WO2019047064A1

WO2019047064A1 - Permission control method, and server end

Info

Publication number: WO2019047064A1
Application number: PCT/CN2017/100719
Authority: WO
Inventors: 梁锦友
Original assignee: 深圳峰创智诚科技有限公司
Priority date: 2017-09-06
Filing date: 2017-09-06
Publication date: 2019-03-14

Abstract

Provided is a permission control method. The method comprises: receiving a request message, sent by an external calling program, for calling an application program interface, wherein the request message comprises a token; verifying identity information and permission information about the token; if the verification of the identity information and permission information about the token is passed, allowing the external calling program to call the application program interface; and if the verification of the identity information and permission information about the token fails, returning a prompt of verification failure to the external calling program. Further disclosed is a server end. The permission control method and the server end provided in the present invention can fully control the access permissions of various application program interfaces and improve the security of a service code in the application program interfaces.

Description

Authority control method and server

Technical field

The present invention relates to the field of communications technologies, and in particular, to a rights control method and a server.

Background technique

With the increasing size of software, in order to save software writing time, the application interface is often called in software. The main purpose of the application interface is to provide applications and developers with the ability to access a set of routines without accessing the source code. Or understand the details of the internal working mechanism. Communication between software can be achieved through an application interface. By using an application interface, you can avoid writing useless programs to ease programming tasks. However, in the process of calling the application interface by the external application, the server cannot control the access rights of each application interface well, which causes the security of the service in the application interface to be relatively low.

technical problem

The main purpose of the present invention is to solve the problem that the current server is not able to control the access rights of each application interface well in the process of being invoked by the application, resulting in a relatively low security of the service in the application interface.

Technical solution

To achieve the above object, the present invention provides a method for controlling rights, which is applied to a server, and the method for controlling rights includes:

Receiving a request message sent by an external calling program to invoke an application interface, where the request message includes a token;

Verifying identity information and permission information of the token;

Allowing the external calling program to call the application program interface if the identity information and the rights information of the token are verified to pass;

If the identity information and the authority information of the token fail to be verified, a prompt for verification failure is returned to the external calling program.

Preferably, the step of receiving the request message of the calling application interface sent by the external calling program further includes:

Receiving identity information sent by the external calling program, generating a token according to the identity information, transmitting the token to the external calling program, and storing the token.

Preferably, the step of generating a token according to the identity information includes:

And setting the corresponding authority information to the identity information, and performing the encryption process on the identity information and the rights information to obtain the token.

Preferably, the step of verifying the identity information and the rights information of the token comprises:

Decrypting the token to obtain the identity information and the rights information included in the token;

Determining whether the identity information and the permission information satisfy a verification condition of the application program interface;

If the identity information and the rights information meet the verification condition of the application program interface, the identity information and the rights information of the token are verified;

If the identity information and the rights information do not satisfy the verification condition of the application interface, the identity information and the rights information of the token are failed to be verified.

Preferably, if the token is verified by identity and rights, the step of allowing the external caller to invoke the application interface further includes:

Returning the business data corresponding to the application interface to the external calling program.

In addition, to achieve the above object, the present invention further provides a server, where the server includes:

a receiving module, configured to receive a request message sent by an external calling program to invoke an application interface, where the request message includes a token;

a verification module, configured to verify identity information and rights information of the token;

a processing module, configured to allow the external calling program to invoke the application program interface if the identity information and the permission information of the token are verified to pass;

The prompting module is configured to: if the identity information and the permission information of the token fail to be verified, return a prompt for verifying failure to the external calling program.

Preferably, the server further includes:

And a generating module, configured to receive identity information sent by the external calling program, generate a token according to the identity information, send the token to the external calling program, and store the token.

Preferably, the generating module is further configured to set corresponding authority information to the identity information, and perform encryption processing on the identity information and the rights information to obtain the token.

Preferably, the verification module is configured to perform decryption processing on the token, obtain the identity information and the rights information included in the token, and determine whether the identity information and the rights information meet the requirements. Determining an authentication condition of the application program interface, if the identity information and the rights information meet the verification condition of the application program interface, the identity information and the rights information of the token are verified, if the identity information and the If the permission information does not satisfy the verification condition of the application interface, the identity information and the permission information of the token are failed to be verified.

Preferably, the server further includes:

And a transmission module, configured to return, to the external calling program, service data corresponding to the application program interface.

Beneficial effect

The permission control method and the server provided by the invention verify the token sent by the external calling program, and when the verification passes, the external calling program is allowed to call the application program interface, and the access authority of each application program interface can be well controlled. Improve the security of business code in the application interface.

DRAWINGS

1 is a schematic flow chart of an embodiment of an authority control method according to the present invention;

2 is a schematic diagram of a specific refinement process for verifying identity information and authority information of the token in step 20 of FIG. 1;

3 is a schematic diagram of functional modules of an embodiment of a server according to the present invention;

4 is a schematic diagram of functional modules of another embodiment of a server according to the present invention;

FIG. 5 is a schematic diagram of functional modules of another embodiment of a server according to the present invention.

The implementation, functional features, and advantages of the present invention will be further described in conjunction with the embodiments.

Embodiments of the invention

The preferred embodiments described herein are to be construed as illustrative only and not limiting.

Referring to FIG. 1 , FIG. 1 is a flowchart of a method for controlling rights according to an embodiment of the present invention. The method for controlling rights is applied to a server. As shown in FIG. 1 , the method for controlling rights includes the following steps:

Step S10: Receive a request message sent by an external calling program to invoke an application interface, where the request message includes a token.

In the above embodiment, the external calling program may be a client installed on the mobile terminal or a web application. When the external caller wants to call an application interface, it needs to send a request message to the server to call the application interface. In order to perform the permission verification, the token needs to be sent to the server. The token has permission to request an interface within a specified valid time.

In the above embodiment, before step 10, the method may include the steps of: receiving identity information sent by the external calling program, generating a token according to the identity information, sending the token to the external calling program, and storing the token Token. Specifically, the token may be obtained by performing an encryption process on the identity information by using an encryption algorithm, where the encryption algorithm may be an RSA encryption algorithm or a symmetric encryption algorithm.

In the above embodiment, the identity information includes account information, visitor information, and/or trial account information. The account information indicates that the user has completed registration and has complete registered account information, and the visitor information indicates that the user accessing the device is an unregistered user. The user information is incomplete. The trial account information can be the information of the identification device, such as the MAC address or other identification information of the device. By using the trial account information, the user can preset the preset permission on the device within the trial duration. Some application interfaces only authorize the registration of user accounts that have been registered. Some application interfaces can be authorized to be called for incomplete visitors. Some application interfaces can authorize calls to trial accounts. The application interface can be labeled differently: the first is the application interface for the visitor to access the tag; the second is the application interface for the user login tag; and the third is the application interface for the trial account login tag.

In the above embodiment, after the external caller receives the token, if the external caller wants to call an application interface, the token may be sent to the server to request the corresponding application interface to be called from the server.

In the foregoing embodiment, the step of generating a token according to the identity information may include the following steps: setting corresponding rights information to the identity information, and performing encryption processing on the identity information and the rights information to obtain a Describe the token.

Specifically, if the identity information is account information, the account information is set with the permission information corresponding to the application interface of the user login tag; if the identity information is the visitor information, the application interface of the visitor information setting and the visitor access tag is set. Corresponding permission information.

In the above embodiment, the identity information and the rights information are encrypted, which can prevent important information from leaking and ensure information security.

Step S20: Verify identity information and rights information of the token.

In the above embodiment, the token is encrypted data, and after the token is decrypted, the decrypted token is authenticated by the identity information and the authority information. Specifically, the token can be encrypted by the public key of the RSA encryption algorithm, and the token can be decrypted by the private key of the RSA encryption algorithm. The token can also be encrypted by the encryption key of the symmetric encryption algorithm, and can be symmetrically encrypted. The inverse operation of the encryption key of the algorithm is decrypted, and the encryption algorithm may also be other algorithms, which is not limited herein.

Step 30: If the identity information and the rights information of the token are verified to pass, the external calling program is allowed to invoke the application program interface.

In the above embodiment, if the server verifies the identity information and the authority information of the token, indicating that the server has authorized the external calling program to invoke the application interface, the server allows the external calling program to invoke the application interface, that is, the server. Allows the external caller to call the business data of the application interface.

In the above embodiment, after step 30, the method may further include the step of: returning, to the external calling program, service data corresponding to the application program interface.

In this way, after the external caller receives the service data returned by the server, the call of the application program interface can be quickly completed, the time for running the program is saved, and the execution efficiency of the external call program is improved.

Step 40: If the identity information and the authority information of the token fail to be verified, return a prompt for verification failure to the external calling program.

In the above embodiment, if the server fails to verify the identity information and the authority information of the token, indicating that the server does not authorize the external caller to invoke the application interface, the server prohibits the external caller from calling the application interface, ie, the service. The external calling program is prohibited from calling the business data of the application interface. At this time, the external calling program needs to return a prompt for the verification failure, and the prompt may include prompt information such as a user account error or a password error.

Please refer to FIG. 2. FIG. 2 is a schematic diagram of a specific refinement process for verifying identity information and authority information of the token in step 20 of FIG.

Step S21: Perform decryption processing on the token to obtain the identity information and the rights information included in the token.

In the above embodiment, the token is encrypted data, and after the token is decrypted, the corresponding identity information and the authority information are obtained from the decrypted token. There are various encryption methods. The server can encrypt the identity information and the authority information according to the encryption method. Specifically, the server can encrypt the identity information and the authority information through the public key of the RSA encryption algorithm to obtain the token. The token can be decrypted by the private key of the RSA encryption algorithm to obtain corresponding identity information and authority information.

Step 22: Determine whether the identity information and the rights information meet the verification condition of the application program interface.

In this embodiment, the verification condition of the application program interface includes an identity verification condition and a rights verification condition. When the identity information satisfies the identity verification condition and the rights information satisfies the rights verification condition, the identity information and the rights information are satisfied. The verification condition of the application interface.

Step 23: If the identity information and the rights information meet the verification condition of the application program interface, the identity information and the rights information of the token are verified.

Specifically, when the identity information satisfies the identity verification condition and the rights information satisfies the rights verification condition, the identity information and the rights information of the token are verified.

Step 24: If the identity information and the rights information do not satisfy the verification condition of the application interface, the identity information and the rights information of the token are failed to be verified.

Specifically, when the identity information does not satisfy the identity verification condition, or the rights information does not satisfy the rights verification condition, the identity information and the rights information of the token are failed to be verified.

The permission control method provided by the invention verifies the token sent by the external calling program, and when the verification passes, the external calling program is allowed to call the application program interface, which can well control the access rights of each application program interface, and improve the application program. The security of the business code in the interface.

The invention further provides a server. FIG. 3 is a schematic diagram of functional modules of an embodiment of a server according to the present invention. In this embodiment, the server 100 includes a receiving module 101, a verification module 102, a processing module 103, and a prompting module 104. The receiving module 101 is configured to receive a request message sent by an external calling program to invoke an application interface, where the request message includes a token. The verification module 102 is configured to verify identity information and rights information of the token. The processing module 103 is configured to allow the external calling program to invoke the application program interface if the identity information and the rights information of the token are verified. The prompting module 104 is configured to return a prompt for verification failure to the external calling program if the identity information and the authority information of the token fail to be verified.

In the above embodiment, if the server fails to verify the identity information and the authority information of the token, indicating that the server does not authorize the external caller to invoke the application interface, the server prohibits the external caller from calling the application interface, ie, the service. The external calling program is prohibited from calling the business data of the application interface. At this time, the external calling program needs to return a prompt for the verification failure, and the prompt may include information such as a user account error or a password error.

In the foregoing embodiment, the verification module 102 is specifically configured to perform decryption processing on the token, obtain the identity information and the rights information included in the token, and determine the identity information and the rights information. Whether the authentication condition of the application program interface is met, and if the identity information and the rights information satisfy the verification condition of the application program interface, the identity information and the rights information of the token are verified, if the identity information is And the permission information does not satisfy the verification condition of the application program interface, and the identity information and the rights information of the token are failed to be verified.

In the above embodiment, the token is encrypted data, and after the token is decrypted, the corresponding identity information and the authority information may be obtained from the decrypted token. There are various encryption methods. The server can encrypt the identity information and the authority information according to the encryption method. Specifically, the server can encrypt the identity information and the authority information through the public key of the RSA encryption algorithm to obtain the token. The token can be decrypted by the private key of the RSA encryption algorithm to obtain corresponding identity information and authority information.

Specifically, when the identity information satisfies the identity verification condition and the rights information satisfies the rights verification condition, the identity information and the rights information of the token are verified. When the identity information does not satisfy the identity verification condition, or the rights information does not satisfy the rights verification condition, the identity information and the rights information of the token are failed to be verified.

Please refer to FIG. 4. FIG. 4 is a functional block diagram of another server according to an embodiment of the present invention. The embodiment shown in FIG. 4 is based on the addition of the generation module 105 to the server 100 shown in FIG. 3, wherein:

The generating module 105 is configured to receive identity information sent by the external calling program, generate a token according to the identity information, send the token to the external calling program, and store the token. Specifically, the token may be obtained by performing an encryption process on the identity information by using an encryption algorithm, where the encryption algorithm may be an RSA encryption algorithm or a symmetric encryption algorithm.

In the above embodiment, the identity information includes account information, visitor information, and/or trial account information. The account information indicates that the user has completed registration, the server has complete registered account information, and the visitor information indicates that the user accessing the device is an uncompleted registration. User, the user data of the server is incomplete. The trial account information can be the information of the identification device, such as the MAC address or other identification information of the device. By using the account information, the user can preset the default permission on the device within the trial period. . Some application interfaces only call the registered account authorization. Some application interfaces can be authorized to call the incomplete user information. Some application interfaces can authorize the trial account. The application interface can be tagged according to requirements: the first type is the application interface for the visitor to access the tag; the second is the application interface for the user login tag; and the third is the application interface for the trial account login tag.

The generating module 105 is further configured to set corresponding authority information to the identity information, and perform encryption processing on the identity information and the rights information to obtain the token.

Please refer to FIG. 5. FIG. 5 is a functional block diagram of another server according to an embodiment of the present invention. The embodiment shown in FIG. 5 is based on the addition of the transmission module 106 to the server 100 shown in FIG. 3, wherein:

The transmission module 106 is configured to return, to the external calling program, service data corresponding to the application program interface.

The server provided by the invention verifies the token sent by the external calling program, and when the verification passes, the external calling program is allowed to call the application program interface, which can well control the access rights of each application program interface, and improve the application program interface. The security of the business code.

The above are only the preferred embodiments of the present invention, and are not intended to limit the scope of the invention, and the equivalent structure or equivalent process transformations made by the description of the present invention and the drawings are directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of the present invention.

Claims

A method for controlling rights, characterized in that the method for controlling rights includes:

Receiving a request message sent by an external calling program to invoke an application interface, where the request message includes a token;

Verifying identity information and permission information of the token;

Allowing the external calling program to call the application program interface if the identity information and the rights information of the token are verified to pass;

If the identity information and the authority information of the token fail to be verified, a prompt for verification failure is returned to the external calling program.
The access control method according to claim 1, wherein the step of receiving the request message of the calling application interface sent by the external calling program further comprises:

Receiving identity information sent by the external calling program, generating a token according to the identity information, transmitting the token to the external calling program, and storing the token.
The access control method according to claim 2, wherein the step of generating a token according to the identity information comprises:

And setting the corresponding authority information to the identity information, and performing the encryption process on the identity information and the rights information to obtain the token.
The access control method according to claim 3, wherein the step of verifying the identity information and the rights information of the token comprises:

Decrypting the token to obtain the identity information and the rights information included in the token;

Determining whether the identity information and the permission information satisfy a verification condition of the application program interface;

If the identity information and the rights information meet the verification condition of the application program interface, the identity information and the rights information of the token are verified;

If the identity information and the rights information do not satisfy the verification condition of the application interface, the identity information and the rights information of the token are failed to be verified.
The privilege control method according to claim 1, wherein if the token is authenticated by identity and authority, the step of allowing the external caller to invoke the application interface further includes:

Returning the business data corresponding to the application interface to the external calling program.
A server, characterized in that it comprises:

a receiving module, configured to receive a request message sent by an external calling program to invoke an application interface, where the request message includes a token;

a verification module, configured to verify identity information and rights information of the token;

a processing module, configured to allow the external calling program to invoke the application program interface if the identity information and the permission information of the token are verified to pass;

The prompting module is configured to: if the identity information and the permission information of the token fail to be verified, return a prompt for verifying failure to the external calling program.
The server according to claim 6, further comprising:

And a generating module, configured to receive identity information sent by the external calling program, generate a token according to the identity information, send the token to the external calling program, and store the token.
The server according to claim 7, wherein the generating module is further configured to set corresponding authority information for the identity information, and encrypt the identity information and the rights information to obtain a Describe the token.
The server according to claim 8, wherein the verification module is configured to decrypt the token, obtain the identity information and the permission information included in the token, and determine the location Determining whether the identity information and the rights information satisfy the verification condition of the application program interface, if the identity information and the rights information satisfy the verification condition of the application program interface, the identity information and the rights information of the token If the identity information and the rights information do not satisfy the verification condition of the application interface, the identity information and the rights information of the token are failed to be verified.
The server according to claim 6, further comprising:

And a transmission module, configured to return, to the external calling program, service data corresponding to the application program interface.