WO2021147442A1

WO2021147442A1 - Access control method and apparatus, terminal device, and storage medium

Info

Publication number: WO2021147442A1
Application number: PCT/CN2020/125522
Authority: WO
Inventors: 周冲
Original assignee: 华为技术有限公司
Priority date: 2020-01-22
Filing date: 2020-10-30
Publication date: 2021-07-29
Also published as: CN113158198A

Abstract

An access control method and apparatus, a terminal device, and a storage medium. The method comprises: upon receipt of request information, sent by an accessing part, of accessing an accessed party, determining whether the request information carries a target token, the target token being found from a pre-constructed token resource pool and allocated for the accessing part when it is determined that the accessing party has the permission of accessing the accessed party; if the request information carries the target token, performing validity verification on the target token; and after the validity verification is successful, permitting the access of the accessing party to the accessed party. By using this configuration, even if an application subject tampers with permission information when accessing an object resource, the application subject still needs a valid token to access the object resource, and therefore, illegal accesses of an application to various services or resources are effectively reduced, and the security of access control is improved.

Description

Access control method, device, terminal equipment and storage medium

This application claims the priority of a Chinese patent application filed with the State Intellectual Property Office on January 22, 2020, the application number is 202010075429.2, and the application name is "Access control methods, devices, terminal equipment and storage media", the entire content of which is incorporated by reference Incorporated in this application.

Technical field

This application belongs to the field of computer technology, and in particular relates to an access control method, device, terminal device, and storage medium.

Background technique

Android applications generally define User Identification (UID) and permission lists in the Manifest file, and grant corresponding permissions when the application is installed or when resources are used.

When an application subject accesses an object resource, it usually finds the corresponding permission from the permission list through the UID of the application subject, so as to decide whether to allow the application subject to access the object resource to achieve access control.

However, if the application tampered with its own UID or tampered with the permissions corresponding to the UID, it is likely to cause the problem of unauthorized access. Therefore, the security of access control in this way is low.

Summary of the invention

In view of this, the embodiments of the present application provide an access control method, device, terminal device, and storage medium, which can improve the security of access control.

In the first aspect, an embodiment of the present application provides an access control method, including:

When receiving the request information for accessing the accessed party sent by the accessing party, it is determined whether the request information carries a target token, and the target token is used to determine that the accessing party has the authority to access the accessed party. At the time, search from the pre-built token resource pool and assign it to the accessing party;

If the request information carries a target token, verify the validity of the target token;

After the legality verification is passed, the visiting party is allowed to access the visited party.

Before the visitor visits the visited party, the corresponding token will be assigned to the visitor according to the visitor's authority. Later, when the visitor visits the visited party, it only needs to verify the validity of the token carried by the visitor. , So as to achieve token-based access control. Through this setting, even if the application subject (visiting party) tampered with the corresponding authority information when accessing the object resource (accessed party), the application subject still needs a legal token to access the object resource, which can effectively reduce the number of applications. Illegal access to various services or resources improves the security of access control.

Further, after determining whether the request information carries the target token, it may further include:

If the request information does not carry the target token, the target token is searched from the token resource pool, and the found target token is allocated to the access party.

The request information does not carry the target token, which may be because the visitor has accessed the visited party for the first time and has not applied for the target token. At this time, the target token can be searched from the token resource pool, and the searched target token can be allocated to the access party. According to the set access control authority policy, if the access party has access authority, the corresponding target token can be found from the token resource pool; if the access party does not have access authority, the token resource cannot be retrieved The corresponding target token is found in the pool.

Further, before the legality verification of the target token is performed, it may further include:

Check whether the target token is invalid;

If the target token has expired, searching for a new target token from the token resource pool to replace the invalid target token.

Many tokens are time-sensitive, so before verifying the validity of the token, it is possible to check whether the target token carried by the accessing party has expired, so as to determine whether a new target token needs to be obtained.

Optionally, the target token can be generated in the following manner and added to the token resource pool:

When it is detected that the accessed party is activated, the access control authority policy and the flow control policy of the accessed party are obtained. The access control authority policy is used to limit the access authority of the accessed party, and the flow control The policy is used to limit the data flow when the visited party is accessed;

The target token is generated according to the access control authority policy and the flow control policy, wherein the type of the target token generated is determined according to the access control authority policy, and the number of target tokens generated is determined according to the access control authority policy. The flow control strategy is determined.

The token is usually generated by the accessed party. When the terminal system detects that the accessed party (such as an object service resource) is started, it can obtain the access control authority policy and flow control policy of the accessed party, where the access control authority The policy is used to limit the access authority of the accessed party, and the flow control policy is used to limit the data flow when the accessed party is accessed; then, the access control authority policy and the flow control policy are used to generate the The target token.

Further, after generating the target token, it may further include:

When it is detected that the accessed party is closed, the target token that has been generated in the token resource pool is deleted.

When it is detected that the accessed party is closed, it means that it no longer provides access services. At this time, each target token that has been generated in the token resource pool can be deleted to prevent each access party from continuing to apply for tokens to the accessed party. Invalid operation caused by access.

When it is detected that the accessing party is activated, the access control authority policy and the flow control policy of the accessed party are acquired. The access control authority policy is used to limit the accessing party's authority to access the accessed party. The flow control strategy is used to limit the data flow when the visited party is accessed;

Although the token is usually generated by the accessed party, some tokens are also restricted to the access party, and this part of the token can be generated by the access party. When the terminal system detects that an accessing party (such as an application) is started, it determines the accessees that it can access according to the accessing party's authority, and then can trigger each accessed party to generate corresponding tokens.

Further, after generating the target token, it may further include:

When it is detected that the access party is closed, the target token that has been generated in the token resource pool is deleted.

When it is detected that the access party is closed (stop running), delete each target token that has been generated in the token resource pool, so that the processing can avoid malicious access to a certain extent.

Specifically, the target token can be obtained from the token resource pool in the following manner:

Acquiring the unique identifier of the visiting party and the unique identifier of the visited party;

Search for a token whose token information includes the unique identifier of the accessing party and the unique identifier of the accessed party from the token resource pool as the target token.

Each visitor or visited party can have its own unique identification, such as ID, name, etc. When the token is generated, this part of the information can be included to establish the corresponding relationship between the token and the accessing party and the accessed party. Therefore, a token whose token information contains the unique identification of the accessing party and the unique identification of the accessed party can be searched from the token resource pool as the corresponding target token.

Acquiring pre-stored token index information, where the token index information records the accessing party information and the accessed party information corresponding to each token in the token resource pool;

According to the token index information, a token corresponding to the accessing party information of the accessing party and the accessed party information of the accessed party is searched from the token resource pool as the target token.

The token itself may not contain the corresponding accessor information and the accessed party information. In this case, the corresponding relationship between each token and the accessor and the accessed party can be recorded by constructing the token index information. Then, a token corresponding to the accessing party information of the accessing party and the accessed party information of the accessed party can be searched from the token resource pool as the corresponding target token. Specifically, a token resource library can be constructed to store the token index information, but it consumes a lot of system resources.

Specifically, the verification of the legality of the target token may include, but is not limited to:

Verify the integrity of the target token;

and / or

Acquiring the timestamp of the target token;

Verifying whether the target token is within the validity period according to the timestamp;

and / or

Verifying whether the access party information contained in the target token is consistent with the access party;

Verifying whether the accessed party information contained in the target token is consistent with the accessed party;

and / or

It is verified whether the access action corresponding to the target token is consistent with the access action corresponding to the request information.

In the second aspect, an embodiment of the present application provides an access control device, including:

The access request receiving module is used to determine whether the request information carries a target token when receiving the request information for accessing the visited party sent by the accessing party, and the target token is used to determine whether the accessing party has access When the authority of the accessed party is searched from a pre-built token resource pool and allocated to the access party;

A token verification module, configured to verify the validity of the target token if the request information carries a target token;

The access permission module is used to allow the visiting party to access the visited party after the legality verification is passed.

In the third aspect, an embodiment of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, Implement the access control method as proposed in the first aspect of the embodiments of the present application.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the implementation as proposed in the first aspect of the embodiments of the present application Access control method.

In a fifth aspect, the embodiments of the present application provide a computer program product, which when the computer program product runs on a terminal device, causes the terminal device to execute the access control method described in any one of the above-mentioned first aspects.

Compared with the prior art, the embodiments of the present application have the beneficial effects that the security of access control can be improved, and they have better practicability and ease of use.

Description of the drawings

FIG. 1 is a schematic diagram of the hardware structure of a mobile phone to which the access control method provided by an embodiment of the present application is applicable;

Figure 2 is a flowchart of an access control method provided by an embodiment of the present application;

Figure 3 is a flowchart of another access control method provided by an embodiment of the present application;

Figure 4 is a flowchart of another access control method provided by an embodiment of the present application;

FIG. 5 is a schematic diagram of an access control method provided by an embodiment of the present application in an actual application scenario;

FIG. 6 is a schematic diagram of a method of generating tokens in the token resource pool shown in FIG. 5;

FIG. 7 is a schematic diagram of verifying the legitimacy of the token in the process of the APP carrying the token to access the service/resource as shown in FIG. 5;

FIG. 8 is a schematic diagram of access control for the APP shown in FIG. 5 to access services/resources for the first time;

FIG. 9 is a schematic diagram of access control for the APP shown in FIG. 5 to access services/resources again;

FIG. 10 is a structural diagram of an access control device provided by an embodiment of the present application;

FIG. 11 is a schematic diagram of a terminal device provided by an embodiment of the present application.

Detailed ways

In the following description, for the purpose of illustration rather than limitation, specific details such as a specific device structure and technology are proposed for a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known devices, devices, circuits, and methods are omitted to avoid unnecessary details from obstructing the description of this application.

The terms used in the following embodiments are only for the purpose of describing specific embodiments, and are not intended to limit the application. As used in the specification and appended claims of this application, the singular expressions "a", "an", "said", "above", "the" and "this" are intended to also This includes expressions such as "one or more" unless the context clearly indicates to the contrary. It should also be understood that in the embodiments of the present application, "one or more" refers to one, two, or more than two; "and/or" describes the association relationship of associated objects, indicating that three relationships may exist; for example, A and/or B can mean the situation where A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character "/" generally indicates that the associated objects are in an "or" relationship.

The access control method provided by the embodiments of this application can be applied to mobile phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR)/virtual reality (VR) devices, notebook computers, and super mobile personal computers On terminal devices or servers such as (ultra-mobile personal computer, UMPC), netbooks, and personal digital assistants (personal digital assistant, PDA), the embodiments of this application do not impose any restrictions on the specific types of terminal devices and servers.

For example, the terminal device may be a station (STAION, ST) in a WLAN, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a wireless local loop (Wireless Local Loop, WLL) station, Personal Digital Assistant (PDA) devices, handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, in-vehicle devices, car networking terminals, computers, laptop computers, handheld communication devices , Handheld computing equipment, satellite wireless equipment, wireless modem cards, TV set top boxes (STB), customer premise equipment (customer premise equipment, CPE), and/or other equipment used to communicate on wireless devices, and download A first-generation communication device, for example, a mobile terminal in a 5G network or a mobile terminal in a public land mobile network (PLMN) network that will evolve in the future.

As an example and not a limitation, when the terminal device is a wearable device, the wearable device can also be a general term for applying wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, Watches, clothing and shoes, etc. A wearable device is a portable device that is directly worn on the body or integrated into the user's clothes or accessories. Wearable devices are not only a kind of hardware device, but also realize powerful functions through software support, data interaction, and cloud interaction. In a broad sense, wearable smart devices include full-featured, large-sized, complete or partial functions that can be implemented without relying on smart phones, such as smart watches or smart glasses, and only focus on a certain type of application function, and need to be used in conjunction with other devices such as smart phones. , Such as all kinds of smart bracelets and smart jewelry for physical sign monitoring.

Take the terminal device as a mobile phone as an example. Fig. 1 shows a block diagram of a part of the structure of a mobile phone provided in an embodiment of the present application. 1, the mobile phone includes: a radio frequency (RF) circuit 110, a memory 120, an input unit 130, a display unit 140, a sensor 150, an audio circuit 160, a wireless fidelity (WiFi) module 170, and a processor 180 , And power supply 190 and other components. Those skilled in the art can understand that the structure of the mobile phone shown in FIG. 1 does not constitute a limitation on the mobile phone, and may include more or fewer components than those shown in the figure, or a combination of some components, or different component arrangements.

The following describes the components of the mobile phone in detail with reference to Figure 1:

The RF circuit 110 can be used for receiving and sending signals during the process of sending and receiving information or talking. In particular, after receiving the downlink information of the base station, it is processed by the processor 180; in addition, the designed uplink data is sent to the base station. Generally, the RF circuit includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, and the like. In addition, the RF circuit 110 can also communicate with the network and other devices through wireless communication. The above-mentioned wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile Communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (Code Division) Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE)), Email, Short Messaging Service (SMS), etc.

The memory 120 may be used to store software programs and modules. The processor 180 executes various functional applications and data processing of the mobile phone by running the software programs and modules stored in the memory 120. The memory 120 may mainly include a storage program area and a storage data area. The storage program area may store an operating device, an application program required by at least one function (such as a sound playback function, an image playback function, etc.), etc.; Data created by the use of mobile phones (such as audio data, phone book, etc.), etc. In addition, the memory 120 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage devices.

The input unit 130 may be used to receive inputted numeric or character information, and generate key signal input related to user settings and function control of the mobile phone 100. Specifically, the input unit 130 may include a touch panel 131 and other input devices 132. The touch panel 131, also known as a touch screen, can collect user touch operations on or near it (for example, the user uses any suitable objects or accessories such as fingers, stylus, etc.) on the touch panel 131 or near the touch panel 131. Operation), and drive the corresponding connection device according to the preset program. Optionally, the touch panel 131 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch position, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it To the processor 180, and can receive and execute the commands sent by the processor 180. In addition, the touch panel 131 can be implemented in multiple types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 131, the input unit 130 may also include other input devices 132. Specifically, the other input device 132 may include, but is not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackball, mouse, and joystick.

The display unit 140 may be used to display information input by the user or information provided to the user and various menus of the mobile phone. The display unit 140 may include a display panel 141. Optionally, the display panel 141 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. Further, the touch panel 131 can cover the display panel 141. When the touch panel 131 detects a touch operation on or near it, it transmits it to the processor 180 to determine the type of the touch event, and then the processor 180 responds to the touch event. The type provides corresponding visual output on the display panel 141. Although in FIG. 1, the touch panel 131 and the display panel 141 are used as two independent components to implement the input and input functions of the mobile phone, but in some embodiments, the touch panel 131 and the display panel 141 can be integrated Realize the input and output functions of mobile phones.

The mobile phone 100 may also include at least one sensor 150, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 141 according to the brightness of the ambient light. The proximity sensor can close the display panel 141 and/or when the mobile phone is moved to the ear. Or backlight. As a kind of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in various directions (usually three-axis), and can detect the magnitude and direction of gravity when it is stationary. It can be used to identify mobile phone posture applications (such as horizontal and vertical screen switching, related Games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, percussion), etc.; as for other sensors such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., which can also be configured in mobile phones, I will not here Go into details.

The audio circuit 160, the speaker 161, and the microphone 162 can provide an audio interface between the user and the mobile phone. The audio circuit 160 can transmit the electrical signal converted from the received audio data to the speaker 161, which is converted into a sound signal for output by the speaker 161; on the other hand, the microphone 162 converts the collected sound signal into an electrical signal, which is then output by the audio circuit 160. After being received, it is converted into audio data, and then processed by the audio data output processor 180, and then sent to, for example, another mobile phone via the RF circuit 110, or the audio data is output to the memory 120 for further processing.

WiFi is a short-distance wireless transmission technology. The mobile phone can help users send and receive e-mails, browse web pages, and access streaming media through the WiFi module 170. It provides users with wireless broadband Internet access. Although FIG. 1 shows the WiFi module 170, it is understandable that it is not a necessary component of the mobile phone 100, and can be omitted as needed without changing the essence of the invention.

The processor 180 is the control center of the mobile phone. It uses various interfaces and lines to connect various parts of the entire mobile phone. It executes by running or executing software programs and/or modules stored in the memory 120 and calling data stored in the memory 120. Various functions and processing data of the mobile phone can be used to monitor the mobile phone as a whole. Optionally, the processor 180 may include one or more processing units; preferably, the processor 180 may integrate an application processor and a modem processor, where the application processor mainly processes operating devices, user interfaces, application programs, etc. , The modem processor mainly deals with wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 180.

The mobile phone 100 also includes a power source 190 (such as a battery) for supplying power to various components. Preferably, the power source may be logically connected to the processor 180 through a power management device, so that functions such as charging, discharging, and power consumption management can be managed by the power management device.

Although not shown, the mobile phone 100 may also include a camera. Optionally, the position of the camera on the mobile phone 100 may be front-mounted or rear-mounted, which is not limited in the embodiment of the present application.

Optionally, the mobile phone 100 may include a single camera, a dual camera, or a triple camera, etc., which is not limited in the embodiment of the present application.

For example, the mobile phone 100 may include three cameras, of which one is a main camera, one is a wide-angle camera, and one is a telephoto camera.

Optionally, when the mobile phone 100 includes multiple cameras, the multiple cameras may be all front-mounted, or all rear-mounted, or partly front-mounted and some rear-mounted, which is not limited in the embodiment of the present application.

In addition, although not shown, the mobile phone 100 may also include a Bluetooth module, etc., which will not be repeated here.

It should be pointed out that the various access control methods proposed in this application are not only suitable for terminal devices to access local resources, but also for terminal devices to access network resources. For scenarios where a terminal device accesses local resources, the execution subject of the access control method is the terminal device; for scenarios where a terminal device accesses network resources, the execution subject of the access control method is the server or terminal device where the network resource is located. At this time, the terminal device where the accessing party is located and the server (terminal device) where the accessed party is located should have the same token mechanism and authority management mechanism.

In addition, the various access control methods proposed in this application can also be used for access control of various systems such as centralized systems or distributed systems, networks, and WEB services.

Figure 2 shows a flow chart of an access control method provided by this application, including:

201. When receiving request information for accessing an visited party sent by an accessing party, determine whether the request information carries a target token;

When receiving the request information sent by the accessing party to access the accessed party, it will detect whether the request information carries the target token. The visitor here is the subject of the access operation, which can be an application, a process, or a service, etc.; the visited party is the object of the access operation, which can be a software and hardware resource, a file, or a service Wait. When the accessing party performs an access operation to the accessed party, it will first send a request message, and after obtaining the request information, the terminal system will detect whether the request message carries the target token. The target token may be a token specifically applicable to the accessing party's access to the accessed party, that is, different accessing parties access the same accessed party, the same accessing party accesses different accessed parties, and different accesses When the party visits different visited parties, the tokens carried by each visitor can be different in these cases.

In addition, the target token is searched from a pre-built token resource pool and allocated to the accessing party when it is determined that the accessing party has the authority to access the accessed party. The terminal system presets an access control authority policy, that is, limits which subjects are allowed to perform what operations on which objects. Before the accessing party accesses the accessed party, if the access control authority policy determines that the accessing party has the corresponding access authority, you can The target token is found from the token resource pool and assigned to the access party. If it is determined according to the access control authority policy that the accessor does not have the corresponding access rights, the corresponding target token will not be found from the token resource pool, that is, the accessor cannot be allocated a token at this time, and there is no token. Then the visited party cannot be accessed. The token resource pool can be shared by the entire access control system, that is, different tokens used by different access parties to access different accessed parties can be generated and added to the token resource pool for preparation. Assigned to different access parties.

If the request information carries the target token, steps 202-203 are executed; if the request information does not carry the target token, then step 205 is directly executed.

(1) When it is detected that the accessed party is activated, the access control authority policy and the flow control policy of the accessed party are obtained. The access control authority policy is used to limit the access authority of the accessed party. The flow control policy is used to limit the data flow when the visited party is accessed;

(2) Generate the target token according to the access control authority policy and the flow control policy, wherein the type of the target token generated is determined according to the access control authority policy, and the target token is generated The number is determined according to the flow control strategy.

In general, tokens must limit the object (tokens that do not limit the object are valid tokens based on the entire system and have no meaning for actual control authority), and can limit specific functional features, APIs, or specific operations. The token can only limit the object, or it can limit both the subject and the object, where the subject refers to the visiting party, and the object refers to the visited party. For example, a public service provides service availability status query. All applications have this permission. In this case, there is no need to limit the subject and the number of accesses. This is a practical application scenario where the token only limits the object. If it is a service for querying the wallet balance, it is necessary to limit which applications can be accessed, and even for security, a new token is required to complete an interaction to avoid the abuse of the token. This is the token that limits both the subject and the object. A practical application scenario.

The token is usually generated by the accessed party. When the terminal system detects that the accessed party (such as an object service resource) is started, it can obtain the access control authority policy and flow control policy of the accessed party, where the access control authority The policy is used to limit the access authority of the accessed party, and the flow control policy is used to limit the data flow when the accessed party is accessed; then, according to the access control authority policy and the traffic control policy, all data flows are generated. The target token, wherein the type of generated target token is determined according to the access control authority policy, and the number of generated target tokens is determined according to the flow control policy. There can be many types of tokens. According to the access control authority policy, combined with the security level requirements of the service provided by the accessed party, one-time tokens with limited objects, multiple tokens with limited objects, and limited objects can be generated. There are different types of tokens such as one-time tokens of the subject, multiple tokens that limit the object and subject, and time-sensitive tokens. On the other hand, the corresponding flow control strategy can be set according to the service capability of the accessed party and the network condition to determine the number of tokens generated. For example, if the visited party is a blockchain service, its performance is poor, and traffic can be restricted when the service is provided, such as 10 visits per second, and only 5 applications can be accessed. If 3 applications are currently running, 10 tokens for each application can be generated, a total of 30 tokens, when the application applies for tokens, only up to 10 orders per second will be issued according to the flow control policy Card.

Further, after generating the target token, it may further include:

(1) When it is detected that the accessing party is activated, the access control authority policy and the flow control policy of the accessed party are obtained, and the access control authority policy is used to limit the accessing authority of the accessing party to the accessed party , The flow control policy is used to limit the data flow when the visited party is accessed;

Although the token is usually generated by the accessed party, some tokens are also restricted to the access party, and this part of the token can be generated by the access party. When the terminal system detects that an accessing party (such as an application) is started, it determines each accessed party that it can access according to the accessing party's authority, and then can trigger each accessed party to generate a corresponding token. For any visited party that the visitor can access, the method of generating tokens can be the same as the method of generating tokens led by the visited party as described above, that is, obtaining their respective access control authority policies and Flow control strategy, and then determine the type and quantity of generated tokens, and finally each token generated can be added to the token resource pool.

Further, after generating the target token, it may further include:

When it is detected that the access party is closed (stop running), each target token that has been generated in the token resource pool is deleted, so that the processing can avoid malicious access to a certain extent.

The above two token generation methods are to trigger the generation of tokens when the visited party is detected and when the visitor is detected. In some cases, it can also be used in advance when the visitor has not started or the visited party has not started. Generate a certain number of tokens as a performance optimization plan.

202. Perform legality verification on the target token;

The visitor carries the target token, and at this time, the legality of the target token is further verified. Specifically, the integrity of the target token itself can be verified, and it can be verified whether the target token is a valid token generated and allocated to the accessed party in the token resource pool.

203. Judge whether the legality verification is passed;

If the legality verification of the target token is passed, step 204 is executed, otherwise, step 205 is executed.

204. Allow the visiting party to access the visited party;

The validity verification of the target token carried by the accessing party indicates that the accessing party has the proper authority to access the accessed party. At this time, the accessing party is allowed to access the accessed party.

205. Reject the visiting party from accessing the visited party.

The accessing party does not carry the target token, or the validity verification of the target token carried by the accessing party fails, both of which indicate that the accessing party may be accessing illegally, so the accessing party is denied access to the accessed party access.

Figure 3 shows a flow chart of another access control method provided by this application, including:

301. When receiving request information for accessing an visited party sent by an accessing party, determine whether the request information carries a target token;

The target token is searched from a pre-built token resource pool and allocated to the accessing party when it is determined that the accessing party has the authority to access the accessed party; if the request information carries For the target token, perform steps 302-303; if the request information does not carry the target token, perform step 306 directly.

302. Perform legality verification on the target token.

303. Judge whether the legality verification is passed;

If the legality verification is passed, step 304 is executed, otherwise, step 305 is executed.

304. Allow the visiting party to access the visited party;

Steps 301-304 are the same as steps 201-204. For details, please refer to the relevant descriptions of steps 201-204.

305. Reject the visiting party from accessing the visited party;

The validity verification of the target token carried by the accessing party fails, indicating that the accessing party may be accessing illegally, so the accessing party is denied access to the accessed party.

306. Find the target token from the token resource pool, and allocate the found target token to the access party.

The request information does not carry the target token, which may be because the visitor has accessed the visited party for the first time and has not applied for the target token. At this time, the target token can be searched from the token resource pool, and the searched target token can be allocated to the access party. According to the set access control authority policy, if the access party has access authority, the corresponding target token can be found from the token resource pool; if the access party does not have access authority, the token resource cannot be retrieved The corresponding target token is found in the pool. In addition, after allocating the found target token to the access party, return to step 302 to continue the legality verification of the target token. If the target token cannot be found in the token resource pool, step 305 can be directly executed, that is, access is denied.

Optionally, the target token can be obtained from the token resource pool in the following manner:

(1) Obtain the unique identifier of the visiting party and the unique identifier of the visited party;

(2) Search for a token whose token information includes the unique identifier of the accessing party and the unique identifier of the accessed party from the token resource pool, as the target token.

(1) Obtain pre-stored token index information, where the token index information records the accessing party information and the accessed party information corresponding to each token in the token resource pool;

(2) According to the token index information, the token corresponding to the accessing party information of the accessing party and the accessed party information of the accessed party is searched from the token resource pool as the target command Card.

In another way, the token itself may not contain the corresponding accessing party information and the accessed party information. In this case, the corresponding relationship between each token and the accessing party and the accessed party can be recorded by constructing the token index information. Then, a token corresponding to the accessing party information of the accessing party and the accessed party information of the accessed party can be searched from the token resource pool as the corresponding target token. Specifically, a token resource library can be constructed to store the token index information, but it consumes a lot of system resources, so relatively speaking, it is better to adopt a method in which the token contains the information of the corresponding visitor and the visited party.

In the embodiment of this application, if the accessing party does not carry the target token, the target token will be searched from the token resource pool, and the found target token will be allocated to the accessing party, and then the target token will continue to be executed. The steps of token legality verification. Through this setting, the access control method can be applied to the scenario where the visitor visits the visited party for the first time, which further improves the practicability.

Figure 4 shows a flowchart of another access control method provided by the present application, including:

401. When receiving request information for accessing the visited party sent by the visiting party, determine whether the request information carries a target token;

The target token is searched from a pre-built token resource pool and allocated to the accessing party when it is determined that the accessing party has the authority to access the accessed party; if the request information carries For the target token, steps 402-403 are executed; if the request information does not carry the target token, step 407 is executed directly.

402. Check whether the target token is invalid.

If the request information carries a target token, first check whether the target token is invalid. Many tokens are time-sensitive, so before verifying the validity of the token, it is possible to check whether the target token carried by the accessing party has expired, so as to determine whether a new target token needs to be obtained. If the target token has expired, steps 403-404 are executed; if the target token has not expired, step 404 is executed directly.

403. Search for a new target token from the token resource pool to replace the invalid target token.

If the target token currently carried by the visitor is invalid, a new target token can be found from the token resource pool to replace the invalid target token. This process usually corresponds to the visitor's access to the visited party again condition.

404. Perform legality verification on the target token.

Generally speaking, the token can contain but not limited to the following information: unique identification of the accessing party, unique identification of the accessed party (supporting extensions, such as multiple API interfaces of the object to distinguish), access actions (such as CRUD, that is, creating, Read, modify, delete, etc.), time stamp and valid window, key-based signature.

Specifically, the verification of the validity of the target token may include, but is not limited to, the following verifications:

(1) Verify the integrity of the target token;

For example, the public key is used to verify (encrypt, decrypt or sign) the integrity of the target token. If the target token is complete, this part of the verification is passed.

(2) Obtain the timestamp of the target token; verify whether the target token is within the validity period according to the timestamp;

When the token is generated, it can include the timestamp of the generated token, and limit the validity time of the token, such as valid within 1 minute, and then verify whether the target token is currently in the validity period according to the timestamp and the validity time Within the validity period, this part of the verification is passed.

(3) Verify whether the access party information contained in the target token is consistent with the access party; verify whether the accessed party information contained in the target token is consistent with the accessed party;

For example, it can be verified whether the unique identification of the accessing party contained in the target token is consistent with the unique identification of the accessing party, and whether the unique identification of the accessed party contained in the target token is consistent with the unique identification of the accessed party, etc., that is, Verify whether the subject and object declared by the token are consistent with the current situation. If they are consistent, it means that this part of the verification is passed.

(4) Verify whether the access action corresponding to the target token is consistent with the access action corresponding to the request information.

Verify whether the access action declared by the target token is consistent with the access action requested by the current visitor. If they are consistent, this part of the verification is passed. For example, if the visitor holds the token of the query operation and wants to perform the modification operation on the visited party, the verification will fail.

405. Judge whether the legality verification is passed;

If the legality verification is passed, step 406 is executed, otherwise, step 407 is executed.

406. Allow the visiting party to access the visited party.

407. Reject the visiting party from accessing the visited party.

Steps 405-407 are the same as steps 203-205. For details, please refer to the relevant descriptions of steps 203-205.

In the embodiment of this application, if the target token carried by the accessing party has expired, a new target token will be searched from the token resource pool to replace the invalid target token, and then continue to execute the target token Steps for legality verification. Through this setting, the access control method can be applied to the scenario where the visitor visits the visited party again, and the practicability is further improved.

It should be understood that the size of the sequence number of each step in the foregoing embodiment does not mean the order of execution. The execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

For ease of understanding, the following uses several practical application scenarios to illustrate the access control method proposed in this application.

As shown in Figure 5, a schematic diagram of the access control method proposed in this application in an actual application scenario.

In Figure 5, the accessing party is an APP, the access control authority of the APP has been pre-set during the installation process, and the accessed party is a service/resource. Before the APP accesses the service/resource, the APP can apply for a token. If the APP has the authority to access the service/resource, the corresponding token can be found from the token resource pool and allocated to the APP. In the process that the APP carries the token to access the service/resource, the legitimacy of the token is verified. If the verification is passed, the APP is allowed to access the service/resource; otherwise, the APP is denied access to the service/resource.

FIG. 6 is a schematic diagram of a method of generating tokens in the token resource pool shown in FIG. 5.

In FIG. 6, the access control module is a functional module used to implement the access control mechanism in the terminal system. When the accessor or the accessed party is detected to be started, the token generation process is triggered. First, the access control module obtains a preset permission policy for the visitor to access the visited party from the permission policy library, and obtains the current flow control policy of the visited party from the flow control policy library. Then, according to the obtained access control authority policy and flow control policy, a corresponding number and type of tokens are generated. Among them, the type of token generated is mainly determined according to the acquired access control authority policy. Figure 6 shows four different types of tokens (one-time tokens that only limit objects, and multiple-time tokens that only limit objects). , A one-time token that limits the subject and object, and a multiple-time token that limits the subject and object); the number of generated tokens is mainly determined according to the acquired flow control strategy. Obviously, you can modify the access control authority policy or modify the flow control policy to change the token generation policy. The generated token may contain the unique identification of the accessing party and the unique identification of the accessed party, as well as other related information. Finally, the generated token is added to the token resource pool for the accessing party to use when accessing the accessed party.

In addition, the access control module can also manage the life cycle of the token. For example, when it is detected that a certain accessing party has been closed, the token resource can be found through the unique identification of the accessing party or the unique identification of the related accessed party. The corresponding token in the pool, delete this part of the generated token.

Fig. 7 is a schematic diagram of verifying the legitimacy of the token during the process in which the APP shown in Fig. 5 carries the token to access the service/resource. In Figure 7, the access control module is a functional module used to implement the access control mechanism in the terminal system. In the process of the APP carrying a token to access services/resources, the access control module will verify the legitimacy of the token. Specific verification methods may include: verifying the integrity of the token, verifying the valid window of the timestamp, verifying the unique identification of the object, verifying the unique identification of the subject, and verifying the access action. If the validity of the token is verified, the APP is allowed to access the service/resource; otherwise, the APP is denied access to the service/resource.

Fig. 8 is a schematic diagram of access control for the APP shown in Fig. 5 to access the service/resource for the first time, and Fig. 9 is a schematic diagram of access control for the APP shown in Fig. 5 to access the service/resource again.

In Figure 8, the APP is accessing the service/resource for the first time, so the APP does not carry a token. At this time, it needs to pass through the access control module, according to the unique identifier of the APP and the unique identifier of the service/resource from the token. Find the corresponding token in the resource pool. Then, the access control module allocates the found token to the APP, and the APP carries the token to access the service/resource, and then executes the token verification process shown in FIG. 7.

In Figure 9, the APP is to access the service/resource again, so the APP already carries a token. At this time, first check whether the token has expired. If it has not expired, you can directly perform the token verification shown in Figure 7 Process; if the token has expired, you also need to use the access control module to find a new token from the token resource pool according to the unique identifier of the APP and the unique identifier of the service/resource to perform the invalidation of the token Replace, and then perform the token verification process shown in Figure 7.

FIG. 10 shows a structural block diagram of an access control device provided by an embodiment of the present application. For ease of description, only the parts related to the embodiment of the present application are shown.

Referring to Figure 10, the device includes:

The access request receiving module 501 is configured to determine whether the request information carries a target token when receiving the request information for accessing the visited party sent by the accessing party, and the target token is used to determine whether the accessing party has When accessing the authority of the accessed party, search for and allocate to the accessing party from the pre-built token resource pool;

The token verification module 502 is configured to verify the validity of the target token if the request information carries a target token;

The access permission module 503 is configured to allow the visiting party to access the visited party after the legality verification is passed.

Further, the access control device may further include:

The token search module is configured to search for the target token from the token resource pool if the request information does not carry the target token, and allocate the found target token to the access party.

Further, the access control device may further include:

The token validity check module is used to check whether the target token is invalid;

The token replacement module is configured to, if the target token is invalid, search for a new target token from the token resource pool to replace the invalid target token.

Further, the access control device may further include:

The first policy obtaining module is configured to obtain the access control authority policy and the flow control policy of the accessed party when it is detected that the accessed party is activated, and the access control authority policy is used to limit the access control authority policy of the accessed party. Access authority, the flow control policy is used to limit the data flow when the accessed party is accessed;

The first token generation module is configured to generate the target token according to the access control authority policy and the flow control policy, wherein the type of the target token generated is determined according to the access control authority policy, and generates The number of the target tokens is determined according to the flow control strategy.

Further, the access control device may further include:

The second policy acquisition module is configured to acquire the access control authority policy and the flow control policy of the accessed party when the accessing party is detected to be activated, and the access control authority policy is used to restrict the accessing party's access to the The authority of the visited party, the flow control policy is used to limit the data flow when the visited party is accessed;

The second token generation module is configured to generate the target token according to the access control authority policy and the flow control policy, wherein the type of the generated target token is determined according to the access control authority policy, and generates The number of the target tokens is determined according to the flow control strategy.

Furthermore, the access control device may further include:

The token deletion module is used to delete the generated target token in the token resource pool when it is detected that the access party is closed.

Further, the access control device may further include:

An identification acquiring module, which is used to acquire the unique identification of the visiting party and the unique identification of the visited party;

The first token search module is configured to search for a token whose token information includes the unique identifier of the accessing party and the unique identifier of the accessed party from the token resource pool, as the target token.

Further, the access control device may further include:

A token index obtaining module, configured to obtain pre-stored token index information, where the token index information records the accessing party information and the accessed party information corresponding to each token in the token resource pool;

The second token search module is used to search the token resource pool corresponding to the accessor information of the accessing party and the accessed party information of the accessed party according to the token index information , As the target token.

Further, the token verification module may include:

An integrity verification unit for verifying the integrity of the target token;

A timestamp acquiring unit for acquiring the timestamp of the target token;

The validity period verification unit is configured to verify whether the target token is within the validity period according to the timestamp;

The visitor information verification unit is used to verify whether the visitor information contained in the target token is consistent with the visitor;

The accessed party information verification unit is used to verify whether the accessed party information contained in the target token is consistent with the accessed party;

The action verification unit is used to verify whether the access action corresponding to the target token is consistent with the access action corresponding to the request information.

The embodiments of the present application also provide a computer-readable storage medium that stores a computer program that, when executed by a processor, implements the steps of each access control method as proposed in the present application.

The embodiments of the present application also provide a computer program product, which when the computer program product runs on a terminal device, causes the terminal device to execute the steps of each access control method proposed in this application.

FIG. 11 is a schematic structural diagram of a terminal device provided by an embodiment of this application. As shown in FIG. 11, the terminal device 6 of this embodiment includes: at least one processor 60 (only one is shown in FIG. 11), a processor, a memory 61, and a processor that is stored in the memory 61 and can be processed in the at least one processor. A computer program 62 running on the processor 60, when the processor 60 executes the computer program 62, the steps in any of the foregoing access control method embodiments are implemented.

The terminal device 6 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The terminal device may include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art can understand that FIG. 11 is only an example of the terminal device 6 and does not constitute a limitation on the terminal device 6. It may include more or less components than shown in the figure, or a combination of certain components, or different components. , For example, can also include input and output devices, network access devices, and so on.

The so-called processor 60 may be a central processing unit (Central Processing Unit, CPU), and the processor 60 may also be other general-purpose processors, digital signal processors (Digital Signal Processors, DSPs), and application specific integrated circuits (Application Specific Integrated Circuits). , ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.

The memory 61 may be an internal storage unit of the terminal device 6 in some embodiments, such as a hard disk or a memory of the terminal device 6. In other embodiments, the memory 61 may also be an external storage device of the terminal device 6, such as a plug-in hard disk equipped on the terminal device 6, a smart media card (SMC), a secure digital (Secure Digital, SD) card, Flash Card, etc. Further, the memory 61 may also include both an internal storage unit of the terminal device 6 and an external storage device. The memory 61 is used to store an operating device, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program. The memory 61 can also be used to temporarily store data that has been output or will be output.

Those skilled in the art can clearly understand that, for the convenience and conciseness of description, only the division of the above functional units and modules is used as an example. In practical applications, the above functions can be allocated to different functional units and modules as needed. Module completion, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist alone physically, or two or more units can be integrated into one unit. The above-mentioned integrated units can be hardware-based Formal realization can also be realized in the form of a software functional unit. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the protection scope of the present application. For the specific working process of the units and modules in the above-mentioned device, reference may be made to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the above-mentioned embodiments, the description of each embodiment has its own focus. For parts that are not described in detail or recorded in an embodiment, reference may be made to related descriptions of other embodiments.

A person of ordinary skill in the art may realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

In the embodiments provided in this application, it should be understood that the disclosed device and method may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods, for example, multiple units or components may be divided. It can be combined or integrated into another device, or some features can be omitted or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the implementation of all or part of the processes in the above-mentioned embodiment methods in the present application can be accomplished by instructing relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. The computer program can be stored in a computer-readable storage medium. When executed by the processor, the steps of the foregoing method embodiments can be implemented. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file, or some intermediate forms. The computer-readable medium may at least include: any entity or device capable of carrying computer program code to a terminal device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), and a random access memory (RAM, Random Access Memory), electric carrier signal, telecommunications signal and software distribution medium. For example, U disk, mobile hard disk, floppy disk or CD-ROM, etc. In some jurisdictions, according to legislation and patent practices, computer-readable media cannot be electrical carrier signals and telecommunication signals.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present application, not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, a person of ordinary skill in the art should understand that it can still implement the foregoing The technical solutions recorded in the examples are modified, or some of the technical features are equivalently replaced; these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the application, and should be included in Within the scope of protection of this application.

Claims

An access control method, characterized in that it comprises:

When receiving the request information for accessing the accessed party sent by the accessing party, it is determined whether the request information carries a target token, and the target token is used to determine that the accessing party has the authority to access the accessed party. At the time, search from the pre-built token resource pool and assign it to the accessing party;

If the request information carries a target token, verify the validity of the target token;

After the legality verification is passed, the visiting party is allowed to access the visited party.
The access control method according to claim 1, wherein after determining whether the request information carries a target token, the method further comprises:

If the request information does not carry the target token, the target token is searched from the token resource pool, and the found target token is allocated to the access party.
5. The access control method according to claim 1, characterized in that, before the legality verification of the target token, the method further comprises:

Check whether the target token is invalid;

If the target token has expired, searching for a new target token from the token resource pool to replace the invalid target token.
The access control method according to claim 1, wherein the target token is generated in the following manner and added to the token resource pool:

When it is detected that the accessed party is activated, the access control authority policy and the flow control policy of the accessed party are obtained. The access control authority policy is used to limit the access authority of the accessed party, and the flow control The policy is used to limit the data flow when the visited party is accessed;

The target token is generated according to the access control authority policy and the flow control policy, wherein the type of the target token generated is determined according to the access control authority policy, and the number of target tokens generated is determined according to the access control authority policy. The flow control strategy is determined.
The access control method according to claim 1, wherein the target token is generated in the following manner and added to the token resource pool:

When it is detected that the accessing party is activated, the access control authority policy and the flow control policy of the accessed party are acquired. The access control authority policy is used to limit the accessing party's authority to access the accessed party. The flow control strategy is used to limit the data flow when the visited party is accessed;

The target token is generated according to the access control authority policy and the flow control policy, wherein the type of the target token generated is determined according to the access control authority policy, and the number of target tokens generated is determined according to the access control authority policy. The flow control strategy is determined.
The access control method according to claim 5, wherein after generating the target token, the method further comprises:

When it is detected that the access party is closed, the target token that has been generated in the token resource pool is deleted.
The access control method according to claim 1, wherein the target token is obtained from the token resource pool in the following manner:

Acquiring the unique identifier of the visiting party and the unique identifier of the visited party;

Search for a token whose token information includes the unique identifier of the accessing party and the unique identifier of the accessed party from the token resource pool as the target token.
The access control method according to claim 1, wherein the target token is obtained from the token resource pool in the following manner:

Acquiring pre-stored token index information, where the token index information records the accessing party information and the accessed party information corresponding to each token in the token resource pool;

According to the token index information, a token corresponding to the accessing party information of the accessing party and the accessed party information of the accessed party is searched from the token resource pool as the target token.
8. The access control method according to any one of claims 1 to 8, wherein said performing legality verification on said target token comprises:

Verify the integrity of the target token;

and / or

Acquiring the timestamp of the target token;

Verifying whether the target token is within the validity period according to the timestamp;

and / or

Verifying whether the access party information contained in the target token is consistent with the access party;

Verifying whether the accessed party information contained in the target token is consistent with the accessed party;

and / or

It is verified whether the access action corresponding to the target token is consistent with the access action corresponding to the request information.
An access control device is characterized in that it comprises:

The access request receiving module is used to determine whether the request information carries a target token when receiving the request information for accessing the visited party sent by the accessing party, and the target token is used to determine whether the accessing party has access When the authority of the accessed party is searched from a pre-built token resource pool and allocated to the access party;

A token verification module, configured to verify the validity of the target token if the request information carries a target token;

The access permission module is used to allow the visiting party to access the visited party after the legality verification is passed.
A terminal device, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the computer program as claimed in claims 1 to 9. Any of the access control methods.
A computer-readable storage medium storing a computer program, wherein the computer program implements the access control method according to any one of claims 1 to 9 when the computer program is executed by a processor.