个从数据库23b，当与目标鉴权逻辑服务器22a1对应部署的从数据库不可用时，目标鉴权逻辑服务器22a1从其它从数据库中选择符合条件的从数据库作为目标从数据库23b1，上述符合条件的从数据库即是指存储有与目标鉴权逻辑服务器22a1所处理的业务相关的授权策略的从数据库。如果其它从数据库中不存在符合条件的从数据库，则目标鉴权逻辑服务器22a1可以选择一个从数据库作为目标从数据库23b1，并通过该目标从数据库23b1从主数据库23a获取与鉴权请求相关的授权策略。
目标鉴权逻辑服务器22a1，还用于根据与鉴权请求相关的授权策略对鉴权请求进行分析处理，得到鉴权结果。目标鉴权逻辑服务器22a1根据目标用户已经具备的权限，验证目标用户是否具备执行其所请求的操作的权限。例如，将目标用户已经具备的权限与其所请求的权限进行比对，如果目标用户已经具备的权限中包括其所请求的权限，则说明具备；否则，如果目标用户已经具备的权限中不包括其所请求的权限，则说明不具备。如果具备，则确定鉴权结果为通过；如果不具备，则确定鉴权结果为未通过。
目标鉴权逻辑服务器22a1，还用于向目标业务接入服务器21a1发送鉴权结果。
目标业务接入服务器21a1，还用于向业务提供方发送鉴权结果。业务提供方接收到鉴权结果之后，便可根据鉴权结果确定是否允许目标用户执行其所请求的操作。如果鉴权结果为通过，则业务提供方允许目标用户执行其所请求的操作；如果鉴权结果为未通过，则业务提供方不允许目标用户执行其所请求的操作。
可选地，目标业务接入服务器21a1，还用于：在接收到鉴权请求之后，判断目标业务接入服务器21a1的缓存中是否已存储鉴权请求对应的鉴权结果；若已存储鉴权请求对应的鉴权结果，则从缓存中获取鉴权请求对应的鉴权结果，并执行向业务提供方发送鉴权结果的步骤；若未存储鉴权请求对应的鉴权结果，则执行向鉴权逻辑层中的目标鉴权逻辑服务器22a1发送鉴权请求的步 骤。
由于授权策略更改较少，为了提高对鉴权请求的响应效率，同时避免因基础鉴权服务异常(例如各地域的鉴权逻辑服务器22a均不可用)而导致无法提供鉴权服务，在本申请实施例中，业务接入服务器21a将鉴权请求对应的鉴权结果进行缓存。业务接入服务器21a在接收到鉴权请求之后，首先判断本地的缓存中是否已存储鉴权请求对应的鉴权结果，如果已存储鉴权请求对应的鉴权结果，则直接获取该鉴权结果并反馈给业务提供方，无需将鉴权请求发送给鉴权逻辑层22进行处理，提高响应效率，且减少鉴权逻辑层22的请求处理量。
另外，业务接入层21的目标业务接入服务器21a1中缓存的鉴权结果是之前通过鉴权逻辑层22对鉴权请求进行处理后得到的鉴权结果。对于同样的鉴权请求来说，如果之前已经对该鉴权请求进行处理得到鉴权结果并在目标业务接入服务器21a1中缓存，则该目标业务接入服务器21a1再次接收到这个鉴权请求时，可以直接从缓存中获取对应的鉴权结果，无需交由鉴权逻辑层22重复处理。
在本申请实施例中，对鉴权结果在业务接入服务器21a中缓存的时间不作限定，其可根据业务接入服务器21a的存储性能进行设定。例如，业务接入服务器21a的存储性能越好，则鉴权结果在业务接入服务器21a中缓存的时间越长；反之，业务接入服务器21a的存储性能越差，则鉴权结果在业务接入服务器21a中缓存的时间越短。另外，当主数据库23a中有授权策略发生更改时，业务接入服务器21a将缓存中与该更改的授权策略相关的鉴权请求对应的鉴权结果删除，以避免因鉴权结果更新不及时而导致向业务提供方反馈错误的鉴权结果。
可选地，目标业务接入服务器21a1，还用于：当各个鉴权逻辑服务器22a均不可用时，根据默认授权策略对鉴权请求进行分析处理，得到鉴权结果。其中，默认授权策略是指针对所有用户制定的通用的授权策略。默认授权策略不考虑用户间的差异化特性，其可以结合用户属性、操作类型和资源类型进行设定。例如，默认授权策略可以是所有用户具备读取某种类型的资源的权限。又例如，默认授权策略可以是所有用户具备对某种类型的资源执行某种操作的权限。再例如，默认授权策略可以是符合某种预设条件的用户具备对某种类型的资源执行读取和修改操作的权限。
在一个示例中，默认授权策略包括：所有用户仅具备读取“xxx”资源的权 限，而不具备修改“xxx”资源的权限。假设目标业务接入服务器21a1接收到的鉴权请求用于请求验证目标用户是否具备读取“xxx”资源的权限，目标业务接入服务器21a1优先将该鉴权请求发送给鉴权逻辑层22进行处理，如果鉴权逻辑层22中的各个鉴权逻辑服务器22a均不可用时，则目标业务接入服务器21a1根据默认授权策略得到鉴权结果，也即鉴权结果为通过。
需要说明的是，默认授权策略仅在业务接入服务器21a1的缓存失效(如未缓存鉴权请求对应的鉴权结果，或者鉴权请求对应的鉴权结果已过期)，且鉴权逻辑层22中的各个鉴权逻辑服务器22a均不可用的情况下生效，通过设置默认授权策略，实现提供柔性容灾的解决方案。
本申请实施例提供的方案中，鉴权系统中各层均采用跨地域的分布式部署方式，每层都支持按需增减以及跨地域的部署和调用。这样，当某一地域的机房内的服务器或数据库出现故障时，其它地域的机房内的服务器和数据库仍然可用，有效解决因一个机房出现故障而导致整个鉴权系统无法提供鉴权服务的问题，而且跨地域部署也可有效解决异地访问所存在的问题，提高鉴权系统的可用性，降低访问延迟，从而提升整体的鉴权服务质量。
另外，通过在业务接入层对鉴权结果进行缓存，优先从缓存中获取鉴权结果，一方面可以提高对鉴权请求的响应效率，减少鉴权逻辑层的请求处理量，另一方面也可以避免因基础鉴权服务异常(例如各地域的鉴权逻辑服务器均不可用)带来的影响，使得鉴权系统能够尽可能地正常提供鉴权服务。
另外，通过设置默认授权策略，提供柔性容灾的解决方案，尽可能地减少对用户操作的影响。
另外，对于访问量较大的业务，使用单独的鉴权逻辑服务器处理相关的鉴权请求；对于访问量较小的业务，复用鉴权逻辑服务器处理相关的鉴权请求，从而达到轻重业务分离的目的，避免业务间的交叉影响，使得整个鉴权系统的服务性能得到保障。
在基于图2所示实施例提供的一个可选实施例中，数据存储层包括主数据库服务器和至少两个从数据库服务器。其中，主数据库服务器中部署主数据库，每一个从数据库服务器中部署至少一个从数据库。从数据库服务器采用跨地域的分布式部署方式，一个地域中可部署至少一个从数据库服务器。
结合参考图4，在本申请实施例中，提供了一套跨地域的数据同步方案， 用以实现将主数据库中存储的授权策略同步至从数据库中。
如图4所示，主数据库服务器41包括：主数据库41a、日志文件41b、管理模块41c和IO(Input Output，输入输出)服务端(server)41d。有关主数据库41a的说明可参见上文，本实施例对此不再赘述。日志文件41b用于记录对主数据库41a中存储的数据(也即授权策略)执行的更新操作所对应的操作日志。上述更新操作包括添加、删除、修改等操作。对数据库的更新操作可称为SQL(Structured Query Language，结构化查询语言)操作。日志文件41b可以是二进制日志文件binlog。管理模块41c用于对主数据库41a中存储的数据执行更新操作，管理模块可称为Manager模块。IO服务端41d用于读取日志文件41b，并将读取的日志文件41b同步给IO客户端。
从数据库服务器42包括：从数据库42a、日志文件42b、执行模块42c和IO客户端(client)42d。有关从数据库42a的说明可参见上文，本实施例对此不再赘述。日志文件42b用于记录对从数据库42a中存储的数据(也即授权策略)执行的更新操作所对应的操作日志。上述更新操作包括添加、删除、修改等操作。日志文件42b可以是二进制日志文件binlog。执行模块42c用于读取和执行日志文件42b中未执行的SQL操作，执行模块可称为SQL executor模块。IO客户端41d用于从IO服务端接收操作日志，并将接收的操作日志写入到日志文件42b中。
主数据库服务器41和从数据库服务器42部署在不同的地域，下面对主数据库服务器41和从数据库服务器42之间跨地域的数据同步过程进行介绍说明。
主数据库服务器41，用于根据对主数据库41a中存储的授权策略的更新操作，在主数据库服务器41的日志文件41b中添加操作日志。日志文件41b可以由主数据库服务器41的应用层生成。
结合参考图4，管理模块41c对主数据库41a中存储的授权策略执行更新操作，例如添加授权策略，并在日志文件41b中添加操作日志，该操作日志记录有执行的上述更新操作。
主数据库服务器41，还用于对于每一个从数据库服务器42，将主数据库服务器41的日志文件41b中未同步给从数据库服务器42的操作日志发送给从数据库服务器42。
在一种可能的实施方式中，主数据库服务器41主动向从数据库服务器42 发送操作日志，例如主数据库服务器41在每一次更新日志文件41b之后，主动将日志文件41b中未同步给从数据库服务器42的操作日志发送给从数据库服务器42。
在另一种可能的实施方式中，主数据库服务器41在接收到从数据库服务器42发送的更新请求之后，向从数据库服务器42发送操作日志。例如，从数据库服务器42定时向主数据库服务器41发送更新请求，该更新请求用于请求主数据库服务器41将日志文件41b中未同步给从数据库服务器42的操作日志发送给从数据库服务器42。主数据库服务器41在接收到更新请求之后，如果确认日志文件41b已更新，则将日志文件41b中未同步给从数据库服务器42的操作日志发送给从数据库服务器42。
另外，如果从数据库采用图2所示实施例提供的第二种可能的实施方式存储授权策略，则主数据库服务器41将日志文件41b中未同步给从数据库42a且从数据库42a需要的授权策略发送给从数据库服务器42；其中，如果从数据库42中存储与目标业务相关的授权策略，则从数据库42a需要的授权策略即是指与目标业务相关的授权策略。
结合参考图4，IO服务端41d将日志文件41b中未同步给从数据库服务器42的操作日志发送给从数据库服务器42。
从数据库服务器42，用于将接收到的操作日志添加至从数据库服务器42的日志文件42b中。
结合参考图4，IO客户端42d接收IO服务端41d发送的操作日志，并将接收到的操作日志写入日志文件42b中。
从数据库服务器42，还用于执行从数据库服务器42的日志文件42b中未执行的操作日志，以对从数据库服务器42的从数据库42a中存储的授权策略进行更新。
结合参考图4，执行模块42c从日志文件42b中读取未执行的操作日志，并执行这些未执行的操作日志，以对从数据库42a中存储的授权策略进行更新，从而实现授权策略在主从数据库间的同步。
可选地，如果执行模块42c在执行操作日志的过程中遇到执行失败的情况，则从数据库服务器42从主数据库服务器41中重新请求获取未执行成功的操作日志，并重新执行。
在本实施例中，提供了一套跨地域的数据同步方案，用以实现将主数据库 中存储的授权策略同步至从数据库中。
下述为本申请方法实施例，对于本申请方法实施例中未披露的细节，请参照本申请系统实施例。
请参考图5，其示出了本申请一个实施例提供的鉴权方法的流程图。该鉴权方法应用于图2所示实施例提供的鉴权系统中，有关鉴权系统的介绍参见上文，此处不再赘述。该鉴权方法可以包括如下几个步骤。
步骤501，业务接入层中的目标业务接入服务器接收业务提供方发送的鉴权请求。
步骤502，目标业务接入服务器向鉴权逻辑层中的目标鉴权逻辑服务器发送鉴权请求。
相应地，目标鉴权逻辑服务器接收目标业务接入服务器发送的鉴权请求。
在通常情况下，目标鉴权逻辑服务器是与目标业务接入服务器部署在同一地域的鉴权逻辑服务器，通过选择就近的鉴权逻辑服务器处理鉴权请求，可以减少数据传输时延。
在一种可能的实施方式中，步骤502包括如下几个子步骤：
1、目标业务接入服务器根据各个鉴权逻辑服务器的服务质量，选择服务质量最优的鉴权逻辑服务器作为目标鉴权逻辑服务器；
2、目标业务接入服务器向目标鉴权逻辑服务器发送鉴权请求。
其中，每一个鉴权逻辑服务器的服务质量可根据以下至少一项参数确定：鉴权逻辑服务器的业务量、鉴权逻辑服务器与目标业务接入服务器之间的连通率、鉴权逻辑服务器的处理效率，等等。
另外，如果鉴权逻辑层中的鉴权逻辑服务器在部署时考虑轻重业务分离，则目标业务接入服务器在选取目标鉴权逻辑服务器时，具体包括：根据各个鉴权逻辑服务器的服务质量，从用于处理与业务提供方提供的业务相关的鉴权请求的鉴权逻辑服务器中选择服务质量最优的鉴权逻辑服务器，作为目标鉴权逻辑服务器。
步骤503，目标鉴权逻辑服务器从目标从数据库中获取与鉴权请求相关的授权策略。
目标从数据库用于存储与业务提供方提供的业务相关的授权策略。在通常情况下，目标从数据库是与目标鉴权逻辑服务器部署在同一地域的从数据库， 通过从就近的从数据库中读取授权策略，可以提高获取授权策略的效率。
另外，如果每一个鉴权逻辑服务器对应部署一个从数据库，则目标从数据库即为与目标鉴权逻辑服务器对应部署的从数据库。
目标鉴权逻辑服务器可以根据鉴权请求中携带的目标用户的用户标识，从目标从数据库中读取与目标用户相关的授权策略，并将这些与目标用户相关的授权策略作为与鉴权请求相关的授权策略。这些与目标用户相关的授权策略记录有目标用户已经具备的权限。
步骤504，目标鉴权逻辑服务器根据与鉴权请求相关的授权策略对鉴权请求进行分析处理，得到鉴权结果。
目标鉴权逻辑服务器根据目标用户已经具备的权限，验证目标用户是否具备执行其所请求的操作的权限。如果具备，则确定鉴权结果为通过；如果不具备，则确定鉴权结果为未通过。
步骤505，目标鉴权逻辑服务器向目标业务接入服务器发送鉴权结果。
相应地，目标业务接入服务器接收目标鉴权逻辑服务器发送的鉴权结果。
步骤506，目标业务接入服务器向业务提供方发送鉴权结果。
业务提供方接收到鉴权结果之后，便可根据鉴权结果确定是否允许目标用户执行其所请求的操作。如果鉴权结果为通过，则业务提供方允许目标用户执行其所请求的操作；如果鉴权结果为未通过，则业务提供方不允许目标用户执行其所请求的操作。
可选地，如图6所示，上述步骤501之后还包括如下步骤：
步骤507，目标业务接入服务器判断目标业务接入服务器的缓存中是否已存储鉴权请求对应的鉴权结果；若是，则执行下述步骤508，并在步骤508之后执行上述步骤506；若否，则执行上述步骤502。
步骤508，目标业务接入服务器从缓存中获取鉴权请求对应的鉴权结果。
由于授权策略更改较少，为了提高对鉴权请求的响应效率，同时避免因基础鉴权服务异常(例如各地域的鉴权逻辑服务器均不可用)而导致无法提供鉴权服务，在本申请实施例中，业务接入服务器将鉴权请求对应的鉴权结果进行缓存。业务接入服务器在接收到鉴权请求之后，首先判断本地的缓存中是否已存储鉴权请求对应的鉴权结果，如果已存储鉴权请求对应的鉴权结果，则直接获取该鉴权结果并反馈给业务提供方，无需将鉴权请求发送给鉴权逻辑层进行处理，提高响应效率，且减少鉴权逻辑层的请求处理量。
在本申请实施例中，对鉴权结果在业务接入服务器中缓存的时间不作限定，其可根据业务接入服务器的存储性能进行设定。另外，当主数据库中有授权策略发生更改时，业务接入服务器将缓存中与该更改的授权策略相关的鉴权请求对应的鉴权结果删除，以避免因鉴权结果更新不及时而导致向业务提供方反馈错误的鉴权结果。
可选地，上述步骤501之后还包括如下步骤：当各个鉴权逻辑服务器均不可用时，目标业务接入服务器根据默认授权策略对鉴权请求进行分析处理，得到鉴权结果。其中，默认授权策略是指针对所有用户制定的通用的授权策略。
默认授权策略不考虑用户间的差异化特性，其可以结合用户属性、操作类型和资源类型进行设定。例如，默认授权策略可以是所有用户具备读取某种类型的资源的权限。又例如，默认授权策略可以是所有用户具备对某种类型的资源执行某种操作的权限。再例如，默认授权策略可以是符合某种预设条件的用户具备对某种类型的资源执行读取和修改操作的权限。
需要说明的是，默认授权策略仅在业务接入服务器的缓存失效(如未缓存鉴权请求对应的鉴权结果，或者鉴权请求对应的鉴权结果已过期)，且鉴权逻辑层中的各个鉴权逻辑服务器均不可用的情况下生效，通过设置默认授权策略，实现提供柔性容灾的解决方案。
本申请实施例提供的方案中，鉴权系统中各层均采用跨地域的分布式部署方式，每层都支持平行扩展以及跨地域的部署和调用。这样，当某一地域的机房内的服务器或数据库出现故障时，其它地域的机房内的服务器和数据库仍然可用，有效解决因一个机房出现故障而导致整个鉴权系统无法提供鉴权服务的问题，而且跨地域部署也可有效解决异地访问所存在的问题，提高鉴权系统的可用性，降低访问延迟，从而提升整体的鉴权服务质量。
另外，通过在业务接入层对鉴权结果进行缓存，优先从缓存中获取鉴权结果，一方面可以提高对鉴权请求的响应效率，减少鉴权逻辑层的请求处理量，另一方面也可以避免因基础鉴权服务异常(例如各地域的鉴权逻辑服务器均不可用)带来的影响，使得鉴权系统能够尽可能地正常提供鉴权服务。
另外，通过设置默认授权策略，提供柔性容灾的解决方案，尽可能地减少对用户操作的影响。
在一个示例性实施例中，数据存储层包括主数据库服务器和至少两个从数 据库服务器。其中，主数据库服务器中部署主数据库，每一个从数据库服务器中部署至少一个从数据库。
结合参考图7，在本申请实施例中，提供了一套跨地域的数据同步方案，用以实现将主数据库中存储的授权策略同步至从数据库中。该数据同步方法可以包括如下几个步骤：
步骤701，主数据库服务器根据对主数据库中存储的授权策略的更新操作，在主数据库服务器的日志文件中添加操作日志。
步骤702，对于每一个从数据库服务器，主数据库服务器将主数据库服务器的日志文件中未同步给从数据库服务器的操作日志发送给从数据库服务器。
步骤703，从数据库服务器将接收到的操作日志添加至从数据库服务器的日志文件中。
步骤704，从数据库服务器执行从数据库服务器的日志文件中未执行的操作日志，以对从数据库服务器的从数据库中存储的授权策略进行更新。
有关图7所示实施例中各步骤的介绍可参见图4所示实施例中的介绍说明，此处不作赘述。
请参考图8，其示出了本申请另一实施例提供的鉴权方法的流程图。该鉴权方法应用于鉴权系统中的目标业务接入服务器中。有关鉴权系统的介绍参见上文，此处不再赘述。目标业务接入服务器是业务接入层中的任意一个业务接入服务器。该鉴权方法可以包括如下几个步骤。
步骤801，接收业务提供方发送的鉴权请求；
其中，业务提供方与目标业务接入服务器位于同一地域，或者，业务提供方与目标业务接入服务器位于不同地域且业务提供方地域的业务接入服务器不可用。
步骤802，向鉴权逻辑层中的目标鉴权逻辑服务器发送鉴权请求；
目标鉴权逻辑服务器用于从从数据库中获取与鉴权请求相关的授权策略，目标从数据库用于存储与业务提供方提供的业务相关的授权策略。目标鉴权逻辑服务器还用于根据与鉴权请求相关的授权策略对鉴权请求进行分析处理，得到鉴权结果。
步骤803，接收目标鉴权逻辑服务器发送的鉴权结果；
步骤804，向业务提供方发送鉴权结果。
可选地，上述步骤801之后还包括：判断目标业务接入服务器的缓存中是否已存储鉴权请求对应的鉴权结果；若是，则从缓存中获取鉴权请求对应的鉴权结果，并执行步骤804；若否，则执行步骤802。
可选地，上述步骤801之后还包括：当各个鉴权逻辑服务器均不可用时，根据默认授权策略对鉴权请求进行分析处理，得到鉴权结果；其中，默认授权策略是指针对所有用户制定的通用的授权策略。
可选地，上述步骤802包括如下几个子步骤：
步骤802a，根据各个鉴权逻辑服务器的服务质量，选择服务质量最优的鉴权逻辑服务器作为目标鉴权逻辑服务器；
步骤802b，向目标鉴权逻辑服务器发送鉴权请求。
请参考图9，其示出了本申请一个实施例提供的服务器的框图。该服务器为鉴权系统中的目标业务接入服务器。有关鉴权系统的介绍参见上文，此处不再赘述。目标业务接入服务器是业务接入层中的任意一个业务接入服务器。该服务器可以包括：请求接收模块910、请求发送模块920、结果接收模块930和结果发送模块940。
请求接收模块910，用于执行上述步骤801。
请求发送模块920，用于执行上述步骤802。
结果接收模块930，用于执行上述步骤803。
结果发送模块940，用于执行上述步骤804。
可选地，该服务器还包括：判断模块和结果获取模块。
判断模块，用于判断目标业务接入服务器的缓存中是否已存储鉴权请求对应的鉴权结果。
结果获取模块，用于若已存储鉴权请求对应的鉴权结果，则从缓存中获取鉴权请求对应的鉴权结果。结果发送模块940，还用于向业务提供方发送结果获取模块获取的鉴权结果。
请求发送模块920，还用于若未存储鉴权请求对应的鉴权结果，则向鉴权逻辑层中的目标鉴权逻辑服务器发送鉴权请求。
可选地，该服务器还包括：请求处理模块。
请求处理模块，用于当各个鉴权逻辑服务器均不可用时，根据默认授权策略对鉴权请求进行分析处理，得到鉴权结果；其中，默认授权策略是指针对所 有用户制定的通用的授权策略。
可选地，请求发送模块920包括：选择单元和发送单元。
选择单元，用于执行上述步骤802a。
发送单元，用于执行上述步骤802b。
需要说明的是，上述实施例提供的服务器在实现其功能时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将服务器的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
请参考图10，其示出了本申请一个实施例提供的服务器的结构示意图。该服务器可以实现成为上述鉴权系统中的任意一个服务器。具体来讲：
所述服务器1000包括中央处理单元(CPU)1001、包括随机存取存储器(RAM)1002和只读存储器(ROM)1003的系统存储器1004，以及连接系统存储器1004和中央处理单元1001的系统总线1005。所述服务器1000还包括帮助计算机内的各个器件之间传输信息的基本输入/输出系统(I/O系统)1006，和用于存储操作系统1013、应用程序1014和其他程序模块1015的大容量存储设备1007。
所述基本输入/输出系统1006包括有用于显示信息的显示器1008和用于用户输入信息的诸如鼠标、键盘之类的输入设备1009。其中所述显示器1008和输入设备1009都通过连接到系统总线1005的输入输出控制器1010连接到中央处理单元1001。所述基本输入/输出系统1006还可以包括输入输出控制器1010以用于接收和处理来自键盘、鼠标、或电子触控笔等多个其他设备的输入。类似地，输入输出控制器1010还提供输出到显示屏、打印机或其他类型的输出设备。
所述大容量存储设备1007通过连接到系统总线1005的大容量存储控制器(未示出)连接到中央处理单元1001。所述大容量存储设备1007及其相关联的计算机可读介质为服务器1000提供非易失性存储。也就是说，所述大容量存储设备1007可以包括诸如硬盘或者CD-ROM驱动器之类的计算机可读介质(未示出)。
不失一般性，所述计算机可读介质可以包括计算机存储介质和通信介质。 计算机存储介质包括以用于存储诸如计算机可读指令、数据结构、程序模块或其他数据等信息的任何方法或技术实现的易失性和非易失性、可移动和不可移动介质。计算机存储介质包括RAM、ROM、EPROM、EEPROM、闪存或其他固态存储其技术，CD-ROM、DVD或其他光学存储、磁带盒、磁带、磁盘存储或其他磁性存储设备。当然，本领域技术人员可知所述计算机存储介质不局限于上述几种。上述的系统存储器1004和大容量存储设备1007可以统称为存储器。
根据本申请的各种实施例，所述服务器1000还可以通过诸如因特网等网络连接到网络上的远程计算机运行。也即服务器1000可以通过连接在所述系统总线1005上的网络接口单元1011连接到网络1012，或者说，也可以使用网络接口单元1011来连接到其他类型的网络或远程计算机系统(未示出)。
所述存储器还包括一个或者一个以上的程序，所述一个或者一个以上程序存储于存储器中，且经配置以由一个或者一个以上处理器执行。所述一个或者一个以上程序包括用于执行上述方法的指令。
本申请一示例性实施例还提供了一种计算机可读存储介质，其上存储有计算机程序，该计算机程序能够被一处理器执行并实现上述鉴权方法。
本申请实施例提供的鉴权系统中包括业务接入服务器和鉴权逻辑服务器。业务接入服务器和鉴权逻辑服务器中均包含有计算机可读存储介质。当计算机可读存储介质位于不同的服务器时，其上可以存储有不同的计算机程序。例如，当计算机存储介质位于业务接入服务器时，该计算机可读存储介质可以称为第一计算机可读存储介质，第一计算机可读存储介质中存储有第一计算机程序。又例如，当计算机存储介质位于鉴权逻辑服务器时，该计算机可读存储介质可以称为第二计算机可读存储介质，第二计算机可读存储介质中存储有第二计算机程序。
本申请一示例性实施例提供了一种第一计算机可读存储介质，该第一计算机可读存储介质位于业务接入服务器中，其上存储有第一计算机程序，第一计算机程序能够被业务接入服务器的处理器执行，以实现上述方法示例中有关业务接入服务器侧的步骤流程。
本申请另一示例性实施例提供了一种第二计算机可读存储介质，该第二计算机可读存储介质位于鉴权逻辑服务器中，其上存储有第二计算机程序，第二 计算机程序能够被鉴权逻辑服务器的处理器执行，以实现上述方法示例中有关鉴权逻辑服务器侧的步骤流程。
应当理解的是，在本文中提及的“多个”和“至少两个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本申请的示例性实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (27)

  1. 一种鉴权系统，其特征在于，所述鉴权系统包括：业务接入层、鉴权逻辑层和数据存储层，所述业务接入层包括至少两个业务接入服务器，所述鉴权逻辑层包括至少两个鉴权逻辑服务器，所述数据存储层包括主数据库和至少两个从数据库；其中，所述至少两个业务接入服务器、所述至少两个鉴权逻辑服务器和所述至少两个从数据库均跨地域部署；
    所述业务接入层中的目标业务接入服务器，用于接收业务提供方发送的鉴权请求，其中，所述业务提供方与所述目标业务接入服务器位于同一地域，或者，所述业务提供方与所述目标业务接入服务器位于不同地域且所述业务提供方所处地域的业务接入服务器不可用；向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求；
    所述目标鉴权逻辑服务器，用于从目标从数据库中获取与所述鉴权请求相关的授权策略，所述目标从数据库用于存储与所述业务提供方提供的业务相关的授权策略；根据与所述鉴权请求相关的授权策略对所述鉴权请求进行分析处理，得到鉴权结果；向所述目标业务接入服务器发送所述鉴权结果；
    所述目标业务接入服务器，还用于向所述业务提供方发送所述鉴权结果。
  2. 根据权利要求1所述的鉴权系统，其特征在于，所述目标业务接入服务器，还用于：
    在接收到所述鉴权请求之后，判断所述目标业务接入服务器的缓存中是否已存储所述鉴权请求对应的鉴权结果；
    若已存储所述鉴权请求对应的鉴权结果，则从所述缓存中获取所述鉴权请求对应的鉴权结果，并执行所述向所述业务提供方发送所述鉴权结果的步骤；
    若未存储所述鉴权请求对应的鉴权结果，则执行所述向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求的步骤。
  3. 根据权利要求1或2所述的鉴权系统，其特征在于，所述目标业务接入服务器，还用于：
    当各个所述鉴权逻辑服务器均不可用时，根据默认授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
    其中，所述默认授权策略是指针对所有用户制定的通用的授权策略。
  4. 根据权利要求1至3任一项所述的鉴权系统，其特征在于，所述目标业务接入服务器，用于：
    根据各个所述鉴权逻辑服务器的服务质量，选择服务质量最优的鉴权逻辑服务器作为所述目标鉴权逻辑服务器；
    向所述目标鉴权逻辑服务器发送所述鉴权请求。
  5. 根据权利要求1至4任一项所述的鉴权系统，其特征在于，
    所述鉴权逻辑层中的至少一个鉴权逻辑服务器用于对与一个第一业务相关的鉴权请求进行处理，所述第一业务是指业务量大于预设阈值的业务；
    所述鉴权逻辑层中的至少一个鉴权逻辑服务器用于对与多个第二业务相关的鉴权请求进行处理，所述第二业务是指业务量小于预设阈值的业务。
  6. 根据权利要求5所述的鉴权系统，其特征在于，
    每一个鉴权逻辑服务器对应部署一个从数据库，所述从数据库中存储与所述鉴权逻辑服务器所处理的业务相关的授权策略；
    所述主数据库中存储与各个所述鉴权逻辑服务器所处理的业务相关的授权策略。
  7. 根据权利要求1至6任一项所述的鉴权系统，其特征在于，所述数据存储层包括主数据库服务器和至少两个从数据库服务器；其中，所述主数据库服务器中部署所述主数据库，每一个从数据库服务器中部署至少一个从数据库；
    所述主数据库服务器，用于根据对所述主数据库中存储的授权策略的更新操作，在所述主数据库服务器的日志文件中添加操作日志；对于每一个从数据库服务器，将所述主数据库服务器的日志文件中未同步给所述从数据库服务器的操作日志发送给所述从数据库服务器；
    所述从数据库服务器，用于将接收到的操作日志添加至所述从数据库服务器的日志文件中；执行所述从数据库服务器的日志文件中未执行的操作日志，以对所述从数据库服务器的从数据库中存储的授权策略进行更新。
  8. 一种鉴权方法，其特征在于，所述鉴权方法应用于鉴权系统中，所述鉴权系统包括：业务接入层、鉴权逻辑层和数据存储层，所述业务接入层包括至少两个业务接入服务器，所述鉴权逻辑层包括至少两个鉴权逻辑服务器，所述数据存储层包括主数据库和至少两个从数据库；其中，所述至少两个业务接入服务器、所述至少两个鉴权逻辑服务器和所述至少两个从数据库均跨地域部署；
    所述鉴权方法包括：
    所述业务接入层中的目标业务接入服务器接收业务提供方发送的鉴权请求，其中，所述业务提供方与所述目标业务接入服务器位于同一地域，或者，所述业务提供方与所述目标业务接入服务器位于不同地域且所述业务提供方所处地域的业务接入服务器不可用；向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求；
    所述目标鉴权逻辑服务器从目标从数据库中获取与所述鉴权请求相关的授权策略，所述目标从数据库用于存储与所述业务提供方提供的业务相关的授权策略；根据与所述鉴权请求相关的授权策略对所述鉴权请求进行分析处理，得到鉴权结果；向所述目标业务接入服务器发送所述鉴权结果；
    所述目标业务接入服务器向所述业务提供方发送所述鉴权结果。
  9. 根据权利要求8所述的鉴权方法，其特征在于，所述目标业务接入服务器接收业务提供方发送的鉴权请求之后，还包括：
    所述目标业务接入服务器判断所述目标业务接入服务器的缓存中是否已存储所述鉴权请求对应的鉴权结果；
    若已存储所述鉴权请求对应的鉴权结果，则所述目标业务接入服务器从所述缓存中获取所述鉴权请求对应的鉴权结果，并执行所述向所述业务提供方发送所述鉴权结果的步骤；
    若未存储所述鉴权请求对应的鉴权结果，则所述目标业务接入服务器执行所述向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求的步骤。
  10. 根据权利要求8或9所述的鉴权方法，其特征在于，所述目标业务接入服务器接收业务提供方发送的鉴权请求之后，还包括：
    当各个所述鉴权逻辑服务器均不可用时，所述目标业务接入服务器根据默认授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
    其中，所述默认授权策略是指针对所有用户制定的通用的授权策略。
  11. 根据权利要求8至10任一项所述的鉴权方法，其特征在于，所述目标业务接入服务器向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求，包括：
    所述目标业务接入服务器根据各个所述鉴权逻辑服务器的服务质量，选择服务质量最优的鉴权逻辑服务器作为所述目标鉴权逻辑服务器；
    所述目标业务接入服务器向所述目标鉴权逻辑服务器发送所述鉴权请求。
  12. 根据权利要求8至11任一项所述的鉴权方法，其特征在于，
    所述鉴权逻辑层中的至少一个鉴权逻辑服务器用于对与一个第一业务相关的鉴权请求进行处理，所述第一业务是指业务量大于预设阈值的业务；
    所述鉴权逻辑层中的至少一个鉴权逻辑服务器用于对与多个第二业务相关的鉴权请求进行处理，所述第二业务是指业务量小于预设阈值的业务。
  13. 根据权利要求12所述的鉴权方法，其特征在于，
    每一个鉴权逻辑服务器对应部署一个从数据库，所述从数据库中存储与所述鉴权逻辑服务器所处理的业务相关的授权策略；
    所述主数据库中存储与各个所述鉴权逻辑服务器所处理的业务相关的授权策略。
  14. 根据权利要求8至13任一项所述的鉴权方法，其特征在于，所述数据存储层包括主数据库服务器和至少两个从数据库服务器；其中，所述主数据库服务器中部署所述主数据库，每一个从数据库服务器中部署至少一个从数据库；
    所述鉴权方法还包括：
    所述主数据库服务器根据对所述主数据库中存储的授权策略的更新操作，在所述主数据库服务器的日志文件中添加操作日志；对于每一个从数据库服务器，将所述主数据库服务器的日志文件中未同步给所述从数据库服务器的操作日志发送给所述从数据库服务器；
    所述从数据库服务器将接收到的操作日志添加至所述从数据库服务器的日志文件中；执行所述从数据库服务器的日志文件中未执行的操作日志，以对所 述从数据库服务器的从数据库中存储的授权策略进行更新。
  15. 一种鉴权方法，其特征在于，所述鉴权方法应用于鉴权系统中的目标业务接入服务器中，所述鉴权系统包括：业务接入层、鉴权逻辑层和数据存储层，所述业务接入层包括至少两个业务接入服务器，所述鉴权逻辑层包括至少两个鉴权逻辑服务器，所述数据存储层包括主数据库和至少两个从数据库；其中，所述至少两个业务接入服务器、所述至少两个鉴权逻辑服务器和所述至少两个从数据库均跨地域部署；
    所述鉴权方法包括：
    接收业务提供方发送的鉴权请求；其中，所述业务提供方与所述目标业务接入服务器位于同一地域，或者，所述业务提供方与所述目标业务接入服务器位于不同地域且所述业务提供方所处地域的业务接入服务器不可用；
    向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求；所述目标鉴权逻辑服务器用于从目标从数据库中获取与所述鉴权请求相关的授权策略，所述目标从数据库用于存储与所述业务提供方提供的业务相关的授权策略，根据与所述鉴权请求相关的授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
    接收所述目标鉴权逻辑服务器发送的所述鉴权结果；
    向所述业务提供方发送所述鉴权结果。
  16. 根据权利要求15所述的方法，其特征在于，所述接收业务提供方发送的鉴权请求之后，还包括：
    判断所述目标业务接入服务器的缓存中是否已存储所述鉴权请求对应的鉴权结果；
    若已存储所述鉴权请求对应的鉴权结果，则从所述缓存中获取所述鉴权请求对应的鉴权结果，并执行所述向所述业务提供方发送所述鉴权结果的步骤；
    若未存储所述鉴权请求对应的鉴权结果，则执行所述向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求的步骤。
  17. 根据权利要求15或16所述的方法，其特征在于，所述接收业务提供方发送的鉴权请求之后，还包括：
    当各个所述鉴权逻辑服务器均不可用时，根据默认授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
    其中，所述默认授权策略是指针对所有用户制定的通用的授权策略。
  18. 根据权利要求15至17任一项所述的方法，其特征在于，所述向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求，包括：
    根据各个所述鉴权逻辑服务器的服务质量，选择服务质量最优的鉴权逻辑服务器作为所述目标鉴权逻辑服务器；
    向所述目标鉴权逻辑服务器发送所述鉴权请求。
  19. 一种服务器，其特征在于，所述服务器为鉴权系统中的目标业务接入服务器，所述鉴权系统包括：业务接入层、鉴权逻辑层和数据存储层，所述业务接入层包括至少两个业务接入服务器，所述鉴权逻辑层包括至少两个鉴权逻辑服务器，所述数据存储层包括主数据库和至少两个从数据库；其中，所述至少两个业务接入服务器、所述至少两个鉴权逻辑服务器和所述至少两个从数据库均跨地域部署；
    所述服务器包括：
    请求接收模块，用于接收业务提供方发送的鉴权请求；其中，所述业务提供方与所述目标业务接入服务器位于同一地域，或者，所述业务提供方与所述目标业务接入服务器位于不同地域且所述业务提供方所处地域的业务接入服务器不可用；
    请求发送模块，用于向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求；所述目标鉴权逻辑服务器用于从目标从数据库中获取与所述鉴权请求相关的授权策略，所述目标从数据库用于存储与所述业务提供方提供的业务相关的授权策略，目标鉴权逻辑服务器还用于根据与所述鉴权请求相关的授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
    结果接收模块，用于接收所述目标鉴权逻辑服务器发送的所述鉴权结果；
    结果发送模块，用于向所述业务提供方发送所述鉴权结果。
  20. 根据权利要求19所述的服务器，其特征在于，所述服务器还包括：
    判断模块，用于判断所述目标业务接入服务器的缓存中是否已存储所述鉴 权请求对应的鉴权结果；
    结果获取模块，用于若已存储所述鉴权请求对应的鉴权结果，则从所述缓存中获取所述鉴权请求对应的鉴权结果，并通过所述结果发送模块向所述业务提供方发送所述鉴权结果；
    所述请求发送模块，还用于若未存储所述鉴权请求对应的鉴权结果，则向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求。
  21. 根据权利要求19或20所述的服务器，其特征在于，所述服务器还包括：
    请求处理模块，用于当各个所述鉴权逻辑服务器均不可用时，根据默认授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
    其中，所述默认授权策略是指针对所有用户制定的通用的授权策略。
  22. 根据权利要求19至21任一项所述的服务器，其特征在于，
    所述请求发送模块，还用于根据各个所述鉴权逻辑服务器的服务质量，选择服务质量最优的鉴权逻辑服务器作为所述目标鉴权逻辑服务器；向所述目标鉴权逻辑服务器发送所述鉴权请求。
  23. 一种服务器，其特征在于，所述服务器为鉴权系统中的目标业务接入服务器，所述鉴权系统包括：业务接入层、鉴权逻辑层和数据存储层，所述业务接入层包括至少两个业务接入服务器，所述鉴权逻辑层包括至少两个鉴权逻辑服务器，所述数据存储层包括主数据库和至少两个从数据库；其中，所述至少两个业务接入服务器、所述至少两个鉴权逻辑服务器和所述至少两个从数据库均跨地域部署；
    所述服务器包括：
    一个或多个处理器；和，
    存储器；
    所述存储器存储有一个或多个程序，所述一个或多个程序被配置成由所述一个或多个处理器执行，所述一个或多个程序包含用于执行以下操作的指令：
    接收业务提供方发送的鉴权请求；其中，所述业务提供方与所述目标业务接入服务器位于同一地域，或者，所述业务提供方与所述目标业务接入服务器 位于不同地域且所述业务提供方所处地域的业务接入服务器不可用；
    向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求；所述目标鉴权逻辑服务器用于从目标从数据库中获取与所述鉴权请求相关的授权策略，所述目标从数据库用于存储与所述业务提供方提供的业务相关的授权策略，根据与所述鉴权请求相关的授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
    接收所述目标鉴权逻辑服务器发送的所述鉴权结果；
    向所述业务提供方发送所述鉴权结果。
  24. 根据权利要求23所述的服务器，其特征在于，所述一个或多个程序还包含用于执行以下操作的指令：
    判断所述目标业务接入服务器的缓存中是否已存储所述鉴权请求对应的鉴权结果；
    若已存储所述鉴权请求对应的鉴权结果，则从所述缓存中获取所述鉴权请求对应的鉴权结果，并向所述业务提供方发送所述鉴权结果；
    若未存储所述鉴权请求对应的鉴权结果，则向所述鉴权逻辑层中的目标鉴权逻辑服务器发送所述鉴权请求。
  25. 根据权利要求23或24所述的服务器，其特征在于，所述一个或多个程序还包含用于执行以下操作的指令：
    当各个所述鉴权逻辑服务器均不可用时，根据默认授权策略对所述鉴权请求进行分析处理，得到鉴权结果；
    其中，所述默认授权策略是指针对所有用户制定的通用的授权策略。
  26. 根据权利要求23至25任一项所述的服务器，其特征在于，所述一个或多个程序还包含用于执行以下操作的指令：
    根据各个所述鉴权逻辑服务器的服务质量，选择服务质量最优的鉴权逻辑服务器作为所述目标鉴权逻辑服务器；
    向所述目标鉴权逻辑服务器发送所述鉴权请求。
  27. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所 述计算机程序能够被一处理器执行并实现如权利要求8至14中任一项所述的鉴权方法，或者，实现如权利要求15至18中任一项所述的鉴权方法。
PCT/CN2018/072119 2017-01-19 2018-01-10 鉴权系统、方法及服务器 WO2018133721A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710046587.3 2017-01-19
CN201710046587.3A CN106815099B (zh) 2017-01-19 2017-01-19 鉴权系统和方法

Publications (1)

Publication Number Publication Date
WO2018133721A1 true WO2018133721A1 (zh) 2018-07-26

Family

ID=59111979

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/072119 WO2018133721A1 (zh) 2017-01-19 2018-01-10 鉴权系统、方法及服务器

Country Status (2)

Country Link
CN (1) CN106815099B (zh)
WO (1) WO2018133721A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113239377A (zh) * 2021-05-14 2021-08-10 北京百度网讯科技有限公司 权限控制方法、装置、设备以及存储介质

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106815099B (zh) * 2017-01-19 2020-09-18 腾讯科技（深圳）有限公司 鉴权系统和方法
CN108092996B (zh) * 2018-01-29 2020-02-28 平安科技（深圳）有限公司 一种鉴权通道选取方法及终端设备
CN110266742B (zh) * 2018-03-12 2020-10-09 大唐移动通信设备有限公司 鉴权数据的处理方法、鉴权数据服务器及鉴权系统
CN111277592B (zh) * 2018-06-27 2022-06-10 贵州白山云科技股份有限公司 一种鉴权方法、装置、存储介质及计算机设备
CN109840402B (zh) * 2018-12-19 2021-11-23 北京百度网讯科技有限公司 私有化服务授权管理方法、装置、计算机设备及存储介质
CN109828852B (zh) * 2019-01-23 2021-09-24 北京奇艺世纪科技有限公司 一种权限管理方法、装置、系统、设备及可读存储介质
CN110309669B (zh) * 2019-06-12 2023-10-20 创新先进技术有限公司 一种数据标注方法、装置及设备
CN110990868B (zh) * 2019-11-29 2023-02-10 花瓣云科技有限公司 应用登录及应用访问应用服务器的方法、电子设备
CN112948842A (zh) * 2019-12-10 2021-06-11 华为技术有限公司 一种鉴权方法及相关设备
CN112055024B (zh) * 2020-09-09 2023-08-22 深圳市欢太科技有限公司 权限校验方法及装置、存储介质和电子设备
CN112668059A (zh) * 2021-03-16 2021-04-16 浙江华创视讯科技有限公司 会议授权控制方法、装置、电子设备、系统及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050154915A1 (en) * 2004-01-09 2005-07-14 Peterson Matthew T. Networked computer user identification and authentication apparatus method and system
CN101005636A (zh) * 2006-12-08 2007-07-25 杭州诚智天扬科技有限公司 移动一机多号业务系统及其应用
CN101106509A (zh) * 2006-07-14 2008-01-16 中兴通讯股份有限公司 一种语音浏览系统
CN101202650A (zh) * 2006-12-13 2008-06-18 中兴通讯股份有限公司 一种wap业务管理系统和方法
CN106815099A (zh) * 2017-01-19 2017-06-09 腾讯科技（深圳）有限公司 鉴权系统和方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1287578C (zh) * 2004-01-13 2006-11-29 中兴通讯股份有限公司 一种通过路由服务器实现用户异地漫游业务的系统及方法
CN101137222B (zh) * 2007-01-18 2013-06-05 中兴通讯股份有限公司 一种接入鉴权处理方法和系统及装置
CN101583024B (zh) * 2009-06-04 2011-06-22 中兴通讯股份有限公司 分布式网络视频监控系统及其注册控制方法
US8195819B1 (en) * 2009-07-13 2012-06-05 Sprint Communications Company L.P. Application single sign on leveraging virtual local area network identifier
CN103595816B (zh) * 2013-11-25 2017-01-04 国家电网公司 电力营销一体化催费平台系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050154915A1 (en) * 2004-01-09 2005-07-14 Peterson Matthew T. Networked computer user identification and authentication apparatus method and system
CN101106509A (zh) * 2006-07-14 2008-01-16 中兴通讯股份有限公司 一种语音浏览系统
CN101005636A (zh) * 2006-12-08 2007-07-25 杭州诚智天扬科技有限公司 移动一机多号业务系统及其应用
CN101202650A (zh) * 2006-12-13 2008-06-18 中兴通讯股份有限公司 一种wap业务管理系统和方法
CN106815099A (zh) * 2017-01-19 2017-06-09 腾讯科技（深圳）有限公司 鉴权系统和方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113239377A (zh) * 2021-05-14 2021-08-10 北京百度网讯科技有限公司 权限控制方法、装置、设备以及存储介质
CN113239377B (zh) * 2021-05-14 2024-05-17 北京百度网讯科技有限公司 权限控制方法、装置、设备以及存储介质

Also Published As

Publication number Publication date
CN106815099A (zh) 2017-06-09
CN106815099B (zh) 2020-09-18

Similar Documents

Publication Publication Date Title
WO2018133721A1 (zh) 鉴权系统、方法及服务器
CN113169952B (zh) 一种基于区块链技术的容器云管理系统
JP7304117B2 (ja) ブロックチェーン上のプロキシ・エージェントおよびプロキシ台帳
US10375201B2 (en) Identity and policy enforced inter-cloud and intra-cloud channel
CN102947797B (zh) 使用横向扩展目录特征的在线服务访问控制
WO2021115449A1 (zh) 跨域访问系统、方法及装置、存储介质及电子装置
JP6013594B2 (ja) ローカル支援されるクラウドベースのストレージ
US8745205B2 (en) System and method for intelligent workload management
US11689616B2 (en) Optimization of delivery of blocks
US20050015471A1 (en) Secure cluster configuration data set transfer protocol
WO2021115231A1 (zh) 一种鉴权方法和相关设备
JPWO2006082732A1 (ja) アクセス制御装置
JP2000122974A (ja) ネットワークシステム及びコマンド使用権限制御方法ならびに制御プログラムを格納した記憶媒体
US20240248810A1 (en) Systems and methods for cross-regional back up of distributed databases on a cloud service
US9930063B2 (en) Random identifier generation for offline database
CN112291298A (zh) 异构系统的数据传输方法、装置、计算机设备和存储介质
US20200374340A1 (en) Optimization of delivery of blocks
KR20240047413A (ko) 데이터 공유 방법, 네트워크 측 장치, 시스템, 전자 장치 및 저장 매체
KR20130114575A (ko) 프로비저닝 서비스를 위한 리더 중재
CN117131493A (zh) 权限管理系统构建方法、装置、设备及存储介质
KR101993309B1 (ko) 클라우드계정을 이용한 서비스내부데이터 저장방법 및 프로그램
US20220255970A1 (en) Deploying And Maintaining A Trust Store To Dynamically Manage Web Browser Extensions On End User Computing Devices
US20070050681A1 (en) Global user services management for system cluster
US20050005170A1 (en) Minimizing information gathered by access decision engines in access control systems
WO2024092928A1 (zh) 基于区块链的多实例组网方法及装置和电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18741810

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18741810

Country of ref document: EP

Kind code of ref document: A1