CN115603962A - Data resource access method, gateway and storage medium - Google Patents

Abstract

The embodiment of the invention provides a data resource access method, a gateway and a storage medium, and relates to the field of communication. The data resource access method is applied to a gateway and comprises the following steps: receiving an access request sent by a user side, and extracting request user information and access target resources from the access request; redirecting the access request to a background server of the user side; receiving a target user list returned by the background server, wherein the target user list comprises target user information allowing access to the target resource; and if the request user information is the same as any one of the target user information in the target user list, sending the access target resource to the user side. Compared with the prior art, the data resource access method, the background server, the gateway and the storage medium provided by the embodiment of the invention have the advantage of improving the data security in the data resource access process.

Description

Data resource access method, gateway and storage medium

technical field

The present invention relates to the communication field, in particular, to a method for accessing data resources, a gateway and a storage medium.

Background technique

In the prior art, SSL offloading is realized by transferring the SSL (Secure Sockets Layer protocol) encryption and decryption links in the application access process to corresponding devices that provide encryption and decryption capabilities. While meeting the high concurrent access requirements, this method can reduce the performance pressure of the background server and increase the website access speed. Under certain circumstances, it can reduce the requirements for the hardware resources of the background server and save operating costs. The gateway equipped with the SSL offloading function can act as an SSL proxy background server, establish an SSL connection with the client, communicate with the client in encrypted form, and communicate with the background server in plain text, completely offloading the load of SSL data processing without occupying the background server. hardware resources.

At present, in order to quickly realize the needs of enterprises to connect internally, connect with ecological partners, connect with consumers, professional collaboration, security management, and people-as-a-service, all enterprises will use mobile office services such as enterprise WeChat, government affairs WeChat, and DingTalk. Users are using During the working process of these APPs, it is necessary to frequently visit other data resource pages. Although the existing data resource access methods improve the data security performance in the process of data resource access to a certain extent through gateways that support SSL offloading, there is still room for improvement in the data security in the process of data resource access.

Contents of the invention

The purpose of the present invention includes, for example, providing a data resource access method, a gateway, and a storage medium, which can improve data security during data resource access.

Embodiments of the present invention can be implemented as follows: First, the present invention provides a method for accessing data resources, which is applied to a gateway, including: receiving an access request sent by a client, and extracting requesting user information and access target from the access request resources; redirect the access request to the background server of the client; receive the target user list returned by the background server, the target user list includes target user information that is allowed to access the access target resource; if the If the requesting user information is the same as any of the target user information in the target user list, the access target resource is sent to the client.

In a second aspect, the present invention provides a background server, including: receiving an access request sent by a client, extracting an access target resource from the access request; returning a target user list according to the access target resource, and the target user list Contains target user information that is allowed to access the access target resource.

In the third aspect, the present invention provides a gateway, including: a communication module, the communication module is used to receive the access request sent by the client, and receive the target user list returned by the background server, and the target user list includes the list of users allowed to access The target user information of the access target resource; the redirection module, the redirection module is used to redirect the access request to the backend server of the client; the data processing module, the data processing module is used for accessing the Extracting the requesting user information and the access target resource from the request, and sending the access target resource to the client when the requesting user information is the same as any target user information in the target user list.

In a fourth aspect, the present invention provides a gateway, including: at least one processor; and a memory connected in communication with the at least one processor; wherein, the memory stores instructions executable by the at least one processor , the instructions are executed by the at least one processor, so that the at least one processor can execute the data resource access method described in any one of the foregoing implementation manners.

In a fifth aspect, the present invention provides a storage medium storing a computer program, and the computer program is executed by a processor to implement the data resource access method described in any one of the foregoing implementation manners.

Compared with the prior art, in the data resource access method, background server, gateway, and storage medium provided by the embodiments of the present invention, by redirecting the access request to the background server of the client, the background server stores a large number of client The data that can be accessed and the target users who are allowed to access these data. After the background server receives the redirected access request, it can obtain the target resource target that is allowed to access according to the access target resource that the client wants to access extracted from the access request. user list, and feed back the target user information of the target user list and the target user in the target user list to the gateway. After receiving the target user list returned by the background server, the gateway can extract the requested user information from the access request with the Compare the target user information of the target user in the target user list. If the requesting user information is the same as any target user information in the target user list, it means that the requesting user who sent the current access request belongs to the user who is allowed to access the target resource. Connecting the client and accessing the target resource in real time can prevent the data from being accessed by users who are not allowed, thereby improving the data security in the process of data resource access.

In an optional implementation manner, before redirecting the access request to the background server of the client, the method further includes: judging whether the gateway saves the requested user information; if the gateway saves If there is the requesting user information, send the access target resource to the client; if the requesting user information is not saved in the gateway, redirect the access request to the background server of the client.

In an optional implementation manner, the extracting the requesting user information and the access target resource from the access request includes: extracting the user cookie of the client terminal and the access target resource from the access request.

In an optional implementation manner, after extracting the requesting user information and the access target resource from the access request, the method further includes: creating a user corresponding to the requesting user information one-to-one according to the requesting user information session, and set the user cookie corresponding to the user session.

In an optional implementation manner, the method further includes: creating a target session one-to-one corresponding to the target user information according to each target user information, and setting a target cookie one-to-one corresponding to each target session; If the user cookie is the same as any of the target cookies, it means that the requested user information is the same as any of the target user information in the target user list.

In an optional implementation manner, the receiving the target user list returned by the background server includes: receiving the interface call credential requirement returned by the background server according to the access target resource, and the interface call credential requirement includes returning the The interface calling credential required by the target user list; sending the interface calling credential to the background server according to the interface calling credential requirement; receiving the target user list returned by the background server.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention, and thus It should be regarded as a limitation on the scope, and those skilled in the art can also obtain other related drawings based on these drawings without creative work.

FIG. 1 is a schematic flowchart of a data resource access method provided by Embodiment 1 of the present invention;

FIG. 2 is a schematic flowchart of a data resource access method provided in Embodiment 2 of the present invention;

FIG. 3 is a schematic flowchart of a data resource access method provided in Embodiment 3 of the present invention;

FIG. 4 is a schematic flowchart of a data resource access method provided in Embodiment 4 of the present invention;

FIG. 5 is a schematic structural diagram of a gateway provided by Embodiment 5 of the present invention;

FIG. 6 is a schematic structural diagram of a gateway provided by Embodiment 6 of the present invention.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. The components of the embodiments of the invention generally described and illustrated in the figures herein may be arranged and designed in a variety of different configurations.

Accordingly, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

It should be noted that like numerals and letters denote similar items in the following figures, therefore, once an item is defined in one figure, it does not require further definition and explanation in subsequent figures.

In the description of the present invention, it should be noted that if the orientation or positional relationship indicated by the terms "upper", "lower", "inner" and "outer" appear, it is based on the orientation or positional relationship shown in the drawings, or It is the orientation or positional relationship that the invention product is usually placed in use, and it is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation , and therefore cannot be construed as a limitation of the present invention.

In addition, terms such as "first" and "second" are used only for distinguishing descriptions, and should not be understood as indicating or implying relative importance.

It should be noted that, in the case of no conflict, the features in the embodiments of the present invention may be combined with each other.

Embodiment 1 of the present invention provides a method for accessing data resources, which is applied to a gateway. The specific steps are shown in FIG. 1 , including the following steps.

Step S101: Receive the access request sent by the client, and extract the requesting user information and the access target resource from the access request.

Specifically, in this step, the client can be a client of various social, office, and entertainment applications. The client is the client in this step. After the user logs in, the user can initiate an access request to access the target resource through the user terminal. After receiving the user's click instruction on the access target resource, the user terminal constructs an access request based on the access target resource and user information, and then sends the access request to the gateway After the gateway receives the access request, it deconstructs and processes the data, and extracts the requested user information and access target resources from the access request according to the deconstruction and data processing results.

Specifically, in this embodiment, the requesting user information is stored in the user cookie of the client, and extracting the requesting user information from the access request is to extract the user cookie of the client from the access request. The so-called cookie is a data segment that identifies user information. During the data interaction process, the access request is stateless. That is to say, even if the client has connected to the gateway for the first time and logged in successfully, the gateway still cannot know which user the current request is for the second time. The emergence of cookies is to solve this problem. After the first login, the gateway returns some data identifying user information (ie cookies) to the client, and then the client saves it locally. When the client sends an access request again, It will automatically carry the stored cookie data in the access request and send it to the gateway, and the gateway can identify the current client through the user cookie data carried by the client.

Further, in this step, when the client sends an access request to the gateway for the first time, there is no user cookie in the access request, that is, the gateway fails to extract the user cookie from the access request, and at this time, the complete cookie can be directly extracted from the access request. The requested user information, and then create a user session corresponding to the requested user information according to the requested user information, and set the user cookie corresponding to the user session.

Step S102: Redirect the access request to the background server of the client.

Specifically, in this step, the access request is redirected to the background server of the client application program according to the access target resource extracted from the access request in step S101.

Step S103: Receive the target user list returned by the background server, the target user list includes target user information that is allowed to access the target resource.

Various resources that can be accessed by the client end are stored in the background server, and corresponding to each resource is stored a white list of users who are allowed to access each resource. For example, for resource A stored in the background server, the background server correspondingly stores user information of users A1 , A2 , A3 , A4 , A5 , A6 who are allowed to access resource A. After the background server receives the redirected access request, it obtains the access target resource included in the access request, determines the target user whitelist that allows access to the target resource according to the access target resource, and saves the target user's user information in the target user whitelist Integrate to form a target user list, and send the target user list to the gateway.

After the gateway receives the target user list sent by the background server, it can extract the target user information in the target user list.

Step S104: If the requested user information is the same as any target user information in the target user list, send the access target resource to the client.

Specifically, in this step, compare the requesting user information extracted from the access request in step S101 with the target user information received from the background server in step S103, if the requesting user information matches any target user in the target user list If the information is the same, it means that the requesting user who sends the access request is a user who is allowed to access the target resource, and at this time, send the access target resource to the client.

Specifically, in this step, after receiving the target user list, the gateway may create a session according to the target user information in the target user list, and set a target cookie corresponding to each target session one by one. Specifically, the target user information of each target user is used to create a target session corresponding to the target user one by one, and a target cookie is set for each target session. Then compare the target cookie with the user cookie extracted in step S101. Since the method of setting the cookie by the gateway remains unchanged, when the target cookie is the same as the user cookie, it means that the target user information corresponding to the target cookie corresponds to the requesting user corresponding to the user cookie The information is the same. Use the user cookie and the target cookie to compare. Since the data volume of the cookie is far less than the data volume of the user information, it can effectively improve the verification efficiency of the user terminal, and thus improve the access rate of data resources as a whole. It can be understood that the foregoing is only an illustration of a specific implementation example in this embodiment, and does not constitute a limitation. In other embodiments of the present invention, other methods may also be used, such as combining each target user information with Methods such as accessing user information for one-to-one comparison can be flexibly used according to actual needs.

Compared with the prior art, in the data resource access method provided by Embodiment 1 of the present invention, by redirecting the access request to the background server of the client, the background server stores a large amount of data that the client can access and the data that is allowed to access For the target users of these data, after the background server receives the redirected access request, it can obtain the list of target users who are allowed to access the target resource according to the access target resources that the client wants to access extracted from the access request, and store the list of target users and the target user information of the target user in the target user list are fed back to the gateway. After the gateway receives the target user list returned by the background server, it can combine the requested user information extracted from the access request with the target user information in the target user list. Compare the target user information, if the request user information is the same as any target user information in the target user list, it means that the requesting user who sent the current access request belongs to the user who is allowed to access the target resource. It can prevent data from being accessed by unauthorized users, thereby improving data security during data resource access.

Embodiment 2 of the present invention provides a method for accessing data resources, which is applied to a gateway. The specific steps are shown in FIG. 2 , including the following steps.

Step S201: Receive the access request sent by the client, and extract the requesting user information and the access target resource from the access request.

Step S202: Redirect the access request to the background server of the client.

It can be understood that steps S201 to S202 in this embodiment are substantially the same as steps S101 to S102 in Embodiment 1. For details, reference may be made to the specific descriptions of the foregoing embodiments, and details are not repeated here.

Step S203: receiving the interface invocation credential requirement returned by the background server according to the access target resource, the interface invocation credential requirement including the interface invocation credential for returning the target user list requirement.

According to the specific description in step S103 of Embodiment 1 of the present invention, it can be seen that various data resources and user whitelists that are allowed to access each resource are stored in the background server. The API call credentials required by the whitelist. After the background server receives the redirected access request, it obtains the access target resource contained in the access request, determines the white list of target users who are allowed to access the target resource according to the access target resource, and then obtains the white list of the calling target user according to the target user white list The required interface calling credentials, and the obtained interface calling credentials needs to be sent to the gateway.

Step S204: Send the interface invocation credentials to the background server according to the interface invocation credentials requirements.

After receiving the interface call credential requirement sent by the background server, the interface call credential is obtained according to the interface call credential requirement, and the obtained interface call credential is sent to the background server. It can be understood that in this step, the pre-stored interface call credentials in the gateway can be directly called and sent to the background server, and the interface call credentials requirements that do not exist in the gateway are sent to the client. After receiving the interface call credentials fed back by the client, it is forwarded to the background server.

Step S205: Receive the target user list returned by the background server, the target user list includes target user information that is allowed to access the target resource.

After receiving the interface call credentials sent by the gateway, the background server verifies the received interface call credentials, and compares the received interface call credentials with the interface call credentials obtained in step S203 to call the target user whitelist, If the two are the same, the interface call credentials sent by the gateway pass the verification, and the background server sends the target user list to the gateway; if the two are not the same, the interface call credentials sent by the gateway fail the verification, and the background server does not send the target user list to the gateway .

Step S206: If the requested user information is the same as any target user information in the target user list, send the access target resource to the client.

It can be understood that the step S206 in this embodiment is substantially the same as the step S106 in the first embodiment, for details, reference may be made to the specific description of the foregoing embodiments, and details are not repeated here.

Compared with the prior art, the data resource access method provided by the second embodiment of the present invention retains all the technical steps in the first embodiment, so it has the same technical effect as the first embodiment. In addition, in the second embodiment of the present invention, the interface call credential request sent by the background server is also received, and the corresponding interface call credential is sent to the background server according to the interface call credential requirement. Only after the background server passes the verification of the interface call credential can the background server return The list of target users, and then send access target resources to the client, and further verify the interface call credentials of the gateway can further improve the security performance of the data resource access method.

Embodiment 3 of the present invention provides a method for accessing data resources, which is applied to a gateway. The specific steps are shown in FIG. 3 , including the following steps.

Step S301: Receive the access request sent by the client, and extract the requesting user information and the access target resource from the access request.

Step S302: Determine whether the gateway saves the requesting user information, if yes, execute step S306, if not, execute step S303.

Specifically, in this step, after receiving the target user list returned by the background server, the gateway will store the target user information in the target user list. The access user has already accessed the access target resource through the gateway before, so step S306 can be directly executed to send the access target resource to the client. If the request user information has been stored in the gateway, it means that the access user who sent the access request has not previously The access target resource has been accessed through the gateway, therefore, step S303 is performed to redirect the access request to the background server of the client.

Step S303: Redirect the access request to the background server of the client.

Step S304: Receive the target user list returned by the background server, the target user list includes target user information that is allowed to access the target resource.

Step S305: If the requested user information is the same as any target user information in the target user list, execute step S306.

Step S306: Send the access target resource to the client.

It can be understood that steps S301, S303 to S306 in this embodiment are substantially the same as steps S101 to S104 in Embodiment 1, and for details, reference may be made to the specific descriptions of the foregoing embodiments, and details are not repeated here.

Compared with the prior art, the data resource access method provided by the third embodiment of the present invention retains all the technical steps in the first embodiment, so it has the same technical effect as the first embodiment. In addition, in the third embodiment of the present invention, when it is determined that the gateway has saved the requesting user information, the access target resource is directly sent to the user terminal, that is, the access user who sends the access request directly sends the request to the user if the access user has previously accessed the access target resource through the gateway. The terminal sends access to the target resource, avoiding repeated verification of the requesting user information, and improving the efficiency of data resource access.

Embodiment 4 of the present invention provides a method for accessing data resources, which is applied to a background server. The specific steps are shown in FIG. 4 , including the following steps.

Step S401: Receive the access request sent by the client, and extract the access target resource from the access request.

Specifically, in this step, the access request sent by the client is an access request redirected by the gateway in the foregoing embodiment, and the access request includes the requested user information and the access target resource of the client. In this embodiment, the background server directly extracts the access target resource from the received access request.

Step S402: Return a target user list according to the access target resource, and the target user list includes target user information that is allowed to access the target resource.

Various resources that can be accessed by the client end are stored in the background server, and corresponding to each resource is stored a white list of users who are allowed to access each resource. After extracting the access target resource contained in the access request, the target user whitelist that is allowed to access the target resource can be determined according to the access target resource, and the user information of the target user in the target user whitelist is integrated to form a target user list, and the target user The list is sent to the gateway.

Compared with the prior art, the data resource access method provided by Embodiment 4 of the present invention is a data resource access method executed on the background server side corresponding to the foregoing embodiments, so it has the same technical effect as the foregoing embodiments, and can be specifically Reference is made to the specific descriptions of the foregoing embodiments, and details are not repeated here.

Embodiment 5 of the present invention relates to a gateway. The specific structure is shown in FIG. 5 , including a communication module 501. The communication module 501 is used to receive the access request sent by the client and the target user list returned by the background server. In the target user list Contains target user information that is allowed to access the target resource; redirection module 502, redirection module 502 is used to redirect the access request to the background server of the client; data processing module 503, data processing module 503 is used to extract the request from the access request The user information and the access target resource, and when the request user information is the same as any target user information in the target user list, send the access target resource to the client. Further, the gateway provided in Embodiment 5 is an SSL offloading gateway. It can be understood that the foregoing gateway is an SSL offloading gateway only as a specific example in this embodiment. In other embodiments of the present invention, it can also be other types of gateways, which can be flexibly determined according to actual needs. set up.

Compared with the prior art, in the gateway provided by Embodiment 5 of the present invention, the access request is redirected to the background server of the client through the redirection module 502, and a large amount of data accessible to the client and the data allowed to be accessed are stored in the background server. For the target users of these data, after the background server receives the redirected access request, it can obtain the list of target users who are allowed to access the target resource according to the access target resources that the client wants to access extracted from the access request, and store the list of target users and the target user information of the target user in the target user list are fed back to the gateway. After the communication module 501 receives the target user list returned by the background server, the data processing module 503 can combine the request user information extracted from the access request with the target user information. Compare the target user information of the target user in the target user list. If the requesting user information is the same as any target user information in the target user list, it means that the requesting user who sent the current access request belongs to the user who is allowed to access the target resource. At this time, the connection The client can prevent data from being accessed by unauthorized users by accessing the target resource, thereby improving data security during data resource access.

Embodiment 6 of the present invention relates to an electronic device, as shown in FIG. 6 , including: at least one processor 601; and a memory 602 communicatively connected to at least one processor 601; The instructions executed by the processor 601 are executed by at least one processor 601, so that the at least one processor 601 can execute the data resource access methods in the foregoing embodiments.

Wherein, the memory and the processor are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors and various circuits of the memory together. The bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein. The bus interface provides an interface between the bus and the transceivers. A transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium. The data processed by the processor is transmitted on the wireless medium through the antenna, further, the antenna also receives the data and transmits the data to the processor.

The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Instead, memory can be used to store data that the processor uses when performing operations.

Embodiment 7 of the present invention relates to a storage medium storing a computer program. The above method embodiments are implemented when the computer program is executed by the processor.

That is, those skilled in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, the program is stored in a storage medium, and includes several instructions to make a device ( It may be a single-chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-OnlyMemory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (10)

1. A data resource access method, characterized in that it is applied to a gateway, comprising: receiving the access request sent by the client, and extracting the requesting user information and the access target resource from the access request; Redirecting the access request to the background server of the client; receiving the target user list returned by the background server, the target user list including target user information allowed to access the access target resource; If the requesting user information is the same as any of the target user information in the target user list, sending the access target resource to the client. 2. The method according to claim 1, wherein before the redirection of the access request to the background server of the client, the method further comprises: judging whether the gateway saves the requesting user information; If the gateway stores the requested user information, send the access target resource to the client; If the requesting user information is not saved in the gateway, the step of: redirecting the access request to the background server of the user terminal is performed. 3. The method according to claim 1, wherein said extracting request user information and access target resource from said access request comprises: Extracting the user cookie of the user terminal and the access target resource from the access request. 4. The method according to claim 1, wherein after extracting the requested user information and the access target resource from the access request, the method further comprises: Create a user session one-to-one corresponding to the requesting user information according to the requesting user information, and set a user cookie corresponding to the user session. 5. according to the described method of claim 3 or 4, it is characterized in that, described method also comprises: Create a target session one-to-one corresponding to the target user information according to each of the target user information, and set a target cookie corresponding to each of the target sessions; If the user cookie is the same as any of the target cookies, it means that the requested user information is the same as any of the target user information in the target user list. 6. The method according to claim 1, wherein the receiving the target user list returned by the background server comprises: receiving the interface call credential demand returned by the background server according to the access target resource, the interface call credential demand including the interface call credential for returning the target user list demand; Sending the interface calling credentials to the background server according to the interface calling credentials requirement; and receiving the target user list returned by the background server. 7. A data resource access method, characterized in that it is applied to a backend server, comprising: receiving the access request sent by the client, and extracting the access target resource from the access request; A target user list is returned according to the access target resource, and the target user list includes target user information that is allowed to access the access target resource. 8. A gateway, characterized in that, comprising: A communication module, the communication module is used to receive the access request sent by the client, and receive the target user list returned by the background server, the target user list includes target user information that is allowed to access the access target resource; A redirection module, the redirection module is used to redirect the access request to the background server of the client; A data processing module, the data processing module is configured to extract the requesting user information and the access target resource from the access request, and when the requesting user information is the same as any one of the target user information in the target user list , sending the access target resource to the client. 9. A gateway, characterized in that, comprising: at least one processor; and, a memory communicatively coupled to the at least one processor; Wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can perform any one of claims 1 to 6. The data resource access methods described in the item. 10. A storage medium storing a computer program, wherein the computer program is executed by a processor to implement the data resource access method according to any one of claims 1 to 6.

Images