WO2021135255A1 - 基于消息队列的行列权限管理的方法及相关装置 - Google Patents

基于消息队列的行列权限管理的方法及相关装置 Download PDF

Info

Publication number
WO2021135255A1
WO2021135255A1 PCT/CN2020/109047 CN2020109047W WO2021135255A1 WO 2021135255 A1 WO2021135255 A1 WO 2021135255A1 CN 2020109047 W CN2020109047 W CN 2020109047W WO 2021135255 A1 WO2021135255 A1 WO 2021135255A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
message
topic
target user
authority
Prior art date
Application number
PCT/CN2020/109047
Other languages
English (en)
French (fr)
Inventor
钟斌
Original Assignee
深圳云天励飞技术股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳云天励飞技术股份有限公司 filed Critical 深圳云天励飞技术股份有限公司
Publication of WO2021135255A1 publication Critical patent/WO2021135255A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services

Definitions

  • This application relates to the field of computer technology, and in particular to a method and related devices for managing ranks and permissions based on message queues.
  • MQ Message Queuing
  • MQ Message Queuing
  • MQ has become the core of the entire software system, and 90% of cross-component communication traffic is carried on message queues.
  • MQ mainly completes the following core responsibilities: interaction and communication within components, connecting the internal processing flow of the software system, and realizing the interaction between the software system and the outside through the input and output of messages.
  • the embodiment of the present application provides a method and related device for queue authority management based on a message queue that can ensure the security of MQ without destroying the native characteristics of MQ.
  • a method for managing rank rights based on message queues is characterized in that it is applied to a rights management system, and the rights management system includes a message receiving end message queue MQ, a message rebirth module, a rights configuration module, and an MQ service interface Gateway and message sender MQ, the method includes:
  • the message receiving terminal MQ receives the initial message, and sends the initial message to the message regeneration module;
  • the message regeneration module receives the subscription information of the target user sent from the MQ service interface gateway;
  • the message regeneration module receives the rank and rank authority information of the target user sent from the authority configuration module;
  • the message regeneration module receives the initial message, filters the initial message according to the subscription information and the rank authority information of the target user, generates a target message and topic routing unit, and uses the topic routing unit to send the message to the message
  • the sending end MQ sends the target message
  • the message sender MQ After receiving the target message, the message sender MQ sends the target message to the target client.
  • a message queue-based queue authority management device is characterized in that it is applied to an authority management system.
  • the authority management system includes a message receiving end message queue MQ, a message rebirth module, an authority configuration module, and an MQ service interface gateway With the message sender MQ, the rank authority management device includes a communication unit and a processing unit, wherein:
  • the processing unit is configured to control the message receiving terminal MQ to receive the initial message and send the initial message to the message regeneration module;
  • the processing unit is further configured to control the message rebirth module to receive the subscription information of the target user sent by the MQ service interface gateway;
  • the processing unit is further configured to control the message regeneration module to receive the rank authority information of the target user sent from the authority configuration module;
  • the processing unit is further configured to control the message regeneration module to receive the initial message, and filter the initial message according to the subscription information and the rank authority information of the target user to generate a target message and topic routing unit, and use The topic routing unit sends the target message to the message sender MQ;
  • the processing unit is further configured to control the message sender MQ to send the target message to the target client after receiving the target message.
  • an embodiment of the present application provides an electronic device, including a processor, a memory, a communication interface, and one or more programs, wherein the one or more programs are stored in the memory and configured to be processed by the above
  • the above program includes instructions for executing the steps in the first aspect of the embodiments of the present application.
  • an embodiment of the present application provides a chip that includes a processor and a data interface.
  • the processor reads instructions stored on a memory through the data interface, and executes the above-mentioned first to third aspects and any An alternative implementation method.
  • an embodiment of the present application provides a computer-readable storage medium, wherein the above-mentioned computer-readable storage medium stores a computer program for electronic data exchange, wherein the above-mentioned computer program enables a computer to execute Some or all of the steps described in one aspect.
  • the embodiments of the present application provide a computer program product, wherein the above-mentioned computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the above-mentioned computer program is operable to cause a computer to execute as implemented in this application.
  • the computer program product may be a software installation package.
  • the dual-instance structure deployment of the message receiving end MQ and the message sending end MQ is used, and the message rebirth module, the permission configuration module, and the MQ service interface gateway are set up between the two ends to manage the message queue.
  • Rank permissions Compared with the single-instance native MQ, for message producers and message consumers, it is still message production and message reception, which realizes the management of permissions, and does not affect the message producers and message producers. Consumers increase the consumption of additional resources, so that the authority management process not only guarantees the security of MQ, but also does not destroy the original characteristics of MQ.
  • Figure 1 is a schematic structural diagram of a rights management system provided by an embodiment of the present application.
  • 2A is a schematic flowchart of a method for rights management based on a message queue provided by an embodiment of the present application
  • 2B is a schematic diagram of functional units of a message rebirth module provided by an embodiment of the present application.
  • 2C is a schematic diagram of a cache structure for row permissions provided by an embodiment of the present application.
  • 2D is a schematic diagram of a cache structure for column permissions provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of another permission management method based on a message queue provided by an embodiment of the present application
  • FIG. 4 is a schematic diagram of functional units of a rank authority management apparatus provided by an embodiment of the present application.
  • Fig. 5 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the existing MQ authority management method even if it has authentication-based security, but the authority management only has a rough level of management, and the accuracy is insufficient. Or add a layer of security mechanism in addition to MQ, but not only the logic of permission management is complicated, but also the distributed characteristics of MQ itself are affected, which greatly weakens the balance, dynamic scalability, and high availability of MQ. Moreover, if the permission is processed by the output end of the message, unnecessary message transmission is added, which affects the performance of the message bus and causes the waste of resources. It is difficult to ensure the security of MQ without destroying the characteristics of MQ itself.
  • the embodiment of the present application provides a method for queue authority management based on a message queue, which is applied to an authority management system.
  • the above-mentioned authority management system 100 may be a server, for example, a distributed storage server, a traditional server, a large storage system, a desktop computer, a notebook computer, a tablet computer, a palm computer, a smart phone, a portable digital player, a smart watch, and a smart bracelet Wait.
  • a server for example, a distributed storage server, a traditional server, a large storage system, a desktop computer, a notebook computer, a tablet computer, a palm computer, a smart phone, a portable digital player, a smart watch, and a smart bracelet Wait.
  • the technical solutions of the embodiments of the present application may be implemented specifically based on the authority management system of the architecture shown in FIG. 1 or its deformed architecture.
  • Figure 2A is a schematic flow chart of a method for managing queue permissions based on a message queue provided by an embodiment of the present application. This method may include but is not limited to the following steps:
  • the message receiving terminal MQ receives an initial message, and sends the initial message to the message regeneration module;
  • the message receiving end MQ is Ingress MQ, which provides services to message producers, which corresponds to the message sending end MQ (Out Bonding MQ), and the message sending end MQ provides services to message consumers.
  • Message Queue also known as Message Bus (Message Bus) refers to a cross-process communication component with a message production/subscription mechanism as the core. In a modern service-oriented processing architecture, it is generally a Public infrastructure. It can be understood that the message receiving terminal MQ sends the initial message to the message regeneration module after receiving the initial message from other devices or the Internet. The initial message is a message generated by a message producer.
  • the message regeneration module receives the subscription information of the target user sent from the MQ service interface gateway.
  • the message regeneration module is a core module of the rights management system. This module can realize the rebirth of messages.
  • the above-mentioned MQ service interface gateway is a core module that connects the user terminal and the message regeneration module. When the user terminal inputs subscription information, it can be understood that the MQ service interface gateway transmits the subscription information of the target user to the message regeneration module, so that the message regeneration module can judge, process, and generate messages based on the subscription information of the target user.
  • the message regeneration module receives the rank and rank authority information of the target user sent by the authority configuration module;
  • the authority configuration module is a module that pre-stores the message queue authority of a certain user or some users. If the message queue authority of multiple users is stored in advance, it can be encrypted or labeled with code or data. And other ways to distinguish.
  • the authority configuration module is in communication connection with the message regeneration module, so that the message regeneration module can receive the rank authority information of the target user.
  • the row and column permission information of the target user marks which rows or columns the target user has access permissions, as well as the expression and structure of specific row permissions, and the expression and cache structure of column permissions.
  • the message regeneration module receives the initial message, filters the initial message according to the subscription information and the rank authority information of the target user, generates a target message and topic routing unit, and uses the topic routing unit to send the The message sender MQ sends the target message;
  • the message regeneration module filters the initial message according to the subscription information and the target user rank authority information.
  • the message generates a target message and topic routing unit.
  • the target message reflects the rank authority of the target user relative to the initial message, that is, the rank information for which the target user has rank authority is retained, and the rank information for which the target user does not have rank authority is eliminated , And generate the target message in accordance with the preset row and column format according to the retained information.
  • the generated target message may not have a corresponding routing unit that can send the target message, so a new path must be generated, namely the topic routing unit, and the topic routing unit is used to send the message to the message sender.
  • MQ sends the target message.
  • the message sender MQ After receiving the target message, the message sender MQ sends the target message to the target client.
  • the message sending end MQ is a message sending port connecting the MQ service interface gateway and the target client. After it obtains the target message, it forwards it to the target client. It is convenient for the target client to obtain the target message that it wants to obtain in time.
  • the dual-instance structure deployment of the message receiving end MQ and the message sending end MQ is used, and the message regeneration module, the permission configuration module, and the MQ service interface gateway are set up between the two ends to manage messages.
  • the rank permissions of the queue Compared with the single-instance native MQ, for message producers and message consumers, it is still message production and message reception, which realizes the management of permissions, and does not affect the message producers and message producers. Consumers increase the consumption of additional resources, so that the authority management process not only guarantees the security of MQ, but also does not destroy the original characteristics of MQ.
  • the message regeneration module includes a user subscription topic routing unit, a target user authority calculation unit, and a message generation unit.
  • the message regeneration module filters according to the subscription information and the rank authority information of the target user
  • the initial message generation target message and topic routing unit includes: the user subscribed topic routing unit monitors routing requests for multiple topic information, and when the routing request for the first topic information is monitored, if it is based on the subscription of the target user If the information determines that the target user has subscribed to the first topic information, the first topic information is routed to the target user authority calculation unit; the target user authority calculation unit is based on the target user's rank authority information Calculate the rank authority of the target user in the first topic information, obtain the authority result information of the target user, and send the authority result information of the target user to the message generating unit; the message generating unit receives the authority result information of the target user; The authority result information of the target user is described, and a target message and topic routing unit is generated according to the authority result information of the target user.
  • the functional unit schematic diagram of the message rebirth module shown in Figure 2B can be understood as the message rebirth module includes a user subscription topic routing unit, a target user authority calculation unit, and a message generation unit. These units specifically execute messages.
  • the management task of the rebirth module the communication connection between each unit.
  • the user subscription topic routing unit mainly monitors topic routing requests. When the routing request is obtained, if it is determined according to the subscription information of the target user that the target user has subscribed to the first topic information, Then, the first subject information is routed to the target user authority calculation unit.
  • the target user is user A, and his subscription information records that he has subscribed to Topic1 (User A’s subscription can also include Topic2, Topic3, Topic4...
  • Topic1 can also be used by users B, C, User D, etc. subscribe, here only Topic1 is subscribed by user A as an example), after the user subscription routing unit is determined, Topic1 related information is sent but user A’s authority calculation unit is used to calculate the message queue of user A Rank permissions.
  • a target user authority calculation unit is established for each subscriber to calculate the rank and column authority of the target user. After the target user authority calculation unit receives Topic1 related information, it calculates the rank authority of the user A according to the rank authority information of the user A (that is, the rank authority information of the target user). That is, in Topic1 which ranks of permissions user A has, and according to this calculation result, user A's permission result information is obtained.
  • the authority result information of the user A is sent to the message generating unit, and the message generating unit generates a target message centered on the user A, and a topic routing unit corresponding to the target message.
  • the topic routing unit is the path for sending the target message .
  • the format of the target message is (User ID, Topic ID).
  • the user-subscribed topic routing unit includes a topic routing information table and a topic routing execution subunit, and the user-subscribed topic routing unit listens to multiple topic information routing requests, and when it listens to the first topic information In the routing request, if it is determined that the target user has subscribed to the first topic information according to the subscription information of the target user, routing the first topic information to the target user authority calculation unit includes: The subscription information of multiple users establishes the topic routing information table, and each topic of the multiple topics in the topic routing information table corresponds to at least one piece of user information, and the subscription information of the multiple users includes the target user’s information Subscription information; the topic execution unit monitors multiple topic information routing requests, and when it monitors the first topic information routing request, searches for the routing table entry of the first topic information in the topic routing information table; Traverse the routing table entries of the first topic information, and if the target user information is obtained in the routing table entries of the first topic information, route the first topic information to the target user authority calculation unit .
  • the user-subscribed topic routing unit includes a topic routing information table and a topic routing execution subunit.
  • the topic routing information table is a subscription relationship table between Topic and user information, as shown in Table 1: Topic1 may be for multiple subscribers, such as user A and user B, and one user may also correspond to a topic, such as user B subscribes to Topic1 and Topic2. Through this topic routing information table, you can clearly obtain the corresponding subscribers contained in the topic, as well as the detailed information of the subscribers, and other remarks about the topic.
  • the topic execution unit monitors the routing request for topic information, and when it monitors the routing request of Topic1 (the first topic), it routes Topic1 to the authority calculation unit of user A and the authority calculation unit of user B.
  • topic routing information table it is convenient to obtain the subscriber information corresponding to each topic, and different topics can be routed to the corresponding target user authority calculation unit through the topic execution unit. Establish the mapping relationship between Topic and subscribers to make the classification of Topic more accurate.
  • the target user authority calculation unit includes a user authority cache subunit, a row authority filtering subunit, and a column authority filtering subunit.
  • the target user authority calculation unit calculates according to the rank and column authority information of the target user.
  • the rank authority of the target user to obtain the authority result information of the target user includes: the user authority cache subunit caches the rank authority information of the target user, and the rank of the target user.
  • the permission information comes from the permission configuration module, the row and column permission information of the target user includes the row permission information of the target user and the column permission information of the target user; the message row permission filtering subunit is based on the target user
  • the row permission information filters the first subject information to obtain authorized row permission information;
  • the message column permission filtering subunit filters the first subject information according to the column permission information of the target user to obtain the authorized column permission information ; Obtain the permission result information of the target user according to the authorized row permission information and the authorized column permission information.
  • the target user authority calculation unit includes a user authority cache subunit, a row authority filtering subunit, and a column authority filtering subunit.
  • the permission cache subunit is used to cache the rank permission information of the target user, the rank permission information of the target user comes from the permission configuration module, and the rank permission information of the target user includes the target user’s permission information.
  • the purpose of filtering is to save the rows and columns that user A has permissions, and filter out the rows and columns that do not have permissions to get user A's permission result information .
  • the permission result information that is, the ranks of user A's permission are saved in a preset format, and can be sent to user A so that it can be viewed and used.
  • the target user's rank authority is calculated, which is convenient for obtaining the rank and rank authority information of the target user, and is convenient for the generation of the target message in the later period.
  • the message line authority filtering subunit filters the first subject information according to the line authority information of the target user to obtain authorized line authority information, including: the target user line authority information includes three The first level is the user ID, the second level is the topic ID, and the third level is the data source ID.
  • the user ID corresponds to at least one topic ID
  • the one topic ID corresponds to at least one data source ID
  • the message The row permission filtering subunit traverses the multiple data source IDs in the first topic information, and compares the multiple data source IDs in the first topic information with the data source ID in the row permission information of the target user; When the first data source ID in the first topic information matches the data source ID in the row authority information of the target user, mark the first data source ID in the first topic information as authorized row authority information; When the second data source ID in the first topic information does not match the data source ID in the row authority information of the target user, the second data source ID in the first topic information is changed from the first The subject information is excluded; the first data source ID in the first subject information is associated with the user ID as authorized row authority information for storage.
  • the row permission cache structure is shown in Figure 2C.
  • the core points of the structure are as follows:
  • the first-level structure takes users as the core , Such as the user 0 permission cache, user 1 permission cache, user n permission cache, etc.
  • each user has its own independent permission cache item
  • the second-level structure uses Topic as the core, for example, the user 0 permission cache contains Topic1, Topic2...Topic(x), that is, the authority of each topic of each user is managed independently
  • the third-level structure is the data source ID, and each data source ID item can be any layer, and follow up according to the principle of inheritance
  • ID card information If user A has the right to obtain ID card information, he can specifically obtain the ID card information of Zhang San, Li Si, Wang Wu, etc., and Zhang 3. The account information of Li Si, Wang Wu, etc. will be excluded, and finally user A has the authority to get the line message.
  • the message column permission filtering subunit filters column permissions according to the target user rank permission information of the target user, and obtains authorized column permission information, including: the target user rank permission information includes three levels , The first level is the user ID, the second level is the topic ID, the third level is the field information corresponding to the topic ID, the user ID corresponds to at least one topic ID, and the one topic ID corresponds to at least one field information; the message The column permission filtering subunit traverses multiple field information in the first subject information, compares the multiple field information in the first subject information with the fields in the column permission information of the target user; When the first field in the subject information matches the field in the column permission information of the target user, mark the first field in the first subject information as authorized column permission information; the first field in the first subject information When the two fields do not match the fields in the column authority information of the target user, remove the second field in the first subject information from the first subject information; remove the first field in the first subject information The fields are stored as authorized column permission information in association with the user ID
  • the column permission information of the target user is cached by the user permission cache subunit.
  • the column permission cache structure is shown in Figure 2D.
  • the column permission is in one message and consists of multiple fields. Users have different permissions for the same topic.
  • the core structure of the column permission cache structure is as follows: the first-level structure can be user-centric, that is, each user has its own independent column-limited cache item; the second-level structure uses Topic as the core, that is, each user’s The column limit of each topic is managed independently; the third-level structure is the list of topics of the topic, the specific fields that can be accessed.
  • the column information of Topic1 contains the ID card information and household registration information of Zhang San, Li Si, Wang Wu, etc.
  • user A has Zhang San’s information acquisition authority, and he can specifically obtain Zhang San’s information. ID card information and household registration information, and other information of Li Si and Wang Wu will be excluded, and finally user A has permission to get the line message.
  • the message generating unit includes a topic management sub-unit and a topic message sending sub-unit, and the message generating unit receives the permission result information of the target user, and generates it according to the permission result information of the target user
  • the target message and topic routing unit includes: the topic management subunit receives the authorization result information of the target user sent from the target user authorization calculation unit, and obtains the authorization result information from the target user The target user identification ID and the first topic identification ID corresponding to the target user identification; the topic management sub-unit searches for the target user ID and the first topic according to the target user ID and the first topic ID ID topic routing unit information, if the topic routing unit information is not queried, generate topic routing unit information including the target user ID and the first topic ID; the topic message sending subunit listens to the message sending request After obtaining the message sending request, obtaining the permission result information of the target user, and reorganizing the permission result information of the target user to generate target information, where the target information is the first subject information contained in the target user ID Authorized rank information in.
  • the topic management subunit mainly manages topics. For each original Topic(x), such as Topic1, Topic2, Topic3, the topic management subunit obtains Topic ID and User ID and combines them into (User ID, Topic( x))
  • the routing unit format for example, the topic routing unit of (target user, Topic1) is formed according to the target user ID and the first topic ID. In the same way, topic routing units of (target user, Topic2) and (target user, Topic3) can also be formed. If the Topic ID and User ID are obtained from the monitored message sending request, query with the (User ID, Topic ID) data group. If the query result is not empty, the required Topic has been created; if the query result is If it is empty, create a combined topic routing unit with (User ID, Topic ID).
  • the topic message sending subunit generates a new target message according to the format of the target user's authority result information (User ID, Topic ID), which can be understood as a storage or cache cell according to the (User ID, Topic ID), and the target user Fill in this or these cells with the permission result information.
  • a target message of (target user, Topic1) is formed, and the topic message sending subunit uses the topic routing unit of (target user, Topic1) to send the target message of (target user, Topic1).
  • a target message with the user as the core and the theme subscribed by each user as a component and the theme sending routing unit corresponding to the target message are generated.
  • the authority information of the target user is clarified to facilitate user authority management.
  • FIG. 3 is a schematic flow diagram of another method for queue authority management based on message queues provided by an embodiment of the present application, which is applied to an authority management system; including:
  • the message receiving terminal MQ receives an initial message, and sends the initial message to the message regeneration module;
  • the message regeneration module receives the subscription information of the target user sent from the MQ service interface gateway.
  • the message regeneration module receives the rank permission information of the target user sent from the permission configuration module.
  • Steps 301-303 are the same as the aforementioned steps 201-203, and will not be repeated here.
  • the message rebirth module receives an initial message, where the initial message includes first subject information, and calculates the rank authority of the target user in the first subject information according to the rank authority information of the target user to obtain the Authorization result information of the target user, and obtaining the target user identification ID and the first theme identification ID corresponding to the target user identification from the authorization result information of the target user;
  • the initial message contains multiple topic messages
  • the multiple topic messages contain first topic information. If the target user subscribes to the first topic information, then calculate the rank permission of the target user in the first topic information according to the rank permission information of the target user, that is, the rank that the target user has permission in the first topic information
  • the information is saved, the rank information in the first subject information that the target user does not have the authority is removed, and the authority result information of the target user is finally obtained.
  • the authorization result information contains the ID of the target user, for example, the ID of the target user is A, and the first topic identification ID is Topic1.
  • the message rebirth module searches for topic routing unit information including the target user ID and the first topic ID according to the target user ID and the first topic ID, if the topic routing unit information is not found , Generate topic routing unit information including the target user ID and the first topic ID, generate target information according to the permission result information of the target user, and send the target message to the message sender MQ;
  • the (User ID, Topic ID) data group is used as the query format, for example, (target user, Topic1) is used to query whether there is such a topic route with the target user as the core and the first topic as the content.
  • (target user, Topic1) is used to query whether there is such a topic route with the target user as the core and the first topic as the content.
  • the routing unit if the routing unit is acquired, it indicates that the routing unit already exists. If the query result is empty, it indicates that the routing unit does not exist, so a (target user, Topic1) routing unit needs to be established. And after the routing unit is established, (target user, Topic1) must be used as the message organization form to generate target messages.
  • the topic routing unit of (target user, Topic1) is reused to send the target message of (target user, Topic1) to the message sender MQ.
  • the message sender MQ After receiving the target message, the message sender MQ sends the target message to the target client.
  • Step 306 is the same as the aforementioned step 205, and will not be repeated here.
  • the dual-instance structure deployment of the message receiving end MQ and the message sending end MQ is adopted, and the message rebirth module, the permission configuration module, and the MQ service interface gateway are set up between the two ends to jointly manage the message queue.
  • Rank permissions In addition, the generated message uses (User ID, Topic ID) as the data expression form, which reflects that the target message is based on the user as the core, and the topic for which the user has the rank authority is the content, so as to realize the management of the rank and rank authority of the user.
  • the single-instance native MQ for message producers and message consumers, it is still message production and message reception, which realizes the management of permissions, and does not affect the producers and message producers. Consumers increase the consumption of additional resources, so that the permission management process not only guarantees the security of MQ, but also does not destroy the original characteristics of MQ.
  • FIG. 4 is a schematic diagram of the functional unit structure of a message queue-based queue authority management apparatus 400 provided by an embodiment of the present application, which is applied to authority management
  • the rank authority management device 400 includes a communication unit 410 and a processing unit 420, wherein:
  • the processing unit 420 is configured to control the message receiving terminal MQ to receive the initial message, and send the initial message to the message regeneration module;
  • the processing unit 420 is further configured to control the message regeneration module to receive the subscription information of the target user sent by the MQ service interface gateway;
  • the processing unit 420 is further configured to control the message rebirth module to receive the rank permission information of the target user sent from the permission configuration module;
  • the processing unit 420 is further configured to control the message regeneration module to receive the initial message, and filter the initial message according to the subscription information and the rank authority information of the target user to generate a target message and topic routing unit, and Use the topic routing unit to send the target message to the message sender MQ;
  • the processing unit 420 is further configured to control the message sender MQ to send the target message to the target client after receiving the target message.
  • the dual-instance structure deployment of the message receiving end MQ and the message sending end MQ is controlled by the processing unit, and the message regeneration module, the authority configuration module, and the MQ service interface gateway are set up between the two ends for joint management.
  • the rank authority of the message queue Compared with the single-instance native MQ, for message producers and message consumers, it is still message production and message reception, which realizes the management of permissions, and does not affect the message producers and message producers. Consumers increase the consumption of additional resources, so that the authority management process not only guarantees the security of MQ, but also does not destroy the original characteristics of MQ.
  • the message rebirth module includes a user subscription topic routing unit, a target user authority calculation unit, and a message generation unit.
  • the message rebirth module is based on the subscription information and the target user's rank authority information
  • the processing unit 420 is specifically configured to control the user subscription topic routing unit to listen to multiple topic information routing requests, and to monitor the routing request of the first topic information
  • the target user authority calculation unit calculates the rank authority of the target user in the first topic information according to the rank authority information of the target user, obtains the authority result information of the target user, and sends the target user's authority information to the message generating unit.
  • Authority result information; the message generating unit receives authority result information of the target user, and generates a target message and topic routing unit according to the authority result information
  • the user subscribed topic routing unit includes a topic routing information table and a topic routing execution subunit.
  • the user subscribes topic routing unit listens to multiple topic information routing requests, and when the first topic is monitored In the information routing request, if it is determined that the target user has subscribed to the first topic information according to the subscription information of the target user, the first topic information is routed to the target user authority calculation unit, so
  • the processing unit 420 is specifically configured to establish the topic routing information table according to the subscription information of multiple users. Each topic of the multiple topics in the topic routing information table corresponds to at least one piece of user information.
  • the subscription information includes the subscription information of the target user; the topic execution unit monitors a plurality of topic information routing requests, and when it monitors the routing request of the first topic information, searches for the topic routing information table The routing table entry of the first topic information; traverse the routing table entries of the first topic information, and if the target user information is obtained in the routing table entry of the first topic information, the first topic information Route to the target user authority calculation unit.
  • the target user permission calculation unit includes a user permission cache subunit, a row permission filtering subunit, and a column permission filtering subunit.
  • the target user permission calculation unit is based on the row and column permission information of the target user.
  • the processing unit 420 is specifically configured to control the user authority cache subunit to cache the target user's Row and column permission information, the row and column permission information of the target user comes from the permission configuration module, and the row and column permission information of the target user includes row permission information of the target user and column permission information of the target user; the message
  • the row permission filtering subunit filters the first subject information according to the row permission information of the target user to obtain authorized row permission information;
  • the message column permission filtering subunit filters the first subject information according to the column permission information of the target user A subject information obtains authorized column permission information; obtaining permission result information of the target user according to the authorized row permission information and the authorized column permission information.
  • the processing unit 420 is specifically configured to
  • the target user line authority information includes three levels, the first level is the user ID, the second level is the topic ID, and the third level is the data source ID.
  • the user ID corresponds to at least one topic ID
  • the one topic ID corresponds to At least one data source ID
  • the message line permission filtering subunit traverses multiple data source IDs in the first topic information, and compares the multiple data source IDs in the first topic information with the target user’s row
  • the data source ID in the authority information when the first data source ID in the first subject information matches the data source ID in the row authority information of the target user, the first data in the first subject information is marked
  • the source ID is the authorized row permission information; when the second data source ID in the first subject information does not match the data source ID in the row permission information of the target user, the first subject information in the first subject information 2.
  • the data source ID is removed from the first topic information; the first data source ID in the first topic information is used as authorized row authority information to be associated with the user ID for storage.
  • the processing unit 420 is specifically used for the
  • the target user rank authority information includes three levels, the first level is the user ID, the second level is the topic ID, and the third level is the field information corresponding to the topic ID.
  • the user ID corresponds to at least one topic ID, and the one topic ID Corresponding to at least one field information;
  • the message column permission filtering subunit traverses multiple field information in the first subject information, and compares the multiple field information in the first subject information with the column permission information of the target user When the first field in the first subject information matches the field in the column permission information of the target user, mark the first field in the first subject information as authorized column permission information; When the second field in the first subject information does not match the field in the column authority information of the target user, remove the second field in the first subject information from the first subject information;
  • the first field in the first subject information is associated with the user ID for storage as authorized column permission information.
  • the message generating unit includes a topic management sub-unit and a topic message sending sub-unit.
  • the message generating unit receives the permission result information of the target user, and according to the permission result information of the target user
  • the processing unit 420 is specifically configured to control the topic management sub-unit to receive the authorization result information of the target user sent from the target user authorization calculation unit, and obtain the result information from the target user authorization calculation unit.
  • the authorization result information of the target user obtains the target user identification ID and the first theme identification ID corresponding to the target user identification; the theme management sub-unit queries the target user ID and the first theme ID to include all The subject routing unit information of the target user ID and the first subject ID, if the subject routing unit information is not queried, then the subject routing unit information including the target user ID and the first subject ID is generated; The subject message sending subunit monitors the message sending request, and after obtaining the message sending request, obtains the permission result information of the target user, reorganizes the permission result information of the target user, and generates target information. It is the authorized rank information in the first subject information contained in the target user ID.
  • FIG. 5 is a schematic structural diagram of an electronic device 500 provided by an embodiment of the present application.
  • the electronic device 500 includes a processor 510, a memory 520, a communication interface 530, and one or more programs 521, wherein the one One or more programs 521 are stored in the foregoing memory 520 and configured to be executed by the foregoing processor 510, and the one or more programs 521 include instructions for performing the following steps:
  • the message receiving terminal MQ receives the initial message, and sends the initial message to the message regeneration module;
  • the message regeneration module receives the subscription information of the target user sent from the MQ service interface gateway;
  • the message regeneration module receives the rank and rank authority information of the target user sent from the authority configuration module;
  • the message regeneration module receives the initial message, filters the initial message according to the subscription information and the rank authority information of the target user, generates a target message and topic routing unit, and uses the topic routing unit to send the message to the message
  • the sending end MQ sends the target message
  • the message sender MQ After receiving the target message, the message sender MQ sends the target message to the target client.
  • the dual-instance structure deployment of the message receiving end MQ and the message sending end MQ is controlled through one or more program instructions, and between the two ends, the message regeneration module, the authority configuration module, and the MQ service interface are set up.
  • the gateways unite to manage the ranks of the message queue. Compared with the single-instance native MQ, for message producers and message consumers, it is still message production and message reception, which realizes the management of permissions, and does not affect the message producers and message producers. Consumers increase the consumption of additional resources, so that the authority management process not only guarantees the security of MQ, but also does not destroy the original characteristics of MQ.
  • the message rebirth module includes a user subscription topic routing unit, a target user authority calculation unit, and a message generation unit.
  • the message rebirth module is based on the subscription information and the target user's rank authority information
  • the one or more programs 521 specifically include instructions for performing the following operations.
  • the user subscribes to the topic routing unit to listen to routing requests for multiple topic information. When a routing request for the first topic information is monitored, if it is determined that the target user has subscribed to the first topic information according to the subscription information of the target user, the first topic information is routed to the target user.
  • the target user authority calculation unit calculates the target user's rank authority in the first topic information according to the target user's rank authority information, obtains the authority result information of the target user, and sends the message to the message
  • the generating unit sends the authority result information of the target user; the message generating unit receives the authority result information of the target user, and generates a target message and topic routing unit according to the authority result information of the target user.
  • the user subscribed topic routing unit includes a topic routing information table and a topic routing execution subunit.
  • the user subscribes topic routing unit listens to multiple topic information routing requests, and when the first topic is monitored In the information routing request, if it is determined that the target user has subscribed to the first topic information according to the subscription information of the target user, the first topic information is routed to the target user authority calculation unit, so
  • the one or more programs 521 specifically include instructions for performing the following operations to establish the topic routing information table according to the subscription information of multiple users, and each topic of the multiple topics in the topic routing information table corresponds to at least one topic:
  • User information, the subscription information of the multiple users includes the subscription information of the target user;
  • the topic execution unit listens to multiple topic information routing requests, and when it listens to the first topic information routing request, searches The routing table entry of the first topic information in the topic routing information table; the routing table entry of the first topic information is traversed, if the information of the target user is obtained in the routing table entry of the first topic information ,
  • the target user permission calculation unit includes a user permission cache subunit, a row permission filtering subunit, and a column permission filtering subunit.
  • the target user permission calculation unit is based on the row and column permission information of the target user.
  • the one or more programs 521 specifically include instructions for performing the following operations, the user authority cache The sub-unit caches the rank authority information of the target user, the rank authority information of the target user comes from the authority configuration module, and the rank authority information of the target user includes the line authority information of the target user and the target user
  • the message row permission filtering subunit filters the first topic information according to the row permission information of the target user to obtain authorized row permission information;
  • the message column permission filtering subunit filters the first subject information according to the target user’s row permission information;
  • the first subject information is filtered by the column authority information to obtain authorized column authority information; the authority result information of the target user is obtained according to the authorized row authority
  • the one or more programs 521 specifically Including instructions for performing the following operations.
  • the target user line authority information includes three levels, the first level is the user ID, the second level is the topic ID, and the third level is the data source ID.
  • the user ID corresponds to at least one Subject ID
  • the one subject ID corresponds to at least one data source ID
  • the message line permission filtering subunit traverses multiple data source IDs in the first subject information, and compares multiple data in the first subject information The source ID and the data source ID in the row permission information of the target user; when the first data source ID in the first subject information matches the data source ID in the row permission information of the target user, mark the The first data source ID in the first subject information is authorized row permission information; when the second data source ID in the first subject information does not match the data source ID in the row permission information of the target user, change The second data source ID in the first topic information is removed from the first topic information; the first data source ID in the first topic information is used as authorized row authority information to associate with the user ID Store it.
  • the one or more programs 521 specifically include using In the instruction to perform the following operations, the target user rank authority information includes three levels, the first level is the user ID, the second level is the topic ID, and the third level is the field information corresponding to the topic ID, and the user ID corresponds to at least A topic ID, and the one topic ID corresponds to at least one field information; the message column permission filtering subunit traverses multiple field information in the first topic information, and compares the multiple field information in the first topic information And the field in the column permission information of the target user; when the first field in the first subject information matches the field in the column permission information of the target user, mark the first in the first subject information Field is authorized column permission information; when the second field in the first subject information does not match the field in the target user’s column permission information, the second field in the first subject information is changed from the Exclude from the first
  • the message generating unit includes a topic management sub-unit and a topic message sending sub-unit.
  • the message generating unit receives the permission result information of the target user, and according to the permission result information of the target user
  • the one or more programs 521 specifically include instructions for performing the following operations
  • the topic management sub-unit receives the target user sent from the target user authority calculation unit And obtain the target user identification ID and the first theme identification ID corresponding to the target user identification from the authorization result information of the target user; the theme management subunit is based on the target user ID and the target user ID
  • the first topic ID query includes topic routing unit information of the target user ID and the first topic ID.
  • the topic routing unit information is not queried, it is generated that includes the target user ID and the first topic ID topic routing unit information; the topic message sending subunit listens to the message sending request, after obtaining the message sending request, obtains the permission result information of the target user, and reorganizes the permission result information of the target user, Generate target information, where the target information is the authorized rank information in the first subject information included in the target user ID.
  • the processor 510 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and so on.
  • the processor 510 may adopt at least one hardware form among DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array, Programmable Logic Array). achieve.
  • the processor 510 may also include a main processor and a coprocessor.
  • the main processor is a processor used to process data in the awake state, also called a CPU (Central Processing Unit, central processing unit); the coprocessor is A low-power processor used to process data in the standby state.
  • the processor may be integrated with a GPU (Graphics Processing Unit, image processor), and the GPU is used to render and draw content that needs to be displayed on the display screen.
  • the processor 510 may further include an AI (Artificial Intelligence) processor, and the AI processor is used to process computing operations related to machine learning.
  • AI Artificial Intelligence
  • the memory 520 may include one or more computer-readable storage media, which may be non-transitory.
  • the memory 520 may also include a high-speed random access memory and a non-volatile memory, such as one or more magnetic disk storage devices and flash memory storage devices.
  • the memory 520 is used to store at least the following computer program, where the computer program is loaded and executed by the processor 510 to implement relevant steps in the call control method disclosed in any of the foregoing embodiments.
  • the resources stored in the memory 520 may also include an operating system and data, etc., and the storage mode may be short-term storage or permanent storage.
  • the operating system may include Windows, Unix, Linux, etc.
  • the data may include, but is not limited to, electronic device interaction data, electronic device signals, and so on.
  • the electronic device 500 may further include an input/output interface, a communication interface, a power supply, and a communication bus.
  • an electronic device includes hardware structures and/or software modules corresponding to each function.
  • this application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • the embodiment of the present application may divide the electronic device into functional units according to the foregoing method examples.
  • each functional unit may be divided corresponding to each function, or two or more functions may be integrated into one processing unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit. It should be noted that the division of units in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • the embodiment of the present application provides a chip, the chip includes a processor and a data interface, the processor reads instructions stored on the memory through the data interface, such as part or all of the steps of any method recorded in the above method embodiment .
  • An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any method as recorded in the above method embodiment ,
  • the above-mentioned computer includes electronic equipment.
  • the embodiments of the present application also provide a computer program product.
  • the above-mentioned computer program product includes a non-transitory computer-readable storage medium storing a computer program.
  • the above-mentioned computer program is operable to cause a computer to execute any of the methods described in the above-mentioned method embodiments. Part or all of the steps of the method.
  • the computer program product may be a software installation package, and the above-mentioned computer includes the above-mentioned electronic device.
  • the disclosed device may be implemented in other ways.
  • the electronic device embodiments described above are only illustrative.
  • the division of the above-mentioned units is only a logical function division.
  • there may be other division methods for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical or other forms.
  • the units described above as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the above integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable memory.
  • the technical solution of the present application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory.
  • a number of instructions are included to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the foregoing methods of the various embodiments of the present application.
  • the aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.
  • the program can be stored in a computer-readable memory, and the memory can include: flash disk, Read-only memory (English: Read-Only Memory, abbreviation: ROM), random access device (English: Random Access Memory, abbreviation: RAM), magnetic disk or optical disc, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例公开了基于消息队列的行列权限管理的方法及相关装置，该方法包括：所述消息接收端MQ接收初始消息，并且向所述消息重生模块发送所述初始消息；所述消息重生模块接收来自所述MQ服务接口网关发送的目标用户的订阅信息；所述消息重生模块接收来自所述权限配置模块发送的所述目标用户的行列权限信息；所述消息重生模块接收所述初始消息，并根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元，并使用所述主题路由单元向所述消息发送端MQ发送所述目标消息；所述消息发送端MQ在接收所述目标消息后，向目标用户端发送所述目标消息。采用本申请，既保障了MQ的安全性，又不破坏MQ的原生特性。

Description

基于消息队列的行列权限管理的方法及相关装置 技术领域
本申请涉及计算机技术领域，尤其涉及一种基于消息队列的行列权限管理的方法及相关装置。
背景技术
在常见的服务化架构中，消息队列(MQ)已经是个被广泛使用的基础设施级别的组件。在很多软件系统中，MQ已经成为整个软件系统运行的核心，有90％的跨组件通信流量都承载在消息队列上。MQ主要完成以下核心职责：组件内的交互与通信，衔接软件系统内部处理流程，以及通过消息的输入与输出实现软件系统与外部的交互。
但正因为MQ的运用日益广泛及其重要的地位，MQ安全性问题也凸显出来。即使有基于认证的安全性，但是对权限的管理只具备粗层次的管理，而精度不足。难以实现在不破坏MQ本身特性的基础上，保障MQ的安全性。
发明内容
本申请实施例提供了一种既能保障MQ的安全性，又不破坏MQ的原生特性的基于消息队列的行列权限管理的方法及相关装置。
第一方面，一种基于消息队列的行列权限管理的方法，其特征在于，应用于权限管理系统，所述权限管理系统包括消息接收端消息队列MQ，消息重生模块、权限配置模块、MQ服务接口网关与消息发送端MQ，所述方法包括：
所述消息接收端MQ接收初始消息，并且向所述消息重生模块发送所述初始消息；
所述消息重生模块接收来自所述MQ服务接口网关发送的目标用户的订阅信息；
所述消息重生模块接收来自所述权限配置模块发送的所述目标用户的行列权限信息；
所述消息重生模块接收所述初始消息，并根据所述订阅信息与所述目标用 户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元，并使用所述主题路由单元向所述消息发送端MQ发送所述目标消息；
所述消息发送端MQ在接收所述目标消息后，向目标用户端发送所述目标消息。
第二方面，一种基于消息队列的行列权限管理装置，其特征在于，应用于权限管理系统，所述权限管理系统包括消息接收端消息队列MQ，消息重生模块、权限配置模块、MQ服务接口网关与消息发送端MQ，所述行列权限管理装置包括通信单元与处理单元，其中：
所述处理单元，用于控制所述消息接收端MQ接收初始消息，并且向所述消息重生模块发送所述初始消息；
所述处理单元，还用于控制所述消息重生模块接收来自所述MQ服务接口网关发送的目标用户的订阅信息；
所述处理单元，还用于控制所述消息重生模块接收来自所述权限配置模块发送的所述目标用户的行列权限信息；
所述处理单元，还用于控制所述消息重生模块接收所述初始消息，并根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元，并使用所述主题路由单元向所述消息发送端MQ发送所述目标消息；
所述处理单元，还用于控制所述消息发送端MQ在接收所述目标消息后，向目标用户端发送所述目标消息。
第三方面，本申请实施例提供一种电子设备，包括处理器、存储器、通信接口以及一个或多个程序，其中，上述一个或多个程序被存储在上述存储器中，并且被配置由上述处理器执行，上述程序包括用于执行本申请实施例第一方面中的步骤的指令。
第四方面，本申请实施例提供了一种芯片，该芯片包括处理器与数据接口，该处理器通过该数据接口读取存储器上存储的指令，执行如上述第一方面至第三方面以及任一种可选的实现方式的方法。
第五方面，本申请实施例提供了一种计算机可读存储介质，其中，上述计算机可读存储介质存储用于电子数据交换的计算机程序，其中，上述计算机程序使得计算机执行如本申请实施例第一方面中所描述的部分或全部步骤。
第六方面，本申请实施例提供了一种计算机程序产品，其中，上述计算机程序产品包括存储了计算机程序的非瞬时性计算机可读存储介质，上述计算机程序可操作来使计算机执行如本申请实施例第一方面中所描述的部分或全部步骤。该计算机程序产品可以为一个软件安装包。
可见，本申请实施例中通过消息接收端MQ与消息发送端MQ的双实例结构部署，并在两端之间，通过设置消息重生模块、权限配置模块、MQ服务接口网关联合起来管理消息队列的行列权限。较之于单实例原生的MQ，对于消息的生产者以及消息的消费者而言，依然是消息的生产与消息的接收，即实现了权限的管理，又不会对消息的生产者以及消息的消费者增加额外的资源消耗，从而权限的管理过程既保障了MQ的安全性，又不破坏MQ的原生特性。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的权限管理系统的结构示意图；
图2A是本申请实施例提供的一种基于消息队列的权限管理方法的流程示意图；
图2B是本申请实施例提供的一种消息重生模块的功能单元示意图；
图2C是本申请实施例提供的一种行权限的缓存结构示意图；
图2D是本申请实施例提供的一种列权限的缓存结构示意图；
图3是本申请实施例提供的另一种基于消息队列的权限管理方法的流程示意图；
图4是本申请实施例提供的一种行列权限管理装置的功能单元示意图；
图5是本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是 全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其他步骤或单元。
在本文中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
目前现有的MQ权限管理方法，即使有基于认证的安全性，但是对权限的管理只具备粗层次的管理，而精度不足。或者是在MQ之外增加一层安全机制，但是不仅权限管理的逻辑复杂，还影响了MQ本身的分布式特性定，极大地削弱了MQ的均衡性，动态扩展性以及高可用性等。而且如果由消息的输出端对权限进行处理，又增加了不必要的消息发送，影响消息总线的性能，导致资源空耗。难以实现在不破坏MQ本身特性的基础上，保障MQ的安全性。
针对上述问题，本申请实施例提供一种基于消息队列的行列权限管理的方法，应用于权限管理系统。下面结合附图进行详细介绍。
首先，请参看图1所示的权限管理系统100的结构示意图，包括消息接收端消息队列MQ110，消息重生模块120、权限配置模块130、MQ服务接口网关140与消息发送端MQ150，各模块之间通信连接。
上述权限管理系统100可以是服务器，例如可以为分布式存储服务器、传统服务器、大型存储系统、台式电脑、笔记本电脑、平板电脑、掌上电脑、智能手机、便携式数字播放器、智能手表以及智能手环等。
本申请实施例的技术方案可以基于图1举例所示架构的权限管理系统或其形变架构来具体实施。
参见图2A，图2A是本申请实施例提供的一种基于消息队列的行列权限管 理方法的流程示意图，这种方法可包括但不限于如下步骤：
201、所述消息接收端MQ接收初始消息，并且向所述消息重生模块发送所述初始消息；
具体的，可以理解为，消息接收端MQ为Ingress MQ，面向消息生产者提供服务，其对应于消息发送端MQ(Out Bonding MQ)，消息发送端MQ，面向消息消费者提供服务。消息队列(Message Queue，MQ)，也称为消息总线(Message Bus)，是指以消息的生产/定阅机制为核心的跨进程通信组件，在现代的服务化处理架构中，它一般是一个公共基础设施。可以理解为所述消息接收端MQ从其他设备或者互联网络接收初始消息后，向消息重生模块发送所述初始消息。所述初始消息是消息生产者生成的消息。
202、所述消息重生模块接收来自所述MQ服务接口网关发送的目标用户的订阅信息；
具体的，可以理解为，消息重生模块为权限管理系统的一个核心模块。该模块可以实现消息的重生。上述MQ服务接口网关为连接用户端以及消息重生模块的一个核心模块。用户端输入订阅信息时，可以理解为由MQ服务接口网关将目标用户的订阅信息传送给所述消息重生模块，使得消息重生模块能够基于目标用户的订阅信息进行消息的判断、处理，生成。
203、所述消息重生模块接收来自所述权限配置模块发送的所述目标用户的行列权限信息；
具体的，可以理解为，权限配置模块为预先存储某个或者某些用户的消息队列行列权限的模块，若预先存储了多个用户的消息队列行列权限时，可以以编码或者数据分别加密或者标号等方式进行区分。权限配置模块与所述消息重生模块通信连接，便于所述消息重生模块接收目标用户的行列权限信息。所述目标用户的行列权限信息标记了目标用户具有哪些行或者哪些列的获取权限，以及具体的行权限的表达与结构以及列权限的表达与缓存结构。
204、所述消息重生模块接收所述初始消息，并根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元，并使用所述主题路由单元向所述消息发送端MQ发送所述目标消息；
具体的，可以理解为，消息重生模块在接收所述初始消息以及所述订阅信息与所述目标用户的行列权限信息后，根据所述订阅信息与所述目标用户的行 列权限信息过滤所述初始消息生成目标消息与主题路由单元，所述目标消息相对于初始消息，体现出目标用户的行列权限，也即把目标用户具有行列权限的行列信息保留，把目标用户不具有行列权限的行列信息剔除，并且根据保留下来的信息按照预设的行列格式生成目标消息。更近一步的，生成的目标消息可能没有对应的路由单元能进行目标消息的发送，所以也得生成新的路径，即所述主题路由单元，并使用所述主题路由单元向所述消息发送端MQ发送所述目标消息。
205、所述消息发送端MQ在接收所述目标消息后，向目标用户端发送所述目标消息。
具体的，可以理解为，所述消息发送端MQ为连接所述MQ服务接口网关以及目标客户端的一个消息发送端口。在其获取所述目标消息后便转发给所述目标客户端。便于所述目标客户端及时获取想要获取的目标消息。
可以看出，本申请实施例中通过消息接收端MQ与消息发送端MQ的双实例结构部署，并在两端之间，通过设置消息重生模块、权限配置模块、MQ服务接口网关联合起来管理消息队列的行列权限。较之于单实例原生的MQ，对于消息的生产者以及消息的消费者而言，依然是消息的生产与消息的接收，即实现了权限的管理，又不会对消息的生产者以及消息的消费者增加额外的资源消耗，从而权限的管理过程既保障了MQ的安全性，又不破坏MQ的原生特性。
在一个可能的示例中，所述消息重生模块包括用户定阅主题路由单元，目标用户权限计算单元，消息生成单元，所述消息重生模块根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元包括：所述用户定阅主题路由单元监听多个主题信息的路由请求，在监听到第一主题信息的路由请求时，若根据所述目标用户的订阅信息判断出所述目标用户订阅了所述第一主题信息，则将所述第一主题信息路由至所述目标用户权限计算单元；所述目标用户权限计算单元根据所述目标用户的行列权限信息计算所述第一主题信息中所述目标用户的行列权限，得到所述目标用户的权限结果信息，并向所述消息生成单元发送所述目标用户的权限结果信息；所述消息生成单元接收所述目标用户的权限结果信息，并根据所述目标用户的权限结果信息生成目标消息与主题路由单元。
具体实现中，如图2B所示的消息重生模块的功能单元示意图，可以理解为 所述消息重生模块包括用户定阅主题路由单元，目标用户权限计算单元，消息生成单元，由这些单元具体执行消息重生模块的管理任务，各个单元之间通信连接。所述用户定阅主题路由单元主要是监听主题(Topic)的路由请求，在获取到路由请求时，若根据所述目标用户的订阅信息判断出所述目标用户订阅了所述第一主题信息，则将所述第一主题信息路由至所述目标用户权限计算单元。举例而言，目标用户为用户A，他的订阅信息里记载着他订阅了Topic1(用户A的订阅还可以包括Topic2、Topic3、Topic4……同理，Topic1也可以还被用户B、用户C、用户D等订阅，此处仅以Topic1被用户A订阅为例进行说明)，在用户订阅路由单元确定之后，便将Topic1相关信息发送但用户A的权限计算单元，来计算用户A的消息队列的行列权限。可以理解为，为每一个订阅用户建立了一个目标用户权限计算单元，来计算目标用户的行列权限。所述目标用户权限计算单元在接收Topic1相关信息后，便根据用户A的行列权限信息(即目标用户的行列权限信息)计算用户A的行列权限。即在Topic1中用户A具有哪些行列权限，并且根据这个计算结果得到用户A的权限结果信息。并且将所述用户A的权限结果信息发送给消息生成单元，由消息生成单元生成以用户A为核心的目标消息，以及目标消息对应的主题路由单元，所述主题路由单元即发送目标消息的路径。目标消息的格式为(User ID，Topic ID)。
可见，本示例中，通过消息重生模块多个通信连接的功能单元，由用户定阅主题路由单元监听并且将第一主题信息具体分发至订阅了第一主题的目标用户权限计算单元，由目标用户权限计算单元计算目标用户关于第一主题的行列权限信息，得到目标用户的权限结果信息，再由消息生成单元根据目标用户的权限结果信息生成目标消息与主题路由单元。有利于根据用户的订阅信息准确分发主题信息，提高权限管理的效率与效果。
在一个可能的示例中，所述用户订阅主题路由单元包括主题路由信息表与主题路由执行子单元，所述用户定阅主题路由单元监听多个主题信息的路由请求，在监听到第一主题信息的路由请求时，若根据所述目标用户的订阅信息判断出所述目标用户订阅了所述第一主题信息，则将所述第一主题信息路由至所述目标用户权限计算单元，包括：根据多个用户的订阅信息建立所述主题路由信息表，所述主题路由信息表中多个主题中的每一个主题对应至少一个用户信息，所述多个用户的订阅信息中包括所述目标用户的订阅信息；所述主题执行 单元监听多个主题信息的路由请求，在监听到所述第一主题信息的路由请求时，查找所述主题路由信息表中所述第一主题信息的路由表项；遍历所述第一主题信息的路由表项，若在所述第一主题信息的路由表项获取到所述目标用户的信息，则将所述第一主题信息路由至所述目标用户权限计算单元。
具体的，可以理解为，用户订阅主题路由单元包括主题路由信息表与主题路由执行子单元。其中，所述主题路由信息表为Topic与用户信息的订阅关系表，如表1所示：Topic1可能对于多个订阅用户，比如用户A、用户B，一个用户也可能对应对个Topic，比如用户B订阅了Topic1与Topic2。通过这个主题路由信息表可以清楚的获取到Topic包含的与其对应的订阅用户，以及订阅用户的详细信息，以及其他关于Topic的一个备注信息等。主题执行单元监听主题信息的路由请求，在监听到Topic1(第一主题)的路由请求时，便将Topic1路由至用户A的权限计算单元以及用户B的权限计算单元。
可见，通过主题路由信息表，便于获取每个Topic对应的订阅用户信息，并能通过主题执行单元将不同的Topic路由至对应的目标用户权限计算单元。建立Topic与订阅用户之间的映射关系，使得Topic的分类更加准确。
主题信息 订阅用户名称 用户详细信息 备注
Topic 1 用户A、用户B *** ***
Topic 2 用户B、用户C *** ***
……Topic n …… *** ***
表1
在一个可能的示例中，所述目标用户权限计算单元包括用户权限缓存子单元、行权限过滤子单元、列权限过滤子单元，所述目标用户权限计算单元根据所述目标用户的行列权限信息计算所述第一主题信息中所述目标用户的行列权限，得到所述目标用户的权限结果信息，包括：所述用户权限缓存子单元缓存所述目标用户的行列权限信息，所述目标用户的行列权限信息来自于所述权限配置模块，所述目标用户的行列权限信息包括所述目标用户的行权限信息与所述目标用户的列权限信息；所述消息行权限过滤子单元根据所述目标用户的行权限信息过滤所述第一主题信息，得到授权的行权限信息；所述消息列权限过滤子单元根据所述目标用户的列权限信息过滤所述第一主题信息，得到授权的 列权限信息；根据所述授权的行权限信息与所述授权的列权限信息得到所述目标用户的权限结果信息。
具体的，可以理解为，目标用户权限计算单元包括用户权限缓存子单元、行权限过滤子单元、列权限过滤子单元。其中，所述权限缓存子单元用于缓存所述目标用户的行列权限信息，所述目标用户的行列权限信息来自于所述权限配置模块，所述目标用户的行列权限信息包括所述目标用户的行权限信息与所述目标用户的列权限信息；然后由消息列权限过滤子单元与消息行权限过滤子单元过滤Topic1(第一主题信息)，比如用户A具有Topic1中某些行与某些列的获取权限，但不具备有的行与有的列的获取权限，因此过滤的目的就是将用户A具有权限的行列保存下来，把不具有权限的行列筛除，便得到用户A的权限结果信息。权限结果信息即用户A具有权限的行列按照预设的格式保存下来，并且可以发送给用户A，使之能够查看，使用。
可见，通过目标用户权限计算单元包含的子单元，对目标用户的行列权限进行计算，便于获取目标用户的行列权限信息，而且便于后期目标消息的生成。
在一个可能的示例中，所述消息行权限过滤子单元根据所述目标用户的行权限信息过滤所述第一主题信息，得到授权的行权限信息，包括：所述目标用户行权限信息包含三个层级，第一层级为用户ID，第二层级为主题ID，第三层级为数据源ID，所述用户ID对应至少一个主题ID，所述一个主题ID对应至少一个数据源ID；所述消息行权限过滤子单元遍历所述第一主题信息中的多个数据源ID，比较所述第一主题信息中的多个数据源ID与所述目标用户的行权限信息中的数据源ID；在所述第一主题信息中的第一数据源ID匹配所述目标用户的行权限信息中的数据源ID时，标记所述第一主题信息中的第一数据源ID为授权的行权限信息；在所述第一主题信息中的第二数据源ID不匹配所述目标用户的行权限信息中的数据源ID时，将所述第一主题信息中的第二数据源ID从所述第一主题信息中剔除；将所述第一主题信息中的第一数据源ID作为授权的行权限信息与所述用户ID关联起来进行存储。
具体的，可以理解为，由用户权限缓存子单元缓存所述目标用户的行权限信息，行权限的缓存结构如图2C所示，其结构的核心点如下：第一级结构如以用户为核心，比如图2C中的用户0权限缓存、用户1权限缓存、用户n权限缓存等，即每一个用户拥有自己独立的权限缓存项；第二级结构以Topic为核心， 比如用户0权限缓存中包含了Topic1、Topic2…Topic(x)，即每个用户的每个Topic的权限独立管理；第三级结构则是数据源ID，每一个数据源ID项可以是任何层，并按继承原则进行后续的运算，其中还分为包含与排除项：包含即包含哪些数据源ID，满足条件则进行转发。排除即排除掉对应的数据源ID，满足条件则进行过滤。比如如表2所示，Topic1的行信息身份证信息以及户口信息，如果用户A具有身份证信息的获取权限，则具体的可以获取张三、李四、王五等的身份证信息，而张三、李四、王五等的户口信息则会被排除，最终得到用户A具有权限的行消息。
可见，建立以目标用户为核心的行权限信息，以用户、Topic以及数据源为行权限缓存框架，层层细分，明确了行权限信息的同时，也便于获取授权的行权限信息，以及将不具有权限的信息剔除，减少资源的空耗。
Topic1 张三 李四 王五 ……
身份证信息 @ # ￥ ……
户口信息 重庆 四川 深圳 ……
表2
在一个可能的示例中，所述消息列权限过滤子单元根据所述目标用户的目标用户行列权限信息过滤列权限，得到授权的列权限信息，包括：所述目标用户行列权限信息包含三个层级，第一层级为用户ID，第二层级为主题ID，第三层级为主题ID对应的字段信息，所述用户ID对应至少一个主题ID，所述一个主题ID对应至少一个字段信息；所述消息列权限过滤子单元遍历所述第一主题信息中的多个字段信息，比较所述第一主题信息中的多个字段信息与所述目标用户的列权限信息中的字段；在所述第一主题信息中的第一字段匹配所述目标用户的列权限信息中的字段时，标记所述第一主题信息中的第一字段为授权的列权限信息；在所述第一主题信息中的第二字段不匹配所述目标用户的列权限信息中的字段时，将所述第一主题信息中的第二字段从所述第一主题信息中剔除；将所述第一主题信息中的第一字段作为授权的列权限信息与所述用户ID关联起来进行存储。
具体的，可以理解为，由用户权限缓存子单元缓存所述目标用户的列权限 信息，列权限的缓存结构如图2D所示，列权限即在一个消息中，由多个字段组成，不同的用户针对同一个Topic具有不同的权限。列权限的缓存结构，其核心的结构如下：第一级结构可以以用户为核心，即每一个用户拥有自己独立的列限缓存项；第二级结构以Topic为核心，即每个用户的每个Topic的列限独立管理；第三级结构是Topic的字段列表，即可被访问的具体字段。比如如上述表2所示，Topic1的列信息包含了张三、李四、王五等的身份证信息以及户口信息，比如用户A具有张三的信息获取权限，则具体的可以获取张三的身份证信息与户口信息，其他李四、王五的信息则会被排除，最终得到用户A具有权限的行消息。
可见，建立以目标用户为核心的列权限信息，以用户、Topic以及字段为列权限缓存框架，层层细分，明确了列权限信息的同时，也便于获取授权的列权限信息，以及将不具有权限的信息剔除，减少资源的空耗。
在一个可能的示例中，所述消息生成单元包括主题管理子单元与主题消息发送子单元，所述消息生成单元接收所述目标用户的权限结果信息，并根据所述目标用户的权限结果信息生成所述目标消息与主题路由单元，包括：所述主题管理子单元接收来自所述目标用户权限计算单元发送的所述目标用户的权限结果信息，并从所述目标用户的权限结果信息获取所述目标用户标识ID以及所述目标用户标识对应的第一主题标识ID；所述主题管理子单元根据所述目标用户ID和所述第一主题ID查询包含所述目标用户ID和所述第一主题ID的主题路由单元信息，若未查询到所述主题路由单元信息，则生成包含所述目标用户ID和所述第一主题ID的主题路由单元信息；所述主题消息发送子单元监听消息发送请求，在获取所述消息发送请求后，获取所述目标用户的权限结果信息，对所述目标用户的权限结果信息进行重组，生成目标信息，所述目标信息为目标用户ID包含的第一主题信息中被授权的行列信息。
具体的，主题管理子单元主要进行Topic的管理，对于每一个原始的Topic(x)，比如Topic1、Topic2、Topic3，主题管理子单元在获取Topic ID和User ID后组合成(User ID，Topic(x))的路由单元格式，比如根据目标用户ID和所述第一主题ID形成(目标用户，Topic1)的主题路由单元。同理，也可以形成(目标用户，Topic2)、(目标用户，Topic3)的主题路由单元。若从监听到的消息发送请求中获取到Topic ID和User ID后，以(User ID，Topic ID)数据组进行查询， 如果查询结果不为空，说明所需要的Topic已经创建；如果查询结果为空，则创建以(User ID，Topic ID)为组合主题路由单元。而主题消息发送子单元根据目标用户的权限结果信息(User ID，Topic ID)的格式生成新的目标消息，可以理解为按照(User ID，Topic ID)为一个存储或者缓存单元格，将目标用户的权限结果信息填入这个或者这些单元格。形成(目标用户，Topic1)的目标消息，再由主题消息发送子单元利用(目标用户，Topic1)的主题路由单元将(目标用户，Topic1)的目标消息发送。
可见，通过消息生成单元包括主题管理子单元与主题消息发送子单元根据用户的权限结果信息生成以用户为核心，每个用户订阅的主题为组成部分的目标消息以及目标消息对应的主题发送路由单元。明确了目标用户的权限信息，便于用户权限管理。
与上述图2A所示的实施例一致，请参阅图3，图3是本申请实施例提供的另一种基于消息队列的行列权限管理的方法的流程示意图，应用于权限管理系统；包括：
301、所述消息接收端MQ接收初始消息，并且向所述消息重生模块发送所述初始消息；
302、所述消息重生模块接收来自所述MQ服务接口网关发送的目标用户的订阅信息；
303、所述消息重生模块接收来自所述权限配置模块发送的所述目标用户的行列权限信息；
步骤301-303同前述步骤201-203，在此不再赘述。
304、所述消息重生模块接收初始消息，所述初始消息包括第一主题信息，并根据所述目标用户的行列权限信息计算所述第一主题信息中所述目标用户的行列权限，得到所述目标用户的权限结果信息，并从所述目标用户的权限结果信息获取所述目标用户标识ID以及所述目标用户标识对应的第一主题标识ID；
具体的，可以理解为初始消息中包含了多个主题消息，多个主题消息中包含了第一主题信息。如果所述目标用户订阅了所述第一主题信息，则根据目标用户的行列权限信息计算所述第一主题信息中所述目标用户的行列权限，即将第一主题信息中目标用户具有权限的行列信息保存下来，将第一主题信息中目标用户不具有权限的行列信息剔除，最终得到所述目标用户的权限结果信息。 而权限结果信息中包含了目标用户的ID，比如目标用户的ID为A，第一主题标识ID为Topic1。
305、所述消息重生模块根据所述目标用户ID和所述第一主题ID查询包含所述目标用户ID和所述第一主题ID的主题路由单元信息，若未查询到所述主题路由单元信息，则生成包含所述目标用户ID和所述第一主题ID的主题路由单元信息，根据所述目标用户的权限结果信息，生成目标信息，并向所述消息发送端MQ发送所述目标消息；
具体的，可以理解为以(User ID，Topic ID)数据组为查询格式，比如以(目标用户，Topic1)进行查询是否已经存在这样一个以目标用户为核心，以第一主题为内容的主题路由单元，若获取该路由单元，表明已经存在该路由单元。若查询结果为空，则表明不存在该路由单元，因此需要建立(目标用户，Topic1)路由单元。并且在建立这个路由单元之后，还要以(目标用户，Topic1)为消息组织形式，生成目标消息。再利用(目标用户，Topic1)的主题路由单元将(目标用户，Topic1)的目标消息向消息发送端MQ发送。
306、所述消息发送端MQ在接收所述目标消息后，向目标用户端发送所述目标消息。
步骤306同前述步骤205，在此不再赘述。
可见，本申请实施例中通过消息接收端MQ与消息发送端MQ的双实例结构部署，并在两端之间，通过设置消息重生模块、权限配置模块、MQ服务接口网关联合起来管理消息队列的行列权限。而且生成的消息以(User ID，Topic ID)为数据表现形式，体现出目标消息是以用户为核心，以用户具有行列权限的Topic为内容，实现对用户行列权限的管理。较之于单实例原生的MQ，对于消息的生产者以及消息的消费者而言，依然是消息的生产与消息的接收，即实现了权限的管理，又不会对消息的生产者以及消息的消费者增加额外的资源消耗，从而权限的管理过程既保障了MQ的安全性，又不破坏MQ的原生特性。
与上图2A、图3所示的实施例一致的，请参阅图4，图4是本申请实施例提供的一种基于消息队列的行列权限管理装置400的功能单元结构示意图，应用于权限管理系统，所述行列权限管理装置400包括通信单元410，处理单元420，其中：
所述处理单元420，用于控制所述消息接收端MQ接收初始消息，并且向所 述消息重生模块发送所述初始消息；
所述处理单元420，还用于控制所述消息重生模块接收来自所述MQ服务接口网关发送的目标用户的订阅信息；
所述处理单元420，还用于控制所述消息重生模块接收来自所述权限配置模块发送的所述目标用户的行列权限信息；
所述处理单元420，还用于控制所述消息重生模块接收所述初始消息，并根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元，并使用所述主题路由单元向所述消息发送端MQ发送所述目标消息；
所述处理单元420，还用于控制所述消息发送端MQ在接收所述目标消息后，向目标用户端发送所述目标消息。
可见，本申请实施例中通过处理单元控制消息接收端MQ与消息发送端MQ的双实例结构部署，并在两端之间，通过设置消息重生模块、权限配置模块、MQ服务接口网关联合起来管理消息队列的行列权限。较之于单实例原生的MQ，对于消息的生产者以及消息的消费者而言，依然是消息的生产与消息的接收，即实现了权限的管理，又不会对消息的生产者以及消息的消费者增加额外的资源消耗，从而权限的管理过程既保障了MQ的安全性，又不破坏MQ的原生特性。
在一个可能的示例中，所述消息重生模块包括用户定阅主题路由单元，目标用户权限计算单元，消息生成单元，在所述消息重生模块根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元方面，所述处理单元420，具体用于控制所述用户定阅主题路由单元监听多个主题信息的路由请求，在监听到第一主题信息的路由请求时，若根据所述目标用户的订阅信息判断出所述目标用户订阅了所述第一主题信息，则将所述第一主题信息路由至所述目标用户权限计算单元；所述目标用户权限计算单元根据所述目标用户的行列权限信息计算所述第一主题信息中所述目标用户的行列权限，得到所述目标用户的权限结果信息，并向所述消息生成单元发送所述目标用户的权限结果信息；所述消息生成单元接收所述目标用户的权限结果信息，并根据所述目标用户的权限结果信息生成目标消息与主题路由单元。
在一个可能的示例中，所述用户订阅主题路由单元包括主题路由信息表与 主题路由执行子单元，在所述用户定阅主题路由单元监听多个主题信息的路由请求，在监听到第一主题信息的路由请求时，若根据所述目标用户的订阅信息判断出所述目标用户订阅了所述第一主题信息，则将所述第一主题信息路由至所述目标用户权限计算单元方面，所述处理单元420，具体用于根据多个用户的订阅信息建立所述主题路由信息表，所述主题路由信息表中多个主题中的每一个主题对应至少一个用户信息，所述多个用户的订阅信息中包括所述目标用户的订阅信息；所述主题执行单元监听多个主题信息的路由请求，在监听到所述第一主题信息的路由请求时，查找所述主题路由信息表中所述第一主题信息的路由表项；遍历所述第一主题信息的路由表项，若在所述第一主题信息的路由表项获取到所述目标用户的信息，则将所述第一主题信息路由至所述目标用户权限计算单元。
在一个可能的示例中，所述目标用户权限计算单元包括用户权限缓存子单元、行权限过滤子单元、列权限过滤子单元，在所述目标用户权限计算单元根据所述目标用户的行列权限信息计算所述第一主题信息中所述目标用户的行列权限，得到所述目标用户的权限结果信息方面，所述处理单元420，具体用于控制所述用户权限缓存子单元缓存所述目标用户的行列权限信息，所述目标用户的行列权限信息来自于所述权限配置模块，所述目标用户的行列权限信息包括所述目标用户的行权限信息与所述目标用户的列权限信息；所述消息行权限过滤子单元根据所述目标用户的行权限信息过滤所述第一主题信息，得到授权的行权限信息；所述消息列权限过滤子单元根据所述目标用户的列权限信息过滤所述第一主题信息，得到授权的列权限信息；根据所述授权的行权限信息与所述授权的列权限信息得到所述目标用户的权限结果信息。
在一个可能的示例中，在所述消息行权限过滤子单元根据所述目标用户的行权限信息过滤所述第一主题信息，得到授权的行权限信息方面，所述处理单元420，具体用于所述目标用户行权限信息包含三个层级，第一层级为用户ID，第二层级为主题ID，第三层级为数据源ID，所述用户ID对应至少一个主题ID，所述一个主题ID对应至少一个数据源ID；所述消息行权限过滤子单元遍历所述第一主题信息中的多个数据源ID，比较所述第一主题信息中的多个数据源ID与所述目标用户的行权限信息中的数据源ID；在所述第一主题信息中的第一数据源ID匹配所述目标用户的行权限信息中的数据源ID时，标记所述第一主题信 息中的第一数据源ID为授权的行权限信息；在所述第一主题信息中的第二数据源ID不匹配所述目标用户的行权限信息中的数据源ID时，将所述第一主题信息中的第二数据源ID从所述第一主题信息中剔除；将所述第一主题信息中的第一数据源ID作为授权的行权限信息与所述用户ID关联起来进行存储。
在一个可能的示例中，在所述消息列权限过滤子单元根据所述目标用户的目标用户行列权限信息过滤列权限，得到授权的列权限信息方面，所述处理单元420，具体用于所述目标用户行列权限信息包含三个层级，第一层级为用户ID，第二层级为主题ID，第三层级为主题ID对应的字段信息，所述用户ID对应至少一个主题ID，所述一个主题ID对应至少一个字段信息；所述消息列权限过滤子单元遍历所述第一主题信息中的多个字段信息，比较所述第一主题信息中的多个字段信息与所述目标用户的列权限信息中的字段；在所述第一主题信息中的第一字段匹配所述目标用户的列权限信息中的字段时，标记所述第一主题信息中的第一字段为授权的列权限信息；在所述第一主题信息中的第二字段不匹配所述目标用户的列权限信息中的字段时，将所述第一主题信息中的第二字段从所述第一主题信息中剔除；将所述第一主题信息中的第一字段作为授权的列权限信息与所述用户ID关联起来进行存储。
在一个可能的示例中，所述消息生成单元包括主题管理子单元与主题消息发送子单元，在所述消息生成单元接收所述目标用户的权限结果信息，并根据所述目标用户的权限结果信息生成所述目标消息与主题路由单元方面，所述处理单元420，具体用于控制所述主题管理子单元接收来自所述目标用户权限计算单元发送的所述目标用户的权限结果信息，并从所述目标用户的权限结果信息获取所述目标用户标识ID以及所述目标用户标识对应的第一主题标识ID；所述主题管理子单元根据所述目标用户ID和所述第一主题ID查询包含所述目标用户ID和所述第一主题ID的主题路由单元信息，若未查询到所述主题路由单元信息，则生成包含所述目标用户ID和所述第一主题ID的主题路由单元信息；所述主题消息发送子单元监听消息发送请求，在获取所述消息发送请求后，获取所述目标用户的权限结果信息，对所述目标用户的权限结果信息进行重组，生成目标信息，所述目标信息为目标用户ID包含的第一主题信息中被授权的行列信息。
图5是本申请实施例提供的电子设备500的结构示意图，如图所示，所述 电子设备500包括处理器510、存储器520、通信接口530以及一个或多个程序521，其中，所述一个或多个程序521被存储在上述存储器520中，并且被配置由上述处理器510执行，所述一个或多个程序521包括用于执行以下步骤的指令：
所述消息接收端MQ接收初始消息，并且向所述消息重生模块发送所述初始消息；
所述消息重生模块接收来自所述MQ服务接口网关发送的目标用户的订阅信息；
所述消息重生模块接收来自所述权限配置模块发送的所述目标用户的行列权限信息；
所述消息重生模块接收所述初始消息，并根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元，并使用所述主题路由单元向所述消息发送端MQ发送所述目标消息；
所述消息发送端MQ在接收所述目标消息后，向目标用户端发送所述目标消息。
可见，本申请实施例中通过一个或多个程序指令控制消息接收端MQ与消息发送端MQ的双实例结构部署，并在两端之间，通过设置消息重生模块、权限配置模块、MQ服务接口网关联合起来管理消息队列的行列权限。较之于单实例原生的MQ，对于消息的生产者以及消息的消费者而言，依然是消息的生产与消息的接收，即实现了权限的管理，又不会对消息的生产者以及消息的消费者增加额外的资源消耗，从而权限的管理过程既保障了MQ的安全性，又不破坏MQ的原生特性。
在一个可能的示例中，所述消息重生模块包括用户定阅主题路由单元，目标用户权限计算单元，消息生成单元，在所述消息重生模块根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元方面，所述一个或多个程序521具体包括用于执行以下操作的指令，所述用户定阅主题路由单元监听多个主题信息的路由请求，在监听到第一主题信息的路由请求时，若根据所述目标用户的订阅信息判断出所述目标用户订阅了所述第一主题信息，则将所述第一主题信息路由至所述目标用户权限计算单元；所述目标用户权限计算单元根据所述目标用户的行列权限信息计算所述第一主题 信息中所述目标用户的行列权限，得到所述目标用户的权限结果信息，并向所述消息生成单元发送所述目标用户的权限结果信息；所述消息生成单元接收所述目标用户的权限结果信息，并根据所述目标用户的权限结果信息生成目标消息与主题路由单元。
在一个可能的示例中，所述用户订阅主题路由单元包括主题路由信息表与主题路由执行子单元，在所述用户定阅主题路由单元监听多个主题信息的路由请求，在监听到第一主题信息的路由请求时，若根据所述目标用户的订阅信息判断出所述目标用户订阅了所述第一主题信息，则将所述第一主题信息路由至所述目标用户权限计算单元方面，所述一个或多个程序521具体包括用于执行以下操作的指令，根据多个用户的订阅信息建立所述主题路由信息表，所述主题路由信息表中多个主题中的每一个主题对应至少一个用户信息，所述多个用户的订阅信息中包括所述目标用户的订阅信息；所述主题执行单元监听多个主题信息的路由请求，在监听到所述第一主题信息的路由请求时，查找所述主题路由信息表中所述第一主题信息的路由表项；遍历所述第一主题信息的路由表项，若在所述第一主题信息的路由表项获取到所述目标用户的信息，则将所述第一主题信息路由至所述目标用户权限计算单元。
在一个可能的示例中，所述目标用户权限计算单元包括用户权限缓存子单元、行权限过滤子单元、列权限过滤子单元，在所述目标用户权限计算单元根据所述目标用户的行列权限信息计算所述第一主题信息中所述目标用户的行列权限，得到所述目标用户的权限结果信息方面，所述一个或多个程序521具体包括用于执行以下操作的指令，所述用户权限缓存子单元缓存所述目标用户的行列权限信息，所述目标用户的行列权限信息来自于所述权限配置模块，所述目标用户的行列权限信息包括所述目标用户的行权限信息与所述目标用户的列权限信息；所述消息行权限过滤子单元根据所述目标用户的行权限信息过滤所述第一主题信息，得到授权的行权限信息；所述消息列权限过滤子单元根据所述目标用户的列权限信息过滤所述第一主题信息，得到授权的列权限信息；根据所述授权的行权限信息与所述授权的列权限信息得到所述目标用户的权限结果信息。
在一个可能的示例中，在所述消息行权限过滤子单元根据所述目标用户的行权限信息过滤所述第一主题信息，得到授权的行权限信息方面，所述一个或 多个程序521具体包括用于执行以下操作的指令，所述目标用户行权限信息包含三个层级，第一层级为用户ID，第二层级为主题ID，第三层级为数据源ID，所述用户ID对应至少一个主题ID，所述一个主题ID对应至少一个数据源ID；所述消息行权限过滤子单元遍历所述第一主题信息中的多个数据源ID，比较所述第一主题信息中的多个数据源ID与所述目标用户的行权限信息中的数据源ID；在所述第一主题信息中的第一数据源ID匹配所述目标用户的行权限信息中的数据源ID时，标记所述第一主题信息中的第一数据源ID为授权的行权限信息；在所述第一主题信息中的第二数据源ID不匹配所述目标用户的行权限信息中的数据源ID时，将所述第一主题信息中的第二数据源ID从所述第一主题信息中剔除；将所述第一主题信息中的第一数据源ID作为授权的行权限信息与所述用户ID关联起来进行存储。
在一个可能的示例中，在所述消息列权限过滤子单元根据所述目标用户的目标用户行列权限信息过滤列权限，得到授权的列权限信息方面，所述一个或多个程序521具体包括用于执行以下操作的指令，所述目标用户行列权限信息包含三个层级，第一层级为用户ID，第二层级为主题ID，第三层级为主题ID对应的字段信息，所述用户ID对应至少一个主题ID，所述一个主题ID对应至少一个字段信息；所述消息列权限过滤子单元遍历所述第一主题信息中的多个字段信息，比较所述第一主题信息中的多个字段信息与所述目标用户的列权限信息中的字段；在所述第一主题信息中的第一字段匹配所述目标用户的列权限信息中的字段时，标记所述第一主题信息中的第一字段为授权的列权限信息；在所述第一主题信息中的第二字段不匹配所述目标用户的列权限信息中的字段时，将所述第一主题信息中的第二字段从所述第一主题信息中剔除；将所述第一主题信息中的第一字段作为授权的列权限信息与所述用户ID关联起来进行存储。
在一个可能的示例中，所述消息生成单元包括主题管理子单元与主题消息发送子单元，在所述消息生成单元接收所述目标用户的权限结果信息，并根据所述目标用户的权限结果信息生成所述目标消息与主题路由单元方面，所述一个或多个程序521具体包括用于执行以下操作的指令，所述主题管理子单元接收来自所述目标用户权限计算单元发送的所述目标用户的权限结果信息，并从所述目标用户的权限结果信息获取所述目标用户标识ID以及所述目标用户标识 对应的第一主题标识ID；所述主题管理子单元根据所述目标用户ID和所述第一主题ID查询包含所述目标用户ID和所述第一主题ID的主题路由单元信息，若未查询到所述主题路由单元信息，则生成包含所述目标用户ID和所述第一主题ID的主题路由单元信息；所述主题消息发送子单元监听消息发送请求，在获取所述消息发送请求后，获取所述目标用户的权限结果信息，对所述目标用户的权限结果信息进行重组，生成目标信息，所述目标信息为目标用户ID包含的第一主题信息中被授权的行列信息。
其中，处理器510可以包括一个或多个处理核心，比如4核心处理器、8核心处理器等。处理器510可以采用DSP(Digital Signal Processing，数字信号处理)、FPGA(Field－Programmable Gate Array，现场可编程门阵列)、PLA(Programmable Logic Array，可编程逻辑阵列)中的至少一种硬件形式来实现。处理器510也可以包括主处理器和协处理器，主处理器是用于对在唤醒状态下的数据进行处理的处理器，也称CPU(Central Processing Unit，中央处理器)；协处理器是用于对在待机状态下的数据进行处理的低功耗处理器。在一些实施例中，处理器可以在集成有GPU(Graphics Processing Unit，图像处理器)，GPU用于负责显示屏所需要显示的内容的渲染和绘制。一些实施例中，处理器510还可以包括AI(Artificial Intelligence，人工智能)处理器，该AI处理器用于处理有关机器学习的计算操作。
存储器520可以包括一个或多个计算机可读存储介质，该计算机可读存储介质可以是非暂态的。存储器520还可包括高速随机存取存储器，以及非易失性存储器，比如一个或多个磁盘存储设备、闪存存储设备。本实施例中，存储器520至少用于存储以下计算机程序，其中，该计算机程序被处理器510加载并执行之后，能够实现前述任一实施例公开的通话控制方法中的相关步骤。另外，存储器520所存储的资源还可以包括操作系统和数据等，存储方式可以是短暂存储或者永久存储。其中，操作系统可以包括Windows、Unix、Linux等。数据可以包括但不限于电子设备交互数据、电子设备信号等。
在一些实施例中，电子设备500还可包括有输入输出接口、通信接口、电源以及通信总线。
本领域技术人员可以理解，本实施例公开的结构并不构成对电子设备500的限定，可以包括更多或更少的组件。
上述主要从方法侧执行过程的角度对本申请实施例的方案进行了介绍。可以理解的是，电子设备为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所提供的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对电子设备进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
本申请实施例提供了一种芯片，该芯片包括处理器与数据接口，该处理器通过该数据接口读取存储器上存储的指令，如上述方法实施例中记载的任一方法的部分或全部步骤。
本申请实施例还提供一种计算机存储介质，其中，该计算机存储介质存储用于电子数据交换的计算机程序，该计算机程序使得计算机执行如上述方法实施例中记载的任一方法的部分或全部步骤，上述计算机包括电子设备。
本申请实施例还提供一种计算机程序产品，上述计算机程序产品包括存储了计算机程序的非瞬时性计算机可读存储介质，上述计算机程序可操作来使计算机执行如上述方法实施例中记载的任一方法的部分或全部步骤。该计算机程序产品可以为一个软件安装包，上述计算机包括上述电子设备。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，可通过其它的方式实现。例如，以上所描述的电子设备实施例仅仅是示意性的，例如上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
上述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
上述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储器中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储器中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本申请各个实施例上述方法的全部或部分步骤。而前述的存储器包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于计算机可读存储器中，存储器可以包括：闪存盘、只读存储器(英文：Read-Only Memory，简称：ROM)、随机存取器(英文：Random Access Memory，简称：RAM)、磁盘或光盘等。
以上所揭露的仅为本申请的部分实施例而已，当然不能以此来限定本申请 之权利范围，本领域普通技术人员可以理解实现上述实施例的全部或部分流程，并依本申请权利要求所作的等同变化，仍属于本申请所涵盖的范围。

Claims (10)

  1. 一种基于消息队列的行列权限管理的方法，其特征在于，应用于权限管理系统，所述权限管理系统包括消息接收端消息队列MQ，消息重生模块、权限配置模块、MQ服务接口网关与消息发送端MQ，所述方法包括：
    所述消息接收端MQ接收初始消息，并且向所述消息重生模块发送所述初始消息；
    所述消息重生模块接收来自所述MQ服务接口网关发送的目标用户的订阅信息；
    所述消息重生模块接收来自所述权限配置模块发送的所述目标用户的行列权限信息；
    所述消息重生模块接收所述初始消息，并根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元，并使用所述主题路由单元向所述消息发送端MQ发送所述目标消息；
    所述消息发送端MQ在接收所述目标消息后，向目标用户端发送所述目标消息。
  2. 根据权利要求1所述的方法，其特征在于，所述消息重生模块包括用户定阅主题路由单元，目标用户权限计算单元，消息生成单元，所述消息重生模块根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元，包括：
    所述用户定阅主题路由单元监听多个主题信息的路由请求，在监听到第一主题信息的路由请求时，若根据所述目标用户的订阅信息判断出所述目标用户订阅了所述第一主题信息，则将所述第一主题信息路由至所述目标用户权限计算单元；
    所述目标用户权限计算单元根据所述目标用户的行列权限信息计算所述第一主题信息中所述目标用户的行列权限，得到所述目标用户的权限结果信息，并向所述消息生成单元发送所述目标用户的权限结果信息；
    所述消息生成单元接收所述目标用户的权限结果信息，并根据所述目标用户的权限结果信息生成目标消息与主题路由单元。
  3. 根据权利要求2所述的方法，其特征在于，所述用户订阅主题路由单元包括主题路由信息表与主题路由执行子单元，所述用户定阅主题路由单元监听 多个主题信息的路由请求，在监听到第一主题信息的路由请求时，若根据所述目标用户的订阅信息判断出所述目标用户订阅了所述第一主题信息，则将所述第一主题信息路由至所述目标用户权限计算单元，包括：
    根据多个用户的订阅信息建立所述主题路由信息表，所述主题路由信息表中多个主题中的每一个主题对应至少一个用户信息，所述多个用户的订阅信息中包括所述目标用户的订阅信息；
    所述主题执行单元监听多个主题信息的路由请求，在监听到所述第一主题信息的路由请求时，查找所述主题路由信息表中所述第一主题信息的路由表项；
    遍历所述第一主题信息的路由表项，若在所述第一主题信息的路由表项获取到所述目标用户的信息，则将所述第一主题信息路由至所述目标用户权限计算单元。
  4. 根据权利要求2所述的方法，其特征在于，所述目标用户权限计算单元包括用户权限缓存子单元、行权限过滤子单元、列权限过滤子单元，所述目标用户权限计算单元根据所述目标用户的行列权限信息计算所述第一主题信息中所述目标用户的行列权限，得到所述目标用户的权限结果信息，包括：
    所述用户权限缓存子单元缓存所述目标用户的行列权限信息，所述目标用户的行列权限信息来自于所述权限配置模块，所述目标用户的行列权限信息包括所述目标用户的行权限信息与所述目标用户的列权限信息；
    所述消息行权限过滤子单元根据所述目标用户的行权限信息过滤所述第一主题信息，得到授权的行权限信息；
    所述消息列权限过滤子单元根据所述目标用户的列权限信息过滤所述第一主题信息，得到授权的列权限信息；
    根据所述授权的行权限信息与所述授权的列权限信息得到所述目标用户的权限结果信息。
  5. 根据权利要求4所述的方法，其特征在于，所述消息行权限过滤子单元根据所述目标用户的行权限信息过滤所述第一主题信息，得到授权的行权限信息，包括：
    所述目标用户行权限信息包含三个层级，第一层级为用户ID，第二层级为主题ID，第三层级为数据源ID，所述用户ID对应至少一个主题ID，所述一个主题ID对应至少一个数据源ID；
    所述消息行权限过滤子单元遍历所述第一主题信息中的多个数据源ID，比较所述第一主题信息中的多个数据源ID与所述目标用户的行权限信息中的数据源ID；
    在所述第一主题信息中的第一数据源ID匹配所述目标用户的行权限信息中的数据源ID时，标记所述第一主题信息中的第一数据源ID为授权的行权限信息；
    在所述第一主题信息中的第二数据源ID不匹配所述目标用户的行权限信息中的数据源ID时，将所述第一主题信息中的第二数据源ID从所述第一主题信息中剔除；
    将所述第一主题信息中的第一数据源ID作为授权的行权限信息与所述用户ID关联起来进行存储。
  6. 根据权利要求4所述的方法，其特征在于，所述消息列权限过滤子单元根据所述目标用户的目标用户行列权限信息过滤列权限，得到授权的列权限信息，包括：
    所述目标用户行列权限信息包含三个层级，第一层级为用户ID，第二层级为主题ID，第三层级为主题ID对应的字段信息，所述用户ID对应至少一个主题ID，所述一个主题ID对应至少一个字段信息；
    所述消息列权限过滤子单元遍历所述第一主题信息中的多个字段信息，比较所述第一主题信息中的多个字段信息与所述目标用户的列权限信息中的字段；
    在所述第一主题信息中的第一字段匹配所述目标用户的列权限信息中的字段时，标记所述第一主题信息中的第一字段为授权的列权限信息；
    在所述第一主题信息中的第二字段不匹配所述目标用户的列权限信息中的字段时，将所述第一主题信息中的第二字段从所述第一主题信息中剔除；
    将所述第一主题信息中的第一字段作为授权的列权限信息与所述用户ID关联起来进行存储。
  7. 根据权利要求2所述的方法，其特征在于，所述消息生成单元包括主题管理子单元与主题消息发送子单元，所述消息生成单元接收所述目标用户的权限结果信息，并根据所述目标用户的权限结果信息生成所述目标消息与主题路由单元，包括：
    所述主题管理子单元接收来自所述目标用户权限计算单元发送的所述目标用户的权限结果信息，并从所述目标用户的权限结果信息获取所述目标用户标识ID以及所述目标用户标识对应的第一主题标识ID；
    所述主题管理子单元根据所述目标用户ID和所述第一主题ID查询包含所述目标用户ID和所述第一主题ID的主题路由单元信息，若未查询到所述主题路由单元信息，则生成包含所述目标用户ID和所述第一主题ID的主题路由单元信息；
    所述主题消息发送子单元监听消息发送请求，在获取所述消息发送请求后，获取所述目标用户的权限结果信息，对所述目标用户的权限结果信息进行重组，生成目标信息，所述目标信息为目标用户ID包含的第一主题信息中被授权的行列信息。
  8. 一种基于消息队列的行列权限管理装置，其特征在于，应用于权限管理系统，所述权限管理系统包括消息接收端消息队列MQ，消息重生模块、权限配置模块、MQ服务接口网关与消息发送端MQ，所述行列权限管理装置包括通信单元与处理单元，其中：
    所述处理单元，用于控制所述消息接收端MQ接收初始消息，并且向所述消息重生模块发送所述初始消息；
    所述处理单元，还用于控制所述消息重生模块接收来自所述MQ服务接口网关发送的目标用户的订阅信息；
    所述处理单元，还用于控制所述消息重生模块接收来自所述权限配置模块发送的所述目标用户的行列权限信息；
    所述处理单元，还用于控制所述消息重生模块接收所述初始消息，并根据所述订阅信息与所述目标用户的行列权限信息过滤所述初始消息生成目标消息与主题路由单元，并使用所述主题路由单元向所述消息发送端MQ发送所述目标消息；
    所述处理单元，还用于控制所述消息发送端MQ在接收所述目标消息后，向目标用户端发送所述目标消息。
  9. 一种电子设备，其特征在于，包括处理器、存储器、通信接口，以及一个或多个程序，所述一个或多个程序被存储在所述存储器中，并且被配置由所述处理器执行，所述程序包括用于执行如权利要求1-7任一项所述的方法中的步 骤的指令。
  10. 一种计算机可读存储介质，其特征在于，存储用于电子数据交换的计算机程序，其中，所述计算机程序使得计算机执行如权利要求1-7任一项所述的方法。
PCT/CN2020/109047 2019-12-31 2020-08-14 基于消息队列的行列权限管理的方法及相关装置 WO2021135255A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911418687.XA CN111181976B (zh) 2019-12-31 2019-12-31 基于消息队列的行列权限管理的方法系统、电子设备及存储介质
CN201911418687.X 2019-12-31

Publications (1)

Publication Number Publication Date
WO2021135255A1 true WO2021135255A1 (zh) 2021-07-08

Family

ID=70623519

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/109047 WO2021135255A1 (zh) 2019-12-31 2020-08-14 基于消息队列的行列权限管理的方法及相关装置

Country Status (2)

Country Link
CN (1) CN111181976B (zh)
WO (1) WO2021135255A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114969811A (zh) * 2022-05-16 2022-08-30 贵州领航视讯信息技术有限公司 一种基于数据分段的数据权限控制方法
CN116208379A (zh) * 2022-12-30 2023-06-02 金茂云科技服务(北京)有限公司 物联网设备mqtt主题发布订阅权限校验方法及系统

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111181976B (zh) * 2019-12-31 2022-06-24 深圳云天励飞技术股份有限公司 基于消息队列的行列权限管理的方法系统、电子设备及存储介质
CN114422966B (zh) * 2020-10-28 2023-05-30 中国联合网络通信集团有限公司 信息发送方法及电子设备
CN113055484A (zh) * 2021-03-19 2021-06-29 北京星汉博纳医药科技有限公司 一套通用的医药数据智能同步系统
CN116346570A (zh) * 2021-12-22 2023-06-27 华为技术有限公司 一种消息通知方法以及相关装置
CN114979178B (zh) * 2022-05-12 2023-11-10 中国人民解放军陆军装甲兵学院 一种基于消息队列的消息流向控制平台及方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101431476A (zh) * 2008-12-12 2009-05-13 中国工商银行股份有限公司 一种基于消息队列的数据传输方法、服务器及系统
CN105677774A (zh) * 2015-12-30 2016-06-15 百度在线网络技术（北京）有限公司 一种数据事件推送方法和装置
CN107332787A (zh) * 2017-06-29 2017-11-07 北京奇艺世纪科技有限公司 一种消息分发方法和装置
CN110209507A (zh) * 2019-05-16 2019-09-06 厦门市美亚柏科信息股份有限公司 基于消息队列的数据处理方法、装置、系统及存储介质
US20190306010A1 (en) * 2018-04-02 2019-10-03 Oracle International Corporation Data Replication Conflict Detection and Resolution for a Multi-Tenant Identity Cloud Service
CN111181976A (zh) * 2019-12-31 2020-05-19 深圳云天励飞技术有限公司 基于消息队列的行列权限管理的方法及相关装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7406537B2 (en) * 2002-11-26 2008-07-29 Progress Software Corporation Dynamic subscription and message routing on a topic between publishing nodes and subscribing nodes
US20070245018A1 (en) * 2006-04-12 2007-10-18 International Business Machines Corporation Dynamic access control in a content-based publish/subscribe system with delivery guarantees
CN106302817A (zh) * 2016-09-29 2017-01-04 南京中新赛克科技有限责任公司 一种基于分布式消息队列的数据总线实现方法和装置
CN109428922B (zh) * 2017-08-29 2020-09-08 华为技术有限公司 一种订阅发布方法及服务器
CN110278231A (zh) * 2018-03-16 2019-09-24 中移(苏州)软件技术有限公司 一种数据订阅分发方法及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101431476A (zh) * 2008-12-12 2009-05-13 中国工商银行股份有限公司 一种基于消息队列的数据传输方法、服务器及系统
CN105677774A (zh) * 2015-12-30 2016-06-15 百度在线网络技术（北京）有限公司 一种数据事件推送方法和装置
CN107332787A (zh) * 2017-06-29 2017-11-07 北京奇艺世纪科技有限公司 一种消息分发方法和装置
US20190306010A1 (en) * 2018-04-02 2019-10-03 Oracle International Corporation Data Replication Conflict Detection and Resolution for a Multi-Tenant Identity Cloud Service
CN110209507A (zh) * 2019-05-16 2019-09-06 厦门市美亚柏科信息股份有限公司 基于消息队列的数据处理方法、装置、系统及存储介质
CN111181976A (zh) * 2019-12-31 2020-05-19 深圳云天励飞技术有限公司 基于消息队列的行列权限管理的方法及相关装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114969811A (zh) * 2022-05-16 2022-08-30 贵州领航视讯信息技术有限公司 一种基于数据分段的数据权限控制方法
CN114969811B (zh) * 2022-05-16 2023-04-07 贵州领航视讯信息技术有限公司 一种基于数据分段的数据权限控制方法
CN116208379A (zh) * 2022-12-30 2023-06-02 金茂云科技服务(北京)有限公司 物联网设备mqtt主题发布订阅权限校验方法及系统
CN116208379B (zh) * 2022-12-30 2023-08-22 金茂云科技服务(北京)有限公司 物联网设备mqtt主题发布订阅权限校验方法及系统

Also Published As

Publication number Publication date
CN111181976A (zh) 2020-05-19
CN111181976B (zh) 2022-06-24

Similar Documents

Publication Publication Date Title
WO2021135255A1 (zh) 基于消息队列的行列权限管理的方法及相关装置
US10356078B2 (en) Web ticket based upon a symmetric key usable for user authentication
US8924674B2 (en) Permissions of objects in hosted storage
CN110839078B (zh) 代理推送
US9197611B2 (en) Topic protection policy for publish-subscribe messaging system
US20130215126A1 (en) Managing Font Distribution
TW202025685A (zh) 跨鏈存證方法及接取方法、裝置、電子設備
US20130024526A1 (en) Method of managing feeds based on classifications
US10235047B2 (en) Memory management method, apparatus, and system
US10409656B2 (en) Efficiently receiving messages across a large number of messaging entities
CN103312624A (zh) 一种消息队列服务系统和方法
US8375124B1 (en) Resumable upload for hosted storage systems
CN113361913A (zh) 一种通信业务编排方法、装置、计算机设备及存储介质
CN108234551A (zh) 一种数据处理方法及装置
US10268532B2 (en) Application message processing system, method, and application device
WO2023273922A1 (zh) 一种账号管理方法、系统和计算机可读存储介质
WO2019109922A1 (zh) 资源处理方法及系统、存储介质、电子设备
US10873557B2 (en) Publishing message conversations to electronic forums
CN109088913A (zh) 请求数据的方法和负载均衡服务器
CN113630342B (zh) 一种虚拟交换机的转发表管理方法、系统及装置
CN117828672B (zh) 细粒度动态授权的访问控制与高并发处理方法及装置
CN116662016B (zh) 端口切换方法、装置、计算机设备、存储介质和程序产品

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20910086

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 21/11/2022)

122 Ep: pct application non-entry in european phase

Ref document number: 20910086

Country of ref document: EP

Kind code of ref document: A1